Making a MX device use internal DNS.

[mrpackethead_]

Hi, Is it possible to make a MX device use internal DNS servers that are reachable over the Site to Site VPN?  I easily make devices, ( AP's, Switches ) do this,  as they get DNS via DHCP.   

Am i missing something very simple here/

[ww]

It needs public dns on the uplink for management because it need to reach the cloud /dashboard to come online and before the tunnels are build.

You can use any dns you like on the vlans

[sinelnyyk]

Hi @mrpackethead_,
Unfortunately, it's not possible to configure the MX WAN interface to use DNS server which is reachable over the Site to Site VPN from the MX. This is because the MX WAN interface doesn't participate in VPN, and all traffic from the MX management interface will be sent directly to WAN link, so you need to make sure that the server is reachable from WAN interface. It doesn't necessarily mean that it should be a public IP though. If your MX is behind NAT and using an IP in a private range, you can use the DNS server that will be in the private subnet as well. 

[mrpackethead_]

.

[GIdenJoe]

This would defeat the purpose of your uplink monitoring.  Your MX needs to be able to reach external DNS servers to test DNS query/responses so it can report the WAN uplink is up or down.

Why would you actually want the MX to use an internal DNS anyway?  The sites it tests for are quasi hardcoded anyway.

[mrpackethead_]

The 'why' is because of a bit of annoying technical debt.  I have 802.1x auth Occuring, and they need to be be able to resolve the radius servers names.      Unfortantly for a "bunch of reasons" there is some split dns, where the public dns wont' resolve to the correct address's. ( this is because the public dns is being used for some managment of the radius servers, turns out thats a bad idea, but thats how it is)

"The MX and Z-series devices use the Appliance LAN IP of the highest-numbered VLAN that is included in the VPN as the source address to reach the RADIUS server located on the other side of the VPN tunnel. ".

This suggests that even though this is coming from the 'managment' it will go over the VPN.    But the DNS request for the radius servers is going to go out the wan.. 

I think i'm going to have to fix that split horizon dns.

MX and Z-series Source IP for RADIUS Authentication - Cisco Meraki Documentation

[PhilipDAth · Accepted solution]

Others have given good answers.  I'll add this link to how the DNS is used by the MX for WAN link monitoring.

https://documentation.meraki.com/MX/Firewall_and_Traffic_Shaping/Connection_Monitoring_for_WAN_Failo...