Split DNS

[USMC92]

Hola Meraki Community!

I'm upgrading a remote site from a Barracuda firewall to an MX64.  Now, this site currently has a "DNS Service" install on the Barracuda to split DNS.  This remote site has it's PCs domain joined (hence the current setup).  On the MX how am I able to do this (if necessary) to have normal internet requests go through ISP DNS, and only AD requests through the VPN tunnel?

[jdsilva]

You can't do this on Meraki.

[USMC92]

What would be "best practice" then so users can authenticate?  I typically setup IPsec tunnels, but don't want ALL their traffic flowing through the VPN.

[NolanHerring]

You just need to do split-tunneling then on the MX

Internet traffic goes out local, and traffic destined for 'internal' will go over the VPN.

DNS that you provide that subnet with should be internal DNS only if you want to ensure internal sites resolve.

See example below

[USMC92]

Thanks for the image.  My only issue here is our corporate firewall is not Meraki, it's Barracuda.  So when I select Spoke, I have no option of manually creating the hub.  Under Organization-Wide Settings I do have the Non Meraki Peer created.

[NolanHerring]

Here are some links that might help with what your trying to achieve. I've personally no experience with non-meraki VPN peers:

http://www.willette.works/merging-meraki-vpns/

https://documentation.meraki.com/MX/Site-to-site_VPN/Configuring_Site-to-site_VPN_between_MX_Applian...

https://documentation.meraki.com/MX/Site-to-site_VPN/Site-to-site_VPN_Settings

https://community.meraki.com/t5/Security-SD-WAN/s2s-vpn-between-Meraki-and-Non-Meraki/td-p/2487

[PhilipDAth]

@jdsilva is correct.  You should direct all your DNS requests to the AD servers.  The actual web browsing and the like will still go out the local circuit.

[USMC92]

So for the subnet that requires this, manually set the DNS to our AD Servers under the DHCP settings of that subnet, correct?

[NolanHerring]

Correct. If your MX is handling DHCP/DNS, then make sure you have your AD/internal servers placed there because it will go over the VPN and allow internal sites to resolve.

If you put one internal and one public, your going to have issues so don't do that

[USMC92]

Thanks for all the help everyone!

[dutchaviator]

It's while back since last response here but this issue as well.

We have a hub in Amsterdam with internet breakout plus internal DNS servers which have forwarders to resolve public DNS.

Now we have a site in Santa Cruz, when they want to use internal server(customer.local) they use our configured internal server in Amsterdam. Same goes for public server.

now this client in Santa Cruz goes over to google hangout, then it gets IP adresses back from NL hosted google servers. The client is then having hangout with NL servers (including the latency penalty).

This is where I need to have split DNS: resolve for .local domain's on my own servers, and the rest using the local internet breakout.

Still not supported?