Pulse Connect Secure DNS resolution on External interfacee

[ae]

Hi.

Trying to configure Pulse Connect Secure appliance to provide remote access for a small environment w/o any internal DNS servers, so it's being configured with some external DNS servers (Google ones) to be accessed via an External interface:

However, while the servers are reachable via ping from the same appliance on the External port:

The same appliance it still unable to resolve anything:

Are there some sort of limitations on DNS quesries form External interface? If not, can this be explaned by some other reason?

Thanks.

[grafal]

Hello Ae,

You have the ports mixed up.

The External Port is not used for resource access thus it also does not handle DNS resolution.

The sole purpose of the external port is to serve as a connection interface for users  connecting externally to the device.

Resource access and DNS resolution is handeled by the Internal Port, therefore the DNS servers specified should be reachable via the Internal Port.

Hope that helps.

[ae]

Hello.

That's the point - we want to use Pulse Connect Secure appliance to remotely access some small isolated remote management network. So Internal interface is connected to this network (that has no DNS servers) and External interface is connected to an uplink to the world and is used by clients to establish a connection to. 

We would be fine w/o DNS as such, but we're trying to set up Duo 2-factor auth, so we need to connect to external LDAP server via it's hostname. So the idea was to use some sort of external public DNS for this purpose. Is it not possible?

Thanks.

[grafal · Accepted solution]

Hello unfortunately what you are trying to do is not possible.

Everything is by design tied to the Internal Port- if there is no route from the Internal Port to the external DNS servers, then the DNS resolution will not work.

The device will not switch to resolving via the external port, there is also no option to decouple the traffic and make it go throu the external port.

Hope that clears it up

[ae]

Many thanks, I'd imagine we should think of some other way to achieve this then.

[zanyterp · Accepted solution]

As grafal mentioned, using DNS it is not possible
As long as the Duo server you are assigned to has a static IP, though, you can use the hosts file to reach it for validation (as long as internet traffic is allowed on the small network)