Sophos Connect IPsec DNS suffix not working

Question

I am in the process of setting up an XG 135 with remote IPsec VPN access and it is working apart from the DNS suffix. 
 I have configured the " DNS server 1" to our local DNS server in the "IPsec (remote access)" tab within Configure/VPN. I have also configured " Assign client DNS suffix". 
 When I connect to the VPN using Sophos Connect, I can see that a new "Ethernet 2" adapter of type "Sophos TAP Adapter" is created. If I look at the TCP/IP properties for this adapter I can see that the DNS server has been populated with the one that I configured in "DNS server 1". However, the DNS suffix is not populated anywhere. 
 The result of this is that I can ping hosts using their IP address or fully qualified host name. I cannot ping using just the host name until I manually configure the DNS suffix. 
 I have also been testing the equivalent scenario with SSL VPN and I get the desired behaviour with it. Ideally both kinds of VPN would behave the in the same way as it would make the setup simpler to explain to users. 
 The XG 135 has SFOS 18.0.4 MR-4 and I am using Sophos Connect v2.0.34.0910. 
 It seems like a software issue to me in Sophos Connect but maybe I am missing something. Unfortunately I have had very painful experiences with Sophos Support over the past few weeks where they remain largely unresponsive and wait a week between emails. I don't know if they monitor these forums but I don't imagine I'm the only one to have experienced this.

Alan Spark · Answer

Hi Emmanuel, 
 Thank you for providing the EAP version. I can confirm that it made no difference. 
 However, after you said that the TAP adapter had been updated in your test I did some more experiments. 
 These are the original two test machines that I have been using: 
 Test Machine A (Windows 10 build 18363.1379, desktop with Ethernet) Test Machine B (Windows 10 build 19041.264, VM with NAT network adapter) 
 This morning I introduced two more test machines: Test Machine C (Windows 10 build 15063.1387, laptop with Wi-Fi) Test Machine D (Windows 10 build 19041.804, desktop with Ethernet) 
 Test Machine A has VirtualBox installed whilst Test Machine D has VMware installed. Both of these create virtual network adapters. Test Machine C has no virtualisation software installed. 
 To my surprise Test Machine C populated the DNS suffix on the TAP adapter. Worth noting that it is running quite an old version of Windows 10. However, I don&rsquo;t think this is relevant. Test Machine B is a VirtualBox VM and normally I run my VMs with a NAT adapter but I tried changing it to a bridged adapter and this allowed the DNS suffix to be set. 
 I was beginning to think that VirtualBox may be involved so I tried uninstalling it from Test Machine A and then reinstalling Sophos Connect. However, this made no difference. 
 I had hoped to provide a definitive pattern to you but unfortunately it still seems a bit random. Hopefully it will make it a bit easier for you to reproduce. I think it is clear that it is a software issue at the client end so I we&rsquo;re probably going to have to deploy it with the manual workaround for now. 
 Regards, Alan

emmosophos · Answer

Hello Alan, 
 Thank you for contacting the Sophos Community. 
 Make sure under IPsec (Remote Access) in Advances Settings you configured the DNS Suffix. 
 Or if you&rsquo;re using the Admin Tool you should have that option available too. 
 If you confirmed it is configured, please share the output of ipconfig /all and the Open VPN Log from the IPsec client. 
 Additionally, if you could share your Case IDs I can follow-up. 
 Regards,

Sophos Connect IPsec DNS suffix not working

Top Replies