Since no dropped DNS packets were showing in the packet filter live log, I ran tcpdump on the ASG, tracing on interface ipsec0 shows that the DNS standard query A from the L2TP client is seen by the ipsec0 interface, and that the client tries both DNS servers that are configured in Remote Access - Advanced.

These are the same servers that are configured in Network - DNS - Forwarders, and there are no allowed networks in the Network - DNS - Global, since my DNS servers are running Active Directory. According to the text on that tab, this should prevent clients from using the ASG as a recursive DNS resolver.

Does anyone out there have any ideas why ASG is not forwarding DNS requests for the remote access client?

What packetfilter rules did you setup for the VPN pool?

Barry

__________________
http://DealBert.net
Home & business end-user since v1.x

• ASL 6.3x, HP DL145 Dual Opteron, 1GB RAM, 6 gigE NICs, 50-IP Platinum License
  
• ASL 7.3x, Dell PE1550 Dual PIII 1GHz, 1GB RAM, 2 NICs, 50-IP Platinum License
  
• ASL 7.5x, 17-watt fanless mini-ITX system: MSI IM-945GSE-A Atom n270, 2GB RAM, Morex T3310 case. 2 Intel GigE, 3 VLANs. 80G 5200rpm 2.5" HD
  Netgear GS108T gigE VLAN switch & Linksys WRT54G WAP
  Total network infrastructure: 27 watts. 100-IP Home User. FiOS 10mb/2mb

Ok, I found the problem. Turns out there is one bug and one quirk in Windows XP (and probably other versions of Windows) that pertains to VPN connections. The bug is that even if you put the Remote Access connections at the top of the Adapters & Bindings in Network Connections - Advanced - Advanced Settings, XP will still use the LAN DNS server ahead of the DNS servers configured for the VPN connection. Even though I did the registry hack described in MS KB311218, this behavior was not corrected.

However, the real issue was that I could not resolve internal network names because DNS on the client could not do a reverse lookup on the VPN DNS server names, which were internal class C private addresses. This is because XP does not like it when the VPN adapter IP address is not in the same subnet as the VPN DNS servers.

I fixed this by creating a new VPN address pool with an address of 192.168.0.220/32 (I will expand it beyond 2 addresses later) to put the VPN adapter into the same subnet as the 192.168.0.3 DNS server.

Although it still uses the LAN DNS server first when doing an nslookup, it immediately resolves the internal names as soon as it gives up on the ISP's DNS server.