Examkin

Soru

Zorluk: Çok zorVirtual Private Networks and Remote Access Security

A network engineer is troubleshooting a remote access VPN deployment. Remote workers connecting via an IPsec IKEv2 client can successfully establish Phase 1 and Phase 2 Security Associations and access internal servers by IP address. However, when users attempt to connect to internal resources using hostnames such as `server1.corp.internal`, the lookup fails or resolves to public internet addresses. The engineer needs internal hostnames to be resolved by the corporate DNS server across the tunnel while preventing general internet web traffic from being redirected through the corporate network. Which of the following configuration changes should the engineer implement on the VPN gateway profile?

  1. Configure Split DNS settings in the VPN client connection profile to route queries for `*.corp.internal` to the internal corporate DNS server.Cevap
  2. B
    Switch the VPN tunnel configuration from IPsec ESP to IPsec AH to enable Layer 2 encapsulation for DNS broadcast traffic.
  3. C
    Modify the IKEv2 phase 1 settings on the gateway to transmit tunnel negotiation traffic over TCP port 53 instead of UDP port 500.
  4. D
    Reconfigure the VPN gateway to encapsulate all client tunnel traffic over TCP port 443 to provide connection-oriented reliability for DNS queries.

Cevap

Configure Split DNS settings in the VPN client connection profile to route queries for internal domain names through the tunnel.
Configuring Split DNS pushes rules to the VPN client specifying that queries for internal domain suffixes (such as `*.corp.internal`) must be forwarded across the encrypted tunnel to the internal corporate DNS server, while all other DNS requests go to the local network DNS.

Adım Adım Çözüm

1
Analyze the business and technical requirements
Internal hostnames must resolve using corporate DNS, while public internet traffic must remain outside the VPN tunnel.
Users are experiencing name resolution failures for internal domains while split tunneling is active.
2
Evaluate name resolution mechanisms under split tunneling
Without Split DNS, client operating systems send all DNS queries to their physical network interface DNS server (local ISP).
Split DNS specifies target domain suffixes (e.g., `*.corp.internal`) that should be sent exclusively over the VPN interface to corporate DNS servers.
3
Select the correct configuration parameter
Enabling Split DNS pushes domain routing rules to the remote VPN client upon successful authentication.
This selectively sends internal DNS traffic across the tunnel while keeping regular internet traffic on the client's local network gateway.

Anahtar Kavram

Split DNS configuration in remote access VPN profiles
Bu soruyu puanla

Konular

Virtual Private Networks and Remote Access Security

Bu konudan daha fazla soru