lunads
Hi all,
I've read the example of how to post, we're not using a server but I'll briefly describe the setup and the issue.
We're an IT service provider and this issue arrised at a client with around 80 users.
They were connected through a Sonicwall NSA 3500 firewall and were using the Global VPN Client.
The firewall was outdated and was 8 years old.
We replaced it with a Watchguard M200 in a cluster setup.
Behind the firewall is a standard active directory domain with 3 domaincontrollers handling DNS, DHCP, ...
We configured AD integration for authentication when connecting with VPN.
On the Watchguard we configured Mobile SSL VPN, as we do for all of our clients.
We generally always use the OpenVPN client because it works like a charm, it's lightweight etc... (latest version from the website)
For this client a GPO exists, like with any other client, to update drive mappings: \\servername\sharename
When they connect to VPN, the network drives cannot be openend, they receive an error that the network location cannot be found.
This smells like A DNS issue.
However, we configured the Watchguard Mobile SSL VPN settings to append their domain as a DNS suffix.
We also push the internal DNS server IP addresses along.
We verified that the settings are pushed correctly, as you can see on the screenshot below.
The strange part is that the issue is resolved just by restarting the VPN connection.
Network drives are then immediately resolved.
When I test this, and my laptop is not joined in the domain, it works from the first time, please refer to this screenshot, you can also verify that the domain suffix and the DNS servers are pushed:
[img]https://imgur.com/a/1QyT3[/img]
[url]https://imgur.com/a/1QyT3[/url]
Do notice, and this is nothing new, that you can see that I was connected with my LAN adapter on their network earlier today: the 'ethernet adapter Ethernet' says media disconnected, but it still 'remembers' the domain name. It will only change or update this when I connect to a network which pushes a domain name, using my LAN adapter. This is nothing new, windows has been doing this for as long as I remember.
I've got a feeling this might be the cause of the problem?
As you can see my Wireless LAN adapter doesn't have their domain name, but it has our own, since I'm now connected to the wifi in our office. (the .local domain)
A realistic scenario is where users are at the office, connected by wifi, then goes home and connect back to the office using their home wifi (I assume end users don't configure their home router to push a domain suffix, but then again, assumption is the mother of all fuck-ups) and the OpenVPN client. The domain suffix is still 'remembered' and maybe when they click a network drive, the laptop will start searching their home network?
Anyway, this is resolved by reconnecting the VPN and voila...
Again: this is only a suggestion.
Nothing on the network or on the server side changed, so the clients 'remembering' the domain suffix was also the case when they were using the Global VPN Client to connect to the Sonicwall firewall.
Perhaps this client had something built in to handle this?
Is this a known issue or isn't this the cause at all?
What we tried was changing the GPO to map the network drives using IP addresses, but this caused Ms Office to see all network files as 'unsafe' and the protected view triggered, for all the users who are at the office.
So this isn't quite an option to do.
We also tried \\servername.domain\sharename, so the FQDN, but then Ms Office also triggers the protected view when opening files from the network drives.
This is still active at the moment, since have protected view enabled is still less annoying then not being able to access network drives at all, when using VPN.
The strange thing is that users who are connected at the office using LAN, go home and connect back to the office using their wifi, so a different adapter which perhaps didn't have their domain suffix, and they have the same issue. Restarting the VPN client solves it again.
We're a bit lost here in how to solve this.
We haven't tried this with the Watchguard client yet because we prefer using OpenVPN.
Any help is appreciated.
