Description

This article provides guidelines on how to resolve an issue where the Juniper Secure Connect (JSC) client on macOS fails to install DNS settings when split tunneling is configured.

To ensure proper DNS configuration on macOS, the domain name must be explicitly defined under the remote-access client configuration.

Symptoms

Symptoms

  • JSC client successfully connects, but DNS settings are not applied correctly on macOS
  • Internal domain name resolution fails
  • DNS servers may be assigned, but domain-specific resolution does not work

Solution

Root Cause

In split tunnel deployments, macOS requires an explicit domain name configuration to associate DNS servers with the VPN interface.

If the domain name is not configured under the remote-access client configuration, the JSC client does not properly install DNS resolver entries.

 

Solution

1. Configure Domain Name

Add the domain name under the JSC client configuration:

 

set security remote-access client-config <client-name> domain-name <domain name>

 

2. Example Configuration

IPsec VPN Configuration

 

root@vSRX>show configuration security ipsec vpn Juniper-Secure-Connect 

bind-interface st0.100;

df-bit clear;

copy-outer-dscp;

ike {

  gateway Juniper-Secure-Connect;

  ipsec-policy Juniper-Secure-Connect;

}

traffic-selector ts-1 {

  local-ip 10.20.24.0/24;

  remote-ip 0.0.0.0/0;

}

 

Address Pool with DNS Servers

 

root@vSRX> show configuration access address-assignment pool JSC-pool 

family inet {

  network 10.99.98.0/24;

  range 10-99-98-0 {

    low 10.99.98.100;

    high 10.99.98.110;

  }

  xauth-attributes {

    primary-dns 10.20.24.53/32;

    secondary-dns 10.10.10.10/32;

  }

}

 

Remote Access Client Configuration

 

root@vSRX> show configuration security remote-access client-config Juniper-Secure-Connect 

connection-mode manual;

dead-peer-detection {

  interval 60;

  threshold 5;

}

domain-name example.local; <

 

Verification

Logbook from the client:

15.04.24 18:25:25 IPSec: Assigned IP Address:IPv4=10.99.98.107,IPv6=0.0.0.0

15.04.24 18:25:25 IPSec: Assigned IP Network Mask:IPv4=255.255.255.255,IPv6=0.0.0.0

15.04.24 18:25:25 IPSec: Gateway IP Address:IPv4=0.0.0.0,IPv6=0.0.0.0

15.04.24 18:25:25 IPSec: Primary DNS Server: 10.20.24.53 <

15.04.24 18:25:25 IPSec: Secondary DNS Server: 10.10.10.10 <

 

MacOS terminal scutil --dns             

resolver #2

 domain  : example.local

 nameserver[0] : 10.20.24.53

 nameserver[1] : 10.10.10.10

 flags  : Supplemental, Request A records, Request AAAA records

 reach  : 0x00000002 (Reachable)

 order  : 101400

 

Flow session on the vSRX:

Session ID: 1622, Policy name: Juniper-Secure-Connect-2/9, Timeout: 4, Session State: Valid

 In: 10.99.98.107/50225 --> 10.20.24.53/53;udp, Conn Tag: 0x0, If: st0.100, Pkts: 1, Bytes: 74, 

 Out: 10.20.24.53/53 --> 10.99.98.107/50225;udp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 115,
 

 

Summary

In split tunnel configurations, macOS requires the domain name to be explicitly configured for JSC to properly install DNS settings. Adding the domain name under the remote-access client configuration resolves the issue and enables correct DNS resolution.

Modification History

2024-05-06 : Article Created

2025-02-04: The domain name example was changed.