Description

When implementing split tunneling, for the Juniper Secure Connect (JSC) client to install the domain name on MAC OS, we need to specify the domain name under the remote-access client configuration.

Symptoms

Juniper Secure Connect is not able to install the DNS IPs in MAC.

Solution

When implementing split tunneling, for the JSC client to install the domain name on MAC OS, we need to specify the domain name under the remote-access client-configuration.

 

set security remote-access client-config <client-name> domain-name <domain name>

 

 

root@vSRX>show configuration security ipsec vpn Juniper-Secure-Connect 

bind-interface st0.100;

df-bit clear;

copy-outer-dscp;

ike {

  gateway Juniper-Secure-Connect;

  ipsec-policy Juniper-Secure-Connect;

}

traffic-selector ts-1 {

  local-ip 10.20.24.0/24;

  remote-ip 0.0.0.0/0;

}

 

root@vSRX> show configuration access address-assignment pool JSC-pool 

family inet {

  network 10.99.98.0/24;

  range 10-99-98-0 {

    low 10.99.98.100;

    high 10.99.98.110;

  }

  xauth-attributes {

    primary-dns 10.20.24.53/32;

    secondary-dns 8.8.8.8/32;

  }

}

 

root@vSRX> show configuration security remote-access client-config Juniper-Secure-Connect 

connection-mode manual;

dead-peer-detection {

  interval 60;

  threshold 5;

}

domain-name example.local; <

 

 

Logbook from the client:

15.04.24 18:25:25 IPSec: Assigned IP Address:IPv4=10.99.98.107,IPv6=0.0.0.0

15.04.24 18:25:25 IPSec: Assigned IP Network Mask:IPv4=255.255.255.255,IPv6=0.0.0.0

15.04.24 18:25:25 IPSec: Gateway IP Address:IPv4=0.0.0.0,IPv6=0.0.0.0

15.04.24 18:25:25 IPSec: Primary DNS Server: 10.20.24.53 <

15.04.24 18:25:25 IPSec: Secondary DNS Server: 8.8.8.8 <

 

MacOS terminal scutil --dns             

resolver #2

 domain  : example.local

 nameserver[0] : 10.20.24.53

 nameserver[1] : 8.8.8.8

 flags  : Supplemental, Request A records, Request AAAA records

 reach  : 0x00000002 (Reachable)

 order  : 101400

 

 

Flow session on the vSRX:

Session ID: 1622, Policy name: Juniper-Secure-Connect-2/9, Timeout: 4, Session State: Valid

 In: 10.99.98.107/50225 --> 10.20.24.53/53;udp, Conn Tag: 0x0, If: st0.100, Pkts: 1, Bytes: 74, 

 Out: 10.20.24.53/53 --> 10.99.98.107/50225;udp, Conn Tag: 0x0, If: ge-0/0/1.0, Pkts: 1, Bytes: 115,

 

Modification History

2024-05-06 : Article Created.

2025-02-04: The domain name example was changed.

2026-10-14: Minor edit.