I am connecting to a Cisco IPSec tunnel from MacOS to a hosted pfsense box that is running a number of other IPSec site-to-sites happily, and the DNS resolution is not working. I also am in full control of the configuration, and am able to make changes if needed to get this working.
When the VPN interface comes up on 10.10.3, I can see in the System Preferences Window that both the Search Domains and DNS Servers have been set properly.
However, when I run "scutil --dns", the resolver shown has mysteriously had a 'p' added to the domain name, e.g.,
internal.mynetwork.com from the system preferences (and, DCHP configuration) has become
internal.mynetwork.comp. If I use scutil to correct this configuration (in a similar fashion to here) DNS resolution for *.internal.mynetwork.com works as expected. Unfortunately when I bring the VPN down this configuration is lost.
Here is the relevant output - note the trailing 'p' in the top resolver sections and it's absence in the bottom one. This 'p' has not come from the DHCP configuration and does not appear in the interface configuration in the System Preferences panel.
DNS configuration resolver #1 search domain : internal.mynetwork.comp search domain : home nameserver : 192.168.1.1 flags : Request A records, Request AAAA records reach : Reachable,Directly Reachable Address resolver #2 domain : internal.mynetwork.comp nameserver : 192.168.20.1 flags : Request A records, Request AAAA records reach : Reachable,Transient Connection order : 100200 DNS configuration (for scoped queries) resolver #1 search domain : internal.mynetwork.com nameserver : 192.168.20.1 if_index : 10 (utun0) flags : Scoped, Request A records reach : Reachable,Transient Connection resolver #2 search domain : home nameserver : 192.168.1.1 if_index : 4 (en1) flags : Scoped, Request A records, Request AAAA records reach : Reachable,Directly Reachable Address
Is this a known bug with a known solution?