We have a hub & spoke network where branch offices are connected to the corporate office via L2L VPN with ASA's on both sides. There are no Domain Controllers at the Branch offices so DHCP is configured on the ASA with the primary DNS server being an Internal DNS server in the corporate office and the secondary is a public DNS server in case the tunnel goes down. Everything seems to be working with this. The corporate ASA also hosts an SSL VPN for remote clients which is using split-tunneling and split-DNS and this works fine when clients connect from outside of the offices.
The problem we're having is if a client needs to launch AnyConnect from one of the branch offices. DNS resolution works for the internal DNS domains configured in the split-DNS but it won't resolve external domains. IP traffic gets routed properly and we can ping any address we need to by IP but we can't resolve DNS to those external domains.
The way things are configured a client in the branch has a primary DNS server located in the corporate network with the address of 10.1.2.3. When the client connects with AnyConnect, his DNS server for that connections would also be 10.1.2.3. With the VPN connected the 10.1.2.3 address would get routed over the SSL VPN. The split-DNS rule tells the client not to use the AnyConnect DNS server but instead use the DNS server attached to the physical network adapter ... it seems like a catch 22. How should I configure this to get external DNS to resolve from the branch offices?
