iPhone cisco IPsec VPN split dns entries?

Here is a sample (sanitized) config from my Cisco ASA vpn group policy.

group-policy vpnpolicy internal
group-policy vpnpolicy attributes
wins-server value ipaddress1 ipaddress2
dns-server value ipaddress1 ipaddress2
vpn-tunnel-protocol IPSec svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value AdminSplit
default-domain value youdomain.local
split-dns value yourdomain.local yourdomain.com
address-pools value dhcppool1

Hope it helps everyone.

"Several" years ago, we had a Pix and were using the Cisco client. When we upgraded everyone to Windows XP, we simply began to use the Windows L2TP over IPSec client. I don't know what the IT folks did to facilitate that in the Pix, but the impression I have was that our initial Pix configuration accepted the Windows VPN client.

Have you tried using L2TP on the iPhone? The advantage with the L2TP client is that there's a simple switch to select split-tunnel.

I have not tried L2TP but may in the future. But that will require setting up an IAS authentication server for L2TP.

Also note that split-tunnel is only part of this. I had to use split-dns as well.

Now that I have IPsec working I am hesitant (and lack sufficient motivation) to muck with it. 😉

Message was edited by: tmhunt2

I just got done setting mine up with our network. Thankfully, I build the VPNs. 🙂

I'm using a Cisco 3640 running IOS 12.4(21). 3DES Crypto image.

Not much to configure on the iPhone side, as we all know. The key really lies on the terminating device.

Basically, if your VPN is NOT configured to use split-tunnel, you're all set. All your traffic will pass through the VPN, and you'll be good.

If your VPN IS configured to use split-tunnel, then it needs to be configured for split-dns on each of the domains that need to resolve through the tunnel.

The iPhone doesn't seem to accept the DNS servers that the VPN endpoint tries to assign to it, so the only way to get this to work if split-tunnel is in play is via the split-dns method.

Can anyone provide me a sanple configuration on the Cisco 3640 router running IOS for establishing iPhone VPN connection? I couldn't get it to work.

tbeecher (and others)

I'm also looking for information on how to configure a IOS based VPN router to work with the iPhone.

With our current config it looks like the iPhone VPN logon stalls after phase 1 is complete or almost complete. It never enters phase 2.

Any pointers would be greatly appreciated.