KB29078 - Domain Name Resolution (DNS) lookup fails on iOS operating systems when Pulse Secure Mobile client is used and split tunneling is enabled

This article describes hostname lookup failure on Mac OS X and iOS, when split tunneling is enabled for Pulse Secure Mobile Client.

When Pulse Secure Mobile Client is configured in split tunneling mode, there are two DNS search-order options under Users > Resource Policies > Network Connect (Pre 7.2)/ VPN Tunneling (7.2 and above) > Connection Profiles > [Profile_name]:

• Search client DNS first, then the device.
• Search the device's DNS servers first, then client.

Currently, iOS does not support the sending of multiple DNS requests.

Due to this limitation, DNS requests that match DNS suffixes listed under SupplementalMatchDomains are sent through the tunnel.

All other requests are sent through the physical interface.

So, it is necessary to ensure that proper DNS suffixes are added to the SupplementalMatchDomains list.

The procedure for ensuring this is presented below.

Scenario 1:  PCS DNS Settings configured on VPN Tunneling Connection Profiles

1. Navigate to System > Network > Overview.
2. Under DNS name resolution, enter all DNS domains that need to be tunneled

Scenario 2:  Manual DNS Settings configured on VPN Tunneling Connection Profiles

1. Navigate to Users > Resource Policies > VPN Tunneling > Connection Profiles.
2. From the list, select the corresponding VPN Tunneling Connection Profile.
3. Under DNS Setting, enter all DNS domains that need to be tunneled.

Scenario 3:  DHCP DNS Settings configured on VPN Tunneling Connection Profiles

1. If this option is configured, add all DNS domains that need to be tunneled to the corresponding DHCP profile on the DHCP server.