KB43802 - Tunnel disconnects intermittently with Location Awareness enabled with FQDN split tunneling or Device Only DNS

Tunnel disconnects intermittently with Location Awareness enabled with FQDN split tunneling or Device Only DNS

1. When the policy evaluation is TRUE, the Pulse Desktop client will take action to establish a connection.
2. When the policy evaluation is FALSE, the Pulse Desktop client will disconnect.
3. Any network changes will cause location awareness rules to be re-evaluated when the Pulse client is connected or disconnected for the tunnel.

• If the location awareness rule is configured for a resolvable name with "NOT pulsesecure.net" for an internal IP address only, then the following logic will apply:
  • If the DNS name is not resolvable or resolve to a public ip address, then it will automatically disconnect from the tunnel
  • If the DNS name is resolvable to internal IP address, then it will leave the Pulse client in the same state regardless if the Pulse client is or is not connected to a tunnel.

1. Action is set to Resolve Address with Interface selection is set to Any (This configuration is not recommended)
2. Action is set to DNS Server with Internal DNS names. (This configuration is not recommended for FQDN Split tunneling or Device DNS Only)

Pulse Secure recommendation for location awareness would be the following:

• Configure the Location Awareness rule for Physical interface with the rule action is set for Resolve Address.
• Create a rule for Resolvable Address for an internal dns name that is only resolvable to an internal ip address
• Set Location awareness rule for Custom as a NOT rule.

Instructions:

1. Login to admin console
2. Navigate to Users > Pulse Secure Client
3. Select the corresponding Connection set
4. Under Connections, select the corresponding connection
5. Under Location awareness rules, click New

6. Under Name, enter a friendly name
7. From the Action drop-down menu, select Resolve address
8. In DNS name field, enter the internal dns name
9. Under the IP field, enter the internal ip address associated with the DNS name
10. Under Interface, leave as Physical

11. Click Save Changes
12. Under Require, select the radio button for Custom
13. In the Custom field, enter NOT <rulename> (i.e. NOT PulseSecure)

14. Click Save Changes