How to Enable VPN Compatibility Mode on Windows
In SecureEdge Manager, you can enable VPN Compatibility mode for Windows only. This feature is required when a user is using the SecureEdge Access Agent (SEA) with a dedicated web filtering solution that is both always running and configured with Tamperproof. VPN solutions handle network traffic differently. If a user’s VPN uses the WFP driver to block all traffic, they likely need this feature.
VPN Compatibility Mode is supported only on Windows. Other operating systems are not supported.
For VPN Compatibility mode to work, use Barracuda SecureEdge Access Agent version 3.0.3 or higher.
Step 1. Enable VPN Compatibility Mode in SecureEdge
Go to https://se.barracudanetworks.com and log in with your existing Barracuda Cloud Control account.
The chosen Tenant/Workspace is displayed in the top menu bar.
From the drop-down menu, select the workspace your SecureEdge Access should be configured for.
Go to Access > Settings.
Expand the Settings menu on the left and select Enrollment. The Enrollment Settings page opens.
In the Device settings section, specify a value for the following:
VPN Compatibility (Windows Only) – Click to enable and add a DNS server.
The Add DNS Resolver window opens. Specify values for the following:Protocol – Select the protocol. You can choose between TCP, UDP, or DoT (DNS over TLS). By default, UDP is the default protocol. Note: DNS over TCP is recommended because it helps avoid any web filtering restrictions that may be enforced by a third-party VPN solution.
IP Address – Enter the valid IP address.
Port – Enter the port number for the DNS resolver.
You can see that the DNS server has been added.
You must configure local breakout domains for internal hostnames that need to resolve correctly. This DNS server handles and resolves that network traffic.
To verify, run the following command in Windows Command Prompt:
netstat -ano | findstr 53.
Note: This sets up the127.0.0.1loopback listener on the SecureEdge Access Agent to accept DNS requests on port 53 and forward them to the SecureEdge service.In Task Manager, go to service details and check SecureEdge tunnel; note that the PID matches
18860.
DNS Server Requirements and Protocol Verification
DNS Server requirements
If you use UDP, avoid using port 53 to prevent conflicts with other VPNs and potential blocking.
DNS protocol verification
Verify that your DNS configuration supports something other than UDP on port 53, for example:
DNS over TCP (recommended)
DNS over UDP on a separate port
DNS over TLS (DoT) (supported)
Step 2. (Optional) Configure a Third-Party VPN
You can now configure third-party VPNs such as: PAN GP, Fortinet, and Cisco AnyConnect.
Please note that all these VPNs should also automatically have Split DNS enabled by default because full backhaul on their traffic would otherwise break web filtering.
Below is an example setup for PAN GP.
Configure the PAN GP Side
Open the Palo Alto NETWORK firewall.
Go to the section to configure Global Protect VPN.
From the drop-down menu, select Gateways.
Click GP-Gateways in the Name column.
The GlobalProtect Gateway Configuration page opens.
To configure PAN GP DNS servers:
Click Agent and select Client Settings.
Select the GP_AgentConfig checkbox and click Ok. The Configs window opens.
In the Configs window select Network Services.
Specify your DNS Server settings. On PAN GP, set the agent interface with 127.0.0.1 as the primary DNS server and the user’s internal address as the secondary DNS server for devices that do not run the SecureEdge Access Agent for web filtering.
For example, if you are not using 127.0.0.1 or if you encounter any issues, having an additional DNS server provides a fallback option. It is recommended to configure a secondary DNS server to improve reliability and compatibility, especially since this feature is supported only on Windows.
The Commit window opens. Click Commit.
Wait for the commit to complete.
On the Palo Alto Network, reconnect the PAN GP VPN after the commit status completes.
You can check the interfaces to see that DNS forwarding now uses the loopback interface, changing from
8.8.8.8to127.0.0.1.
DNS requests should now go to SecureEdge Agent to enable web filtering. If you attempt to access forbidden sites, the web filtering policies will block you.
Configure the FortiGate Side
The VPN compatibility mode and the newer SecureEdge Access Agent enable SecureEdge to work with FortiGate. FortiGate differs from other VPN agents, so you do not need to enable VPN Compatibility mode.
Open FortiGate Client.
Click Edit. The Tunnel Settings window opens.
IPv4 split tunnel - To ensure only the required traffic is routed through the tunnel, enable IPP (for split tunneling) so that only the IP addresses within this range are backhauled. As shown here, the backhauled range includes the DNS range, which is why the DNS traffic is covered.
You can see IKEv2 with pre-shared key and encryption method.
To fix this issue, open the SecureEdge Manager, enable VPN Compatibility Mode and set the DNS server. Refer to Step 1 for details.
Open the Console, run the following commands, and then save the changes:
config vpn ipsec phase1-interfaceshedit “VPNTunnel1”set internal-domain-list“<Name of your internal domain>”
Run the following commands to verify your configuration:
config vpn ipsec phase1-interfacesh
You can see that setting is updated.
You can now disconnect and reconnect the FortiClient VPN and check for web filtering.
If you attempt to access forbidden sites, the web filtering policies will block you.
Configure the Cisco AnyConnect Side
This guide explains how to make Cisco AnyConnect work correctly with the SecureEdge Access Agent 3.03 by using split DNS and ensuring that DNS traffic is routed properly.
Prerequisites
SecureEdge Access Agent 3.0.3 running on the client connector/workstation.
Cisco ASA/AnyConnect VPN configured and established.
Windows client.
You know the internal DNS server / internal domain(s) you want split to.
Users may configure a DNS server for internal DNS. In addition, they must set split DNS for their internal domain(s) so that only specific domains resolve via the internal DNS.
Ensure “Split tunnel all DNS” is disabled to prevent backhauling all DNS traffic into the SecureEdge service.
In the Windows PowerShell console, the Cisco ASA/AnyConnect VPN connection is established and running.
Run the command to check the configuration:
show running-config group-policy VPN_SPLIT
You can see configuration for the DNS server. Note : Set a split-dns value for the domain so only certain domains resolve with the internal DNS and ensure that split-tunnel-all-dns is disabled to prevent all traffic from routing through SecureEdge service.
Run the SecureEdge Access Agent and Cisco AnyConnect.
To verify the Windows DNS configuration, run the following commands:
ipconfig /all
You will see all interfaces such as wireless interface, SecureEdge Access Agent, and Cisco AnyConnect with the DNS server value8.8.8.8. In addition, the Window IP configuration section lists the DNS suffix for all local domains.nslookup
For example,nslookup <google.com>is refused. This query tunnels into the Cisco Interconnect, which rejects it.
If you runnslookup <test2.com>, it resolves through the Cisco ASA and returns a different response. This domain is not valid, but the resolution still occurs via the expected path.
To confirm Web Filtering works, do the following:
Open a browser and attempt to access a blocked site (example commonly used:
guns.comor another domain you have in the policy).You will see the web filtering policy block the request as expected.
To check DNS resolution, follow these steps:
Open Windows PowerShell and run the command:
Resolve-DnsName<>For example:
Resolve-DnsName www.google.com
Google resolves by attempting queries across multiple interfaces. Even though Cisco AnyConnect may return a query refusal, the Windows DNS cache resolver retries using other interfaces and then reaches SecureEdge, which allows the resolution. This is how both Cisco AnyConnect and SecureEdge work together correctly.