DNS for non domain devices over VPN

[KML100]

Have a hub and spoke VPN setup with DNS on hub network. Spoke network domain devices are provisioned by DHCP with our DNS. Any domain joined device can resolve DNS without issue. I have some android devices on the spoke side which will not resolve. The devices work perfectly when on the Hub side of the VPN. Any suggestions how I could force these to resolve?

[adambomb1219]

That's interesting, can the Android Devices ping the DNS server?  Are they assigned a different subnet on the firewall than the domain joined devices?  Are you using Identity based rules that the Android devices wouldn't match?  Do you see the correct DNS server on the Android device after DHCP has occurred? 

[KML100]

Replying to all your questions

Android Devices ping the DNS server? Yes by IP

Are they assigned a different subnet on the firewall than the domain joined devices? No same subnet

Are you using Identity based rules that the Android devices wouldn't match?  No

Do you see the correct DNS server on the Android device after DHCP has occurred? Yes, working perfectly by IP only.

[KML100]

I can hit everything by IP. But domain names do not resolve.

[Olivia_7]

you need to specify which DNS servers that the clients receive when they are allocated their VPN IP address when they connect

[KML100]

The DNS servers are my local domain DNS on my hub network. I have tested the same devices with this DNS configuration without the IPSEC VPN and they work.

[srajeswaran]

Android------Spoke-FW---------IPSecVPN---------Hub-FW-------DNS-Server

I assume this is the simple topology, can you run a sniffer on Hub FW and confirm if the DNS requests are reaching the Hub-FW or DNS-Server via VPN