ZTNA and AD operations

[Satory]

Hi all,

I am trying to establish a ZTNA replacement of our VPN for all AD-joined devices.

The first problem I have encountered is that workstations cannot resolve the domain controllers - our internal DNS server is accessible on TCP 53, but it tries UDP 53 to the DHCP provided DNS server of my remote users.

So my users are unable to change their passwords, force local password changes and etc.

Does anyone succeeded in establishing ZTNA for AD environment?

[AEK]

Hi Satory

As per my knowledge regular clients use UDP 53 for DNS, not TCP 53 (please double check).

TCP 53 is used in few specific cases, like zone transfer between DNS servers.

[Satory]

You are not correct - you may fallback and use tcp 53, the problem is that windows uses udp by default.

Still I can't believe no one uses ZTNA for AD access...