Hello, We have the same problem but with FAP 231F and Cisco AnyConnect.
The client connects well, an IP address is obtained, but no DNS traffic
goes into the tunnel. (ping on the IP OK). This happens for an unknown
reason. Other SSIDs on the same FAP...