DNS Resolution slow using Connect 2.0 and IPSec VPN connection

Hi AllanD : To narrow down and to confirm more during live issue time, If you may capture Wireshark PCAP on the end machine which is connected via Sophos connect, PCAP on XG, PCAP on end DNS server (If in house DNS server added in Sophos connect settings on XG) along with TCPDUMP, drop on port 53 over XG and once you have this logs - you may confirm more.

is there a Security Heartbeat requirement for the firewall rule allowing DNS?

That could be an indication.

But I also see some issues regularly with the XG DNS Server in normal operation:

if you nslookup towards the XG the first lookup may timeout while all following will definetely work.

Can you figure out, if this is a Windows or Firewall issue? 

Try a packet capture on the firewall, connect via SSLVPN and check if there are DNS Requests or not. If not, the client will likely not consider the firewall for DNS first. 

serverfault.com/.../vpn-connection-causes-dns-to-use-wrong-dns-server

No security heartbeat on the DNS rule.  With that said do you know how long the time out is? Because what we see is for the first about minute we can't access anything and then it starts working reliably afterward.

Read through that server fault article and while it does make sense I don't think it applies here, it seems the opposite of the issue we're having. In our case it seems like after the VPN is connected DNS resolution is still happening on the user's network with their internet provider router and then after a minute or two it starts going through the VPN connection. I think we might actually try that with some static DNS entries on their equipment just to see how much faster things resolved.

I think Lucar Toni's answer brings you in the right direction. I remember struggling around with this a while ago.

http://woshub.com/dns-resolution-via-vpn-not-working-windows/

But playing with metric manually is no fun and may cause other errors.

I found internal communication where I dumped DNS traffic in VPN on both: the physical NIC or WiFi Adapter and on the Tunnel Adapter.

You can see, the DNS request goes out on both adapters and the first answer wins and is then used as DNS server.

In our case, the DNS domain suffix is the same internally and externally. So it could be resolved on the VPN and LAN connection. On the LAN connection means, when aou're remote, that it uses public Internet DNS Servers.

look for query for SOA of your internal domain.

also I would install the 2.1 Connect Client on a machine known to have that issue and test if it is resolved. 2.0 Version is even more buggy than the current 2.1.