AOVPN Network Interface sporadically reverts AutomaticMetric to Enabled

[togoboldly]

DPC Version 5.3.0

Within our tenant, we have DPC controlling a device tunnel with a backup user tunnel, with both set to have an InterfaceMetric of 1, to ensure that internal DNS queries are routed through the VPN tunnel before being sent externally towards the internet.

This works 99% of the time, but in some random cases it appears that Windows (we are running Win11 25H2, latest patches) is reverting the AutomaticMetric setting on the interface to Enabled, resulting in the InterfaceMetric being reverted to the default of 25. This in turn results in DNS queries being blackholed, and internal (network drive) access is then prevented.

This can be resolved in one of two ways:

• Switch to the backup user tunnel and then back to the device tunnel - this then re-applies the AutomaticMetric / Disabled setting, and the InterfaceMetric returns to 1.
• Manually utilise Set-NetIpInterface to specifically set the AutomaticMetric setting to Disabled. This also reverts the InterfaceMetric to 1.

We are unable to intentionally replicate this issue at will, and it does appear to be a Windows issue specifically, since allowing DPC to "reapply" its settings - by switching to another tunnel and back - restores functionality, implying that DPC is functioning as expected.

[ld0614]

Interesting issue... From the description it sounds like Windows has the profile metric saved correctly in the profile and is using it but then something is triggering a change on the VPN Network interface to revert back to its defaults.

DPC isn't directly involved at this layer as we leave everything except for the MTU to be configured by Windows and the Native VPN Client so if your feeling lucky (and ideally be able to replicate it) you could attempt to raise it as a support case with Microsoft.

I'll label this as a feature request as we do already have hooks into the VPN network interface at connection time to configure the MTU so it might be possible to extend this behaviour to resetting the interface metric as well. This doesn't happen often during an operational tunnel so would probably need an additional timer being built to handle regular checks as well...

If anyone else is also seeing the issue, please comment on this post so that I can prioritise based on impact

[mcnaugha]

I'm seeing this issue too with 25H2 10.0.26200.9106. We're new to DPC and noticed our split DNS wasn't working, when I'd hoped DPC was going to let us avoid NRPT.

VPN Tunnel Metrics set in the DPC config in Intune but on the actual clients the AutomaticMetric setting is enabled. Device and User tunnel both have 20. I set them to 3 and 4 respectively in DPC. The pbk has the desired setting from DPC.

Thanks once again Windows 11! The gift that keeps on giving.

[richardhicks]

@ld0614 I'm curious to know if DPC could validate interface metric settings after connection and adjust them to match defined policy if they don't align. Thoughts?