Cyberoam DNS request routing

Hello all,

I'm in need of help with an issue using cyberoam FW. I know its not the best FW, but currently this is what I'm given to work with. I've summarized the issue below, I'd really appreciate if someone can suggest a solution? one of the solution that could fix the issue is a function used on Sophos FW called DNS request routing however that function is not available on Cyberoam FW. Please see below link to the sample topology.

· Clients (Win10,7) on left-hs are not able to reach the AD server on right-hs

· There is strongswan ipsec tunnel between cyberoam and AWS-VPC.

· DHCP to clients (win10,7) is from cyberoam.

· If we set static DNS on cyberoam with winAD server IP, the client still can’t authenticate with AD.

· At the moment primary DNS is 8.8.8.8 and seconday DNS is WinAD server IP, clients are able to browse internet but not authenticate with AD. If we swap primary & secondary DNS client cannot browse and cannot authenticate.

https://drive.google.com/open?id=1RuuRPwNFpgpgVsNcmIo05XZAYzCEVh8S