I'm very happy with my multisite DirectAccess deployment so far. IPHTTPS is used as the only transition technology and the Intranet is full dual stack (IPv4+IPv6). So, no ISATAP is needed at all. The last step is activating a manage out scenario. For this manage out scenario I have some trouble getting it working. Let explain the issue in more depth.

I've observed that the IPHTTPS Tunnel interface on the DA client gets two IPv6 addresses from the DA server irrespective of the setting 'Randomize Identifiers' in the global IPv6 setting on the DA client (netsh int ipv6 set global rand=dis|ena). The effect is that the DA client uses the temp IPv6 address to setup the IPsec tunnels to the DA server, but that only the normal IPv6 address is registered in the intranet DNS. I belief the latter is normal behavior.

Therefore, in a manage out scenario (i.e. RDP from an Intranet server into a DA client) a request is made to the normal IPv6 address of the DA client but there is no established IPsec tunnel yet. In other words you need to create on the DA client a specific Windows Firewall rule to allow IKE traffic inbound in order to establish an IPsec tunnel from the DA server to the DA client.

I can't find any reference to this important step in any documentation. I also remember vaguely that in some Windows 10 builds the temp IPv6 address was not assigned to DirectAccess clients by default (*).

So, the obvious question is, is what I observed correct and if so, can we disable the DirectAccess temp IPv6 address on the IPHTTPS Tunnel interface for Windows 8/8.1 host?

Added 28/08/2015: I've just tested the Windows 10 RTM version and as far as I can tell, it gets a temp IPv6 address too. Therefore the question can be extended to Windows 10.

(*) See http://blogs.technet.com/b/martin_j_solis/archive/2015/03/20/additional-way-to-monitor-directaccess-machine-user-activity-on-windows-2012-and-2012r2-directaccess-with-component-even-logging.aspx .

Best Regards,
Stefaan

• Edited by spouseele Friday, August 28, 2015 10:55 AM added Windows 10 experience

Hi,

>>Therefore, in a manage out scenario (i.e. RDP from an Intranet server into a DA client) a request is made to the normal IPv6 address of the DA client but there is no established IPsec tunnel yet.

We should add that intranet server into the management servers in the DirectAccess configure wizard.

Best Regards.

Hi Steven

adding those servers to the list of management servers doesn't help because that only add those IPv6-addresses to the ClientToInfra & DaServerToInfra DirectAccess policies and doesn't change the DA Clients IPv6 endpoint of the IPsec tunnel.

It all boils down to the typical management issue pull versus push. In other words, who initiates the connection, the client (pull) or the server (push) and that changes the IPv6 address used by the client for his IPsec tunnel endpoint.

Best Regards,
Stefaan

• Edited by spouseele Monday, August 31, 2015 9:32 AM

Problem only partially solved...

By using the command netsh interface ipv6 set privacy state=disabled we can disable the assignment of an IPv6 temporary address to the DA client.

Further testing reveals that with no IPv6 temporary address assigned to the DA client, a manage out (push) scenario without a specifice IKE inbound rule on the DA client only works if both the Infrastructure and Intranet tunnel are active, even if we test from a DC. In all other cases, we still need a specific IKE inbound rule on the DA client.

Best Regards,
Stefaan

• Edited by spouseele Monday, August 31, 2015 6:38 PM added further test results

Hi,

>>In all other cases, we still need a specific IKE inbound rule on the DA client.

Management servers specified in Step 3 of the DirectAccess Setup Wizard can initiate connections with DirectAccess clients using a management tunnel. The management server can connect to the DirectAccess client before the user has logged on. Alternately, the management tunnel can be established by the DirectAccess client computer when it initiates communication with a management server.

To troubleshooting the management issue, the following guide may be helpful:

https://technet.microsoft.com/pt-pt/library/ee844097(v=ws.10).aspx

Best Regards.