Whether or not DirectAccess shows as "connected" in Windows is a simple probe query, and doesn't necessarily have anything to do with whether or not DA is actually connected. On your DirectAccess server, open up the configuration and go into the
settings inside Step 1. The page about NCA - Network Connectivity Assistant - these are the settings that matter for that probe. Whatever you have defined here is what is being queried by that NCA tool (the one that shows you "connected" or "connecting").
NCA won't show connected until it can validate connectivity to all of the probes listed here, so it's usually a good idea to keep it as a relatively short list, most of my customers have just one entry in here.
So based on that, your NCA not showing up as connected for a while doesn't make any bit of difference to the actual connection, your DA tunnels might be online just fine well before it shows "connected". But, pings are not a good way to validate
that the tunnels are fully online. DirectAccess is a combination of IPsec tunnels that are running inside an IPv6 transition tunnel, like Teredo or IP-HTTPS. When you RDP or file access or anything else to a server via DirectAccess, that traffic always flows
inside the IPsec tunnels, and this is a valid test that the tunnels are online. So an HTTP probe in the NCA properties will be a good determination that yes, everything with the IPsec tunnels is fully online. But ICMP traffic (pings) move outside of IPsec.
Inside the transition tunnel, but outside of the IPsec encrypted tunnel. Most of the time, as soon as you can ping internal servers, DA is fully functional. But there is a possible situation where you would be able to successfully ping, and yet the IPsec tunnels
may not actually be built, which would cause application traffic to fail.
To sum it all up - having one HTTP probe inside the NCA properties is the best way to keep from false negatives, whlie at the same time maintaining a 100% accurate description of the fully "connected" status. Oh, and yes sometimes NCA can be a
little slow to status update, it's not very often that users are sitting there on that purple screen waiting for it to say connected - most users don't even know that it exists in there. :)
-
Marked as answer by
jsc.19
12 hours 49 minutes ago