Hello,
one question : when you said that "Well, we know that the external interface does NOT need to be connected to the Internet.", does-it mean that my DA server could be behind a NAT without port forwarding ? (and that way recheable from Internet obviously with 2 public IP).
As I asked below :
social.technet.microsoft.com/.../516d1838-c9fd-4076-8fa1-f1bcf6b4da7f
Hi Xavier,
You can do this by NATing from public IP address to public IP address. The NAT device would have public IP addresses and forward the connection to another pair of public IP address on the UAG DirectAccess server behind it. Not sure this is supported though - but it should work.
Hello again and thanks !
I already try to know if this trick is supported :
social.technet.microsoft.com/.../d29b4570-6513-4595-9458-9250af1f918b
...bot no answers !
Xavier.
Hi Xavier,
I answered in the thread, but I'll answer here too.
We can't support it because we never tested that scenario and there may be things that break in a production deployment. It works in test labs and small deployments - but without testing, its hard to say what would happen under "stress" - so we can't support it.
Tom
Hi Thomas
I have a couple of queries.
According to the microsoft whitepaper on ISATAP, creating an ISATAP router will mean that all Windows Vista/Server 2008 and above machines will automatically start communicating with each other over IPv6 ISATAP addresses, which in turn will have an impact on AD Sites and Services, in that the subnets will no longer be relevant? The fix is to add the ISATAP range prefix to AD Sites and Services, however surely a 2003 AD will not accept 64bit values?
I could disable ISATAP/IPV6 on the hosts, but this would then mean I couldn't use any of these resources over direct access!
Also I believe NAT64/DNS64 doesn't support connections initiated from the Intranet to machines in the Direct Access extranet and thus management applications may fail to monitor/maintain machines that are off site for extended periods of time?
I would appreciate it if you could advise me on these points, as I would like to implement this solution initially as a PoC, but cannot currently enable the ISATAP router due to the above concerns.
Regards,
Conrad
Hi Conrad,
In most cases, the manage out limitations are more apparent than real. The vast majority of management activities are done by and agent on the client calling the management server. In this scenario, NAT64/DNS64 will work fine. If there are machines on the intranet that need to call a DirectAccess client, you can use a HOSTS file entry on those management stations. Check out my article on ISATAP and see if that helps clear things up. The article is at blogs.technet.com/.../clearing-the-air-on-isatap.aspx
HTH,
Tom
Tom,
Thanks for the further clarification.
Am I right in thinking that I won't be able to use the ISATAP functionality anyway unless I have a 2008 onwards DNS server that supports AAAA records?
Cheers,
Conrad
