direct-accesswindows-server-2008
I have just setup a Win2008R2 DirectAccess server (and also a Win2008R2 Active Directory server).
From the Internet I can Remote Desktop login to the AD server, but I cannot RDP into the DirectAccess server. I can PING both servers and get an IPv6 response.
(I can RDP to the DirectAccess server from the internal company network)
DirectAccess is configured to allow full intranet access.
I think I've hit a mental block, the answer will probably be obvious, but I just can't see it.
Signs of a DirectAccess infrastructure tunnel problem are that you can ping or RDP to the IPv6 address of a domain controller on the corporate network, but you cannot resolve corporate DNS names even though the NRPT is valid.
After a few years of working with it, I've found the following 2 things to be the most common reasons for machine-specific infrastructure tunnel problems with DirectAccess.
1: Certificate problems. The first credential used for the infrastructure tunnel is a certificate. You'll get Policy Not Configured if the certificate is invalid. This could be an caused by an expired certificate, a subject name mismatch, incorrect certificate usage (Server auth/Client auth via the built-in Computer template), or your published revocation list for the root or issuing CA may be out of date.
2: Machine account problems. The second credential used for the infrastructure tunnel is the computer account. I've received "Policy Not Configured" on machines have left and rejoined the domain or when a machine name has been reused. When this happens I can't necessarily find any issues with schannel (nltest), or anywhere else in the event log, but the computer account refuses to authenticate for DA. This is also logged as an IPSec Main Mode failure event on the DirectAccess server.
I haven't identified any firewall consec rule issues that cause problems with the infrastructure tunnel (like an overlapping subnet).
Here is Wikipedia's handy chart of the pursuit of nines:
Interestingly, only 3 of the top 20 websites were able to achieve the mythical 5 nines or 99.999% uptime in 2007. They were Yahoo, AOL, and Comcast. In the first 4 months of 2008, some of the most popular social networks, didn't even come close to that.
From the chart, it should be evident how ridiculous the pursuit of 100% uptime is...
Best Answer
Did you try both the internal and the external IP of the directaccess server? Try and connect to IP instead of name just to see if that helps.