Direct access server reporting NAT64 Translation failure

We are seeing strange issue , Direct Access server 2012 is reporting NAT64 warning.
I am trying to isolate causing could not find any useful information.
DA server is behind firewall having Ipv4 internal address.
Error I see on dash board is
NAT64 translation failures might be preventing remote clients from accessing IPv4-only servers in the corporate network.
Any help appreciated.

NAT64 is an internal component of DirectAccess and there really isn't anything that you configure manually for it. Seeing a message about NAT64 having trouble is more than likely being caused by some kind of external influence on that server. For example,
many of the quirky error messages or problems that we see during DirectAccess implementations are caused by security policies being present in the domain. For example, if you plug in a new server to use as your DA server, if you do not block inheritance in
Group Policy, as soon as you join that new server to your domain it may receive settings from existing GPOs in your network. Sometimes those GPOs conflict with the things that DirectAccess needs, and they have therefore broken DA before you even set it up.
If you are setting this up as a new DA server, I recommend removing the Remote Access role, blocking inheritance in Group Policy so that none of your preexisting GPOs get applied to it, and starting the configuration again.

Similar Messages

  • Possible to convert a Direct Access server?

    Is it possible to convert a Direct Access server ( Windows 2012 server) residing in ESX 5.1 to a Hyper V version ( Windows 2012 R2 Datacenter) by a "normal" conversion process?  The optimal result is that all the configuration of the Direct
    access part is transferred correctly.
    Thanks.

    hey .. funny how expert opinions vary ... i have a handfull of IT and software RAID experts who disagree with you ... in my case, i'd rather get rid of it ... ( however i still have to find a solution to clone my boot drive that works flawlessly with all my software ... )
    anyways ... how exactly do i go about splitting the RAID, to make sure i don't mess it up ....
    1. restart from CD
    2. Delete the mirrored RAID set
    3. remove one of the HDs with the raid slice on it (i'll keep it as a backup 4 the moment just in case)
    4. restart from the remaining slice disc
    5. ... ?
    do i need to do anything specific ... ? what about the name of the Volume .. for the moment my startup disk (the RAID) is called 'BootRAID' ... the slices are called 'RAID Slice (disk0s2)' and 'RAID Slice (disk1s2)' .. in order for everything to work properly, don't i have to rename the new startup disk ?
    i'm scared ...
    here's a screenshot of my setup: http://kinkajou.net/diskUtility_RAID.jpg
    <Edited by Moderator>

  • SQL Server Reporting Services Subscriptions - Failure sending mail

    Hello All,
      I am having a problem with using subscriptions to send my reporting services report by email.
      Getting the following error:
     Failure sending mail: The message could not be sent to the SMTP server. The transport error code was 0x800ccc6d. The server response was 552 Error: message too large
    While browsing for other reports in the report manager(reports created by others staffs), i could find that these reports were sent by email successfully.
    So not understanding why mine has a problem. logically it could be that the report is too big?
    Anybody has a solution or suggestion?
    Thanking you in advance

    Hi LenitaS,
    For first question, we can check the item "IncludeLink" to embed the link in the mail. Or, embed the link the manually by putting a link in the "Comment" field. The URL should be a standard URL Access:
    http://<reportserver>/reprotserver?/reportpath&rc:format=<format>
    For the second question, you are right. We can follow these setps to work around the issue:
    1.Create a file shared subscription, save the export to a shared folder.
    2.Create a E-Mail delivery subscription, embed the file's path in the mail. We can set the file's path in "Comment" field of the E-Mail delivery. The path should be someone like this:
    \\<sharedfolder>\<export report> 
    In this case, the exported report's name cannot be dynamic.
    If there is anything unclear, please feel free to ask.
    Thanks,
    Jin ChenJin Chen - MSFT

  • Direct Access Server 2012 R2 Single NIC DNS problem with 8.1 Enterprise

    Dear helpers,
    I am beginning to rip my hair over the following problem and I am asking for some guidance:
    I have setup DA on a server 2012 R2 with the simple wizard using one NIC. I have opened up port 443 to my  DA Server and operations status is showing green on everything. I have used Djoin to join a remote win 8.1 enterprise client to our domain and
    setup DA. I can see that my tunnel is established and the client shows up as an IPHTTPS client on my server:
    Role                       : client
    URL                        : https://vpn.ourdomain.com:443/IPHTTPS
    Last Error Code            : 0x0
    Interface Status           : IPHTTPS interface active
    Connection status on client is stuck in connecting and the eventlog on client gives me following error:
    The system failed to register host (A or AAAA) resource records (RRs) for network adapter
    with settings:
               Adapter Name : {424F50B4-BF1A-4D96-81FA-7D7436A99F07}
               Host Name : TEST
               Primary Domain Suffix : ourdomain.com
               DNS server list :
                     172.16.8.1
               Sent update to server : <?>
               IP Address(es) :
                 172.16.8.110
    The reason the system could not register these RRs was because the update request it sent to the DNS server timed out. The most likely cause of this is that the DNS server authoritative for the name it was attempting to register or update is not running at
    this time.
    I understand why this is failing because it seems like it is contacting the local DNS to register and that's wrong.
    Get-DaConnectionStatus gives me the following:
    Status    : Error
    Substatus : CouldNotContactDirectAccessServer
    I can ping the name on the DA server and also the IPv6 address, I can also do nslookup if i set the server used to my internal DNS-servers IPv6 address(DNS and DA server = same machine). My DA Client GPO is being applied to the client and i get an NRPT table
    looking as follows:
    Settings for DirectAccess-NLS.ourdomain.com
    DirectAccess (Certification Authority)  :
    DirectAccess (IPsec)                    : disabled
    DirectAccess (DNS Servers)              :
    DirectAccess (Proxy Settings)           : Use default browser settings
    Settings for vpn.ourdomain.com
    DirectAccess (Certification Authority)  :
    DirectAccess (IPsec)                    : disabled
    DirectAccess (DNS Servers)              :
    DirectAccess (Proxy Settings)           : Use default browser settings
    Settings for .ourdomain.com
    DirectAccess (Certification Authority)  :
    DirectAccess (IPsec)                    : disabled
    DirectAccess (DNS Servers)              : fd1f:6801:cc14:3333::1
    DirectAccess (Proxy Settings)           : Bypass proxy
    I cannot reach any internal resources by name or IPv4 address except the DA server.
    I will gladly provide more info if needed
    Please help!
    //Cris

    Hi,
    Thanks for your reply.
    Firstly, computer certificates are necessary for DirectAccess.
    In addition, it is no need to assign an IPv6 address on all the servers. In Windows server 2012/R2, the
    Built-in NAT64 and DNS64 support for accessing IPv4-only resources.
    If you select Configure DirectAccess Clients with DNS client suffix search list and add additional suffixes to the list,
    you can search for short, unqualified computer names in more than one specified DNS domain.
    For more detailed information about DNS suffix search list, please refer to the link below:
    Step 2: Configure the DirectAccess Server
    Best regards,
    Susie

  • Network Positioning of a Windows Server 2012 R2 Direct Access & VPN Server

    Reposted moved from Windows Server Forums- Security
    Hi
    I'm in the process of creating a new active directory forest with a single domain using AD.Contoso.com to use the Microsoft example. The reason I have decided on AD.XXXXXXXXX.com is to get way from using split horizon (Split Brain) DNS. The requirements
    for our new domain are :-
    2012 R2 AD
    Direct Access & VPN
    Exchange 2013 OWA, Active Sync Outlook Anywhere (Possibly a Hybrid Config where we have on premises mailboxes and some exchange online mailboxes Office 365 etc)
    Lync 2013 ?
    SharePoint 2013 ?
    Microsoft Active Directory Certificate Services
    System Center Configuration Manager 2012 R2
    Two way trusts between old forest and new to enable Transition/Migration
    Ok so that's what I'm aiming for so now the question.
    They are allowing me to purchase a next Generation Firewall may be a Barracuda NG firewall or a Cisco ASA X series so I need some advice on what type of network topology I should configure. I've read that using the two NIC configuration for
    the 2012 R2 Direct Access Server is preferable, one nic on the internal network one on the perimeter. The problem I have with this is that it bridges the internal network and the perimeter bypassing the backend Firewall see image
    The other alternative is to dispense with the perimeter network use the Direct Access server with a single NIC and setup the NG Firewall in a three-legged config with the DA server on the DMZ.
    So all you security experts out there what would be your design for this simple domain? we don't need any HA or Load Balancing.
    Thanks
    Simon

    Ok I'm not sure we are going to get any advice on this subject but one last effort. Our budget can only stretch to one next generation firewall so I'm considering the following three legged firewall design with a two NIC 2012 R2 Direct
    Access server. If someone could validate this configuration or suggest an alternative then I would be grateful.

  • LAN side firewall settings for Direct Access (Windows Server 2012 R2) in DMZ?

    I am currently planning to set up our first Direct Access server (Windows Server 2012 R2). I will be in our firewall DMZ and we will be using the IP-HTTPS listener.
    For the Internet facing rule only TCP 443 inbound/outbound is sufficient but for the LAN facing rules (not talking about the Windows server firewall) what would be the recommended firewall rules for a Direct Access server? Is there a best practice guideline
    to follow for this? Appreciate any advice or comments. Thank you.

    Hi Barkley
    Please see this Technet Link which will backup your requirements - https://technet.microsoft.com/en-gb/library/jj574101.aspx
    Section Reads - 
    When using additional firewalls, apply the following internal network firewall exceptions for Remote Access traffic:
    ISATAP—Protocol 41 inbound and outbound
    TCP/UDP for all IPv4/IPv6 traffic
    Also another link from http://www.ironnetworks.com/blog/directaccess-network-deployment-scenarios#.VO3tfvmsVrU
    "I have had a number of conversations with security administrators and network architects who have expressed a desire to place the DirectAccess server between two firewalls (firewall sandwich) in order to explicitly control access from the DirectAccess
    server to the internal corporate network. While at first this may sound like a sensible solution, it is often quite problematic and, in my opinion, does little to improve the overall security of the solution. Restricting network access from the DirectAccess
    server to the internal LAN requires so many ports to be opened on the inside firewall that the benefit of having the firewall is greatly diminished. Placing the DirectAccess server’s internal network interface on the LAN unrestricted is the best configuration
    in terms of supportability and provides the best user experience."
    Kindest Regards
    John Davies
    Thank for your reply and information John. I find it somewhat disappointing that Microsoft does not provide much more in the way of documentation and information regarding this topic. I required more information to show to our security team so they will allow
    us to have the internal facing NIC not have more restrictive rules in place as it is a security concern.

  • Direct Access Wizard Failure

    Hi all,
    Having an issue with setting up direct access I have followed the guide located at here
    I am following this guide to the letter, apart from setting up to blank GPO for client and server settings
    I decided to copy the script and run it via powershell (admin) and the following error is returned
    VERBOSE: Retrieving server GPO details...
    VERBOSE: Retrieving DirectAccess server information...
    VERBOSE: Clearing existing stale configuration settings. This might take a few minutes...
    VERBOSE: Checking for deployment state...
    VERBOSE: Checking the specified adapters...
    VERBOSE: Deploying the Remote Access server behind NAT...
    VERBOSE: Searching for a network location server certificate...
    VERBOSE: Checking the specified adapters...
    VERBOSE: Checking for a native IPv6 deployment...
    VERBOSE: Verifying the IP-HTTPS certificate...
    VERBOSE:  Deploying DirectAccess with a single network adapter (Ethernet) behind a NAT device...
     ISATAP is used in the internal network.
    VERBOSE: Retrieving internal network DNS settings...
    VERBOSE: Verifying the GPO to write settings...
    VERBOSE: Checking GPO edit permissions...
    VERBOSE: Creating GPO link if not present...
    VERBOSE: Checking for a client GPO to write settings...
    VERBOSE: Checking for edit permissions for the DirectAccess client GPO...
    VERBOSE: Creating GPO link if not present...
    VERBOSE: Checking for permissions to apply DirectAccess client policies to the GPO...
    VERBOSE: Identifying all domains...
    VERBOSE: Identifying infrastructure servers in domain HOME.local...
    VERBOSE: Registering the DNS entry used to check client connectivity...
    WARNING: A DNS entry for DNS probe directaccess-corpConnectivityHost.HOME.local (IP addresses 127.0.0.1;
    fd10:f4c1:d28d:7777::7f00:1) cannot be added. Add the entry manually.
    VERBOSE: Registering the web probe in DNS...
    VERBOSE: Clearing existing stale configuration settings...
    VERBOSE: Creating DirectAccess client policies...
    VERBOSE: Updating client policies...
    Install-RemoteAccess : The security group setting cannot be applied to DirectAccess server GPO HOME.local\Direct
    Access Server.
    At line:1 char:1
    + Install-RemoteAccess -NoPrerequisite -Force -PassThru -ServerGpoName 'HOME.local ...
    + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        + CategoryInfo          : InvalidArgument: (HOME.local\Direct Access Server:root/Microsoft/...PS_RemoteAccess) [In
       stall-RemoteAccess], CimException
        + FullyQualifiedErrorId : HRESULT 80070057,Install-RemoteAccess
    Remote access is installed.
    Any ideas to what could be causing this?

    Which group are you talking about?
    I have a group for all direct access machines, You have to specify this group during the wizard.
    The permission issue seems to be related to the script trying to modify group policy
    I have tired with the default polices the wizard creates and also specifying 2 blank policies.

  • Direct Access is working but how do I configure it for remote services, client management software, etc..

    Good morning/afternoon/evening TechNet,
    I've finally gotten a DA client connected to the corporate network utilizing an external network. I'm having a couple issues, one, not being able to ping the server from a computer that's on the same domain(I'm able to ping the DA client from the DA server).
    I'm not sure if there is a firewall setting that needs to be open on the client for incoming echo requests? Second, we use a client management system called BMC and I would like the direct access server to be able to utilize the BMC server so that I can manage
    the DA client whenever its on the network. I noticed on the DA server that "Step 3" offers an area where it allows you to add servers that will be used for direct access client management. Would I just need to populate the server in here and then
    open appropriate firewall rules so that the DA server has access to them? Lastly, Trying to "mstsc" into the DA client what would I need to open up on both sides so that I'm able to do this?
    Sorry about the horrible grammar but I've been up 24+ hours getting this awesome but pain in the butt Direct Access feature working.
    Thank you as always!
    -Liqsh0t

    I'm afraid it's a bit more complicated than adding a server into the list in Step 3 :)
    When a DirectAccess client is connecting into a corporate network that is IPv4 (I assume yours is, most are), it can reach into your IPv4 servers because the DA server is doing NAT64/DNS64 translations, turning all of your DirectAccess IPv6 packets into
    IPv4 packets before they head inside the network. But even though this happens in the background without you really knowing about it, the key thing there is that all DirectAccess traffic is IPv6. This means the clients can only be contacted via IPv6. If you
    have IPv6 inside your network, then you can route outbound fairly easily to your DA client computers. If you are all IPv4 inside as most companies are, then you have to either roll IPv6 out inside your network, at least partially, or you have to utilize ISATAP
    inside your network in order to create a sort of "virtual IPv6 cloud" that runs on top of your IPv4 internal network. This enables your internal management systems (like the BMC servers and helpdesk computers for RDP access outbound) to have a connection
    into the IPv6 world, which then enables them some routing capability to get out to the IPv6-connected DA clients. In addition to this IPv6 or ISATAP setup, you also need to configure WFAS rules on the DA clients so that they will allow this traffic.
    There is some info on setting up ISATAP here: http://blogs.technet.com/b/jasonjones/archive/2013/04/19/limiting-isatap-services-to-directaccess-manage-out-clients.aspx
    Otherwise one of the chapters in this book is also dedicated to the setup of a selective ISATAP environment, to be used for the purposes of DirectAccess outward management: https://www.packtpub.com/virtualization-and-cloud/microsoft-directaccess-best-practices-and-troubleshooting

  • Windows 2012 Direct Access ISATAP not working

    I just installed Windows 2012 Direct Access and it's working fine for my company's Windows 7 Ent clients. The only issue I can't around with is that ISATAP is not working on this box.
    We want to be able to manage-out in our native IPv4 environment, the isatap A record has already been created and is resolvable to all client machines including the Direct Access server. Unfortunately, ISATAP still appears to be Disabled. Do we need to manually
    set this to enabled apart from what I've already done?
    PS C:\Windows\system32> Get-RemoteAccessHealth
    Component            RemoteAccessServer   HealthState     TimeStamp            Id
    Server               localhost            OK              1/31/2013
    3:26:43 PM
    6to4                 localhost            Disabled        1/31/2013 3:21:44 PM
    Vpn Addressing       localhost            Disabled        1/31/2013 3:21:44 PM
    Network Security     localhost            OK              1/31/2013 3:21:44 PM
    Dns                  localhost            OK             
    1/31/2013 3:26:43 PM
    IP-Https             localhost            OK              1/31/2013 3:21:44 PM
    Nat64                localhost            OK              1/31/2013
    3:21:44 PM
    Dns64                localhost            OK              1/31/2013
    3:21:44 PM
    IPsec                localhost            OK              1/31/2013
    3:21:44 PM
    Kerberos             localhost            Disabled        1/31/2013 3:21:44 PM
    Domain Controller    localhost            OK              1/31/2013 3:21:44 PM
    Management Servers   localhost            Disabled        1/31/2013 3:21:44 PM
    Network Location ... localhost            OK              1/31/2013 3:26:43 PM
    Otp                  localhost            Disabled        1/31/2013 3:21:44 PM
    High Availability    localhost            Disabled        1/31/2013 3:21:44 PM
    Isatap               localhost            Disabled        1/31/2013 3:21:44 PM
    Vpn Connectivity     localhost            Dis┌───────────────────────────┐4 PM
    Teredo               localhost            Dis│Enter command number:      │4 PM
    Network Adapters     localhost            OK └───────────────────────────┘4 PM
    Services             localhost            OK              1/31/2013 3:26:43 PM
    PS C:\Windows\system32> ping isatap
    Pinging isatap.isat.com [192.168.1.214] with 32 bytes of data:
    Reply from 192.168.1.214: bytes=32 time=1ms TTL=128
    Reply from 192.168.1.214: bytes=32 time<1ms TTL=128
    Reply from 192.168.1.214: bytes=32 time<1ms TTL=128
    Reply from 192.168.1.214: bytes=32 time<1ms TTL=128

    Hi,
    Thank you for the post.
    As far as I understand, ISATAP is not recommended for use as the IPv6 to IPv4 transition technology in DirectAccess in Windows Server 2012. With ISATAP disabled DirectAccess clients can initiate connections to computers
    on the internal network, and the computers on the internal network are able to respond. However, computers on the internal network will not be able to initiate connections to DirectAccess for purposes of remote client management. If you want to be able to
    remote client management, consider deploying native IPv6 for management servers that will connect to DirectAccess client computers.
    Regards,
    Nick Gu - MSFT

  • Direct Access client DNS Registration q.

    Hi All,
    We have Direct Access installed, configured and mostly working on Windows 2012 R2 server supporting WIN 8.1 clients (only).
    All internal resources are accessible and have good name resolution, etc.
    However, I now have to enable "manage out" functionality. SCCM based Remote Assistance etc.
    There are various guides and I think manage out is working correctly. There is a major sticking point in that the clients are attempted to register DNS names on the local DHCP server (home/office) router and registration never reaches corporate DNS servers.
    I have enable "secure only" DNS registration by Group Policy.
    We use split tunneling for clients.
    The Direct Access server is behind a NAT firewall. (CISCO) So the only effective transition tech is IP-HTTPS.
    Many thanks for any assistance in pointing me in the right direction.

    Hi,
    >>There is a major sticking point in that the clients are attempted to register DNS names on the local DHCP server (home/office) router and registration never reaches corporate DNS servers.
    Did you deploy the IPv6 in your corpnet? If no, it's normal.
    If we use the IPv4 in the corpnet, the NAT64 and DNS64 will be enabled on the DirectAccess server. When the DirectAccess client sends the DNS update packet, according to the NRPT, the packet will be sent to the DirectAccess server. DirectAccess
    server will on behalf of the client to register the AAAA record.
    Best Regards.
    Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

  • Direct Access on windows 2012 with OTP

    Hello everyone,
    i've just finished setting up Direct Access 2012 with Gemalto's OTP solution for a client,
    i have an issue though, without OTP all is working fine, and when i activate OTP with all the certificates and stuff when i enter the OTP code on my client it looks like its not validating it.
    on the Direct Access Server i get this error:
    Erreur : Challenge returned.
    source: RemoteAccess-RemoteAccessServer
    ID: 10042
    i have absolutely no errors on my radius server... any idea on why the server is rejecting my requests ?
    thanks for the help
    Hitch Bardawil

    Hi
    I deployed this scenario for a Customer of mine a few months ago with GEMALTO. It's a little bit tricky but possible. For some trroubleshooting tips have a look at one of my blog posts :
    http://danstoncloud.com/blogs/simplebydesign/archive/2013/10/26/the-0x80040008-directaccess-otp-case.aspx.
    At last for your OTP operating in Challenge/response mode. It's not possible. It's a NPS limitation :
    http://technet.microsoft.com/fr-fr/library/jj618331.aspx"The OTP
    provider used requires the user to provide additional credentials in the form of a RADIUS challenge/response exchange, which is not supported by Windows Server 2012 DirectAccess OTP."
    BenoitS - Simple by Design http://danstoncloud.com/blogs/simplebydesign/default.aspx

  • Routing back to Direct Access Clients - is this possible?

    Hi,
    We have been using direct access for the past few months successfully, however the one problem we are still having is we can't use programs that require a route back to the Direct Access client (such as managing a Hyper-V machine on the local lan), using SourceOffsite
    or even using Remote Desktop to remote onto a direct access client or ping the direct access client.
    Our local LAN uses Ipv4 and we can route fine to the Direct Access clients from the Direct Access Server where the tunnel terminates but not from any other machine on the network. Do I need to change the direct access configuration to allow this or do I need
    to somehow create a route on my LAN for the direct access clients?
    Thanks in advance
    David

    I found out how to do this in this useful article and tested it and it is working fine - thanks.
    http://www.packtpub.com/article/configuring-manage-out-to-directaccess-clients

  • Direct Access DNS resolution local domain network

    Hey guys,
    some information to my test environment...
    My direct access server and my DC are based on Windows Server 2012 R2. The direct access server has one nic. Port 443 requests are forwarded through an firewall to the direct access server. The configuration for direct access is based on the built in assistens
    to configure it.
    On client side i am using Windows 8.1 x64.
    Now the to my problem...
    If I do an ping or a gpupdate when i am not connected to my local company network, the server responds and gpupdate/ping works fine. As soon as i am connected to my local company network i am not able to do a gpupdate or a ping (error in resolving dns).
    But i am able to use nslookup to query names.
    Anyone a suggestion where the problem could be?

    Hi,
    It seems that this problem is caused by the issue of Network Location Server.
    Does the client know that it is connected to the local network?
    When the client connects to the local network, it should show "Connected to network locally or through VPN".
    Here is the screenshot of my lab server,
    Aslo, we can use the command below to verify this,
    netsh dns show state
    The Machine location should be "Inside corporate network"  when the client is connected to the local network.
    If the client doesn't know that it is inside the corporate network, please check if client can access the Network Location Server.
    Best Regards.
    Steven Lee
    TechNet Community Support

  • Cannot connect to direct access clients from management servers

    I have direct access setup on a Server 2012 machine and I have successfully added clients to it.  Clients can reach internal resources and everything seems to be working great inbound.  However, I am having some trouble with outbound management.
     From the Direct Access server I can ping, RDP, browse files, etc... From the management server I have defined in the DA setup I can only ping the machines and nothing else.
    I had worked with some MS tech support to get to this point, and they had me configure my DA server and the few management server with status IPv6 addresses.  I'm not sure if this is necessary or if outbound managment should work using ISATAP?
    My DA server is Server 2012, and the clients are Windows 8 and Windows 8.1.

    You should be able to make outbound management work using either ISATAP or native IPv6. If you have configured native IPv6 and it's not working, there may be some kind of routing issue with the way that IPv6 is setup in your environment, or even a piece
    of networking equipment that is not IPv6 capable.
    If you're interested in trying the ISATAP route to see if you can get it working that way, Chapter 3 in this is dedicated to the setting up of ISATAP: http://www.packtpub.com/microsoft-directaccess-best-practices-and-troubleshooting/book
    (sorry, not trying to be self-serving, but these kinds of questions are exactly the reason why I put the book together)

  • Direct Access has no internet access

    Hi all,
    Hopefully some can help me with this issue that I have been struggling with for about a week now.
    I'm new to Direct Access so please bear with me
    I've setup a Server 2012 box and installed the Direct Access role.  The server is behind en edge device with 1 NIC.
    I've configured it and can connect up Windows 8.1 tablets successfully, both on the internal network and when connected externally.
    The problem I have is with internet access when they are connected externally and I've tried with Force Tunneling enabled and disabled (ideally for security reasons I'd like it enabled).
    We use a proxy server configured with a wpad file hosted on Server 2003.  This is published via DNS.
    Internet Explorer is configured to Auto Detect Internet Settings
    I can connect to any of our internally hosted websites, and also strangely enough, our main publically accessible web site.
    If I don't have Force Tunneling enabled then I get the following behavior
    I can't use Internet Explorer to connect to any public websites though (google.com, yellowpages.com, etc).
    I can connect to any website that has the same domain suffix as our domain
    I can use Firefox and connect to external websites if I say 'Direct Connection to Internet' or 'Use System Settings'
    If I use Force Tunneling then I get the following behavior:
    The network connection says it is 'limited' and the Direct Access connection says it has 'No Internet Access'
    I can't use Internet Explorer to connect to any public websites though (google.com, yellowpages.com, etc).
    I can connect to any website that has the same domain suffix as our domain
    I can't use Firefox and connect to external websites
    Does anyone know why this would be the case?
    Thanks

    Thanks for the responses, I managed to get this working by unticking the 'Auto Detect Settings' and manually entering the proxy server and port under the 'Proxy Settings' option
    It means that it doesn't read my wpad file but I can manage this way still through GP.
    Another problem that I've just encountered for no reason that I can see is this.
    I'm connected to my Domain, I pull the LAN cable and then it auto connects me to my wireless network.  It used to auto connect me to my Direct Access server but it doesn't anymore, it just says connecting.  If I reboot the tablet while on the wireless
    LAN and then log on with my Domain Credentials it'll connect me through to the Direct Access server.
    Why would it need a reboot?  Why has it stopped connecting straight away after detecting I'm no longer on the domain?

Maybe you are looking for