DirectAccess is probably the most awesome thing that I have ever setup. However, there were a few gotchas with using a server behind a NAT that needed a bit or research, so below are the steps I took to a successful deployment, hope that they help someone.

 

The setup

The DA server is running on Server 2012r2 (non DC). It is behind a Smoothwall UTM so NAT is involved (although supported by DA in Server 2012R2 is complicated things a bit).

 

The client I tested is running Windows 10 Education (Windows 8.1 Enterprise should work as well, Windows 7 Enterprise needs extra config not detailed here).

 

I have an external IP with a public URL of da.<school>.<local authority>.sch.uk

 

The Smoothwall UTM has a port forwarding rule to forward all traffic from our public IP on port 443 to DA server’s local IP.

 

The steps:

 

1. Create AD Security Group for machines that are allowed to use DA.
   
2. Install DA role on server:
   
   1. 
      
   2. Choose “Remote Access” role -> “Direct Access and VPN (RAS)” and accept the extra bits it wants to install.
      
   3. Reboot.
      

 

[*]Configure initial DA settings:

1. Run “Remote Access Management” from the Start Menu.
   
2. Run the getting started wizard.
   
3. Click “Deploy DirectAccess only”.
   
4. Choose the “Behind a Edge device (with a single network adapter) topology.
   
5. Enter your public URL (important: I found you must you the public URL, even though it says you can use the IPv4 address it doesn’t work in this setup (plenty of discussion on the net about this)).
   
6. Exit the wizard.
   

 

[*]Configure client settings:

1. On the setup screen, go to “Step 1 - Remote Clients” and click “Edit”.
   
2. Check “Deploy full DirectAccess for client access and remote management” and click next.
   
3. Remove the default group and add in your DA security group.
   
4. Uncheck “Enable DirectAccess for mobile computers only”.
   
5. If you want to force all remote clients to tunnel through your network for Internet access then check “Use force tunnelling” (though I doubt you will do this). Click next.
   
6. Here you need to add a highly available machine that clients can attempt to ping (I use our Smoothwall box) – there should also be DA webprobe added automatically, leave this alone.
   
7. I checked “Allow DirectAccess clients to use local name resolution” – I think that this is a good idea…
   
8. Click finish.
   

 

[*]Configure DA server settings:

1. On the setup screen, go to “Step 2 - Remote Access Server” and click “Edit”
   
2. Check the settings on this screen and click next.
   
3. Check the NIC is selected.
   
4. Check to use a self signed certificate (unless you want to create an upload a proper cert). Click next.
   
5. Choose your authentication method.
   
6. Click finish.
   

 

[*]Configure Infrastructure settings:

1. On the setup screen, go to “Step 4 – Infrastructure Servers” and click “Edit”
   
2. Ok so a note here. I am not clear exactly what a Network Location Server is, nor, apparently, do a lot of people who set this up. I plumped with using the DA server itself which a self-signed certificate which seems to work fine. Click next.
   
3. Ok another odd one here. On this screen you have to add in a DNS server on your local network. So I did, and it failed miserably. Next I took the option of allowing the setup to detect a DNS server and it came up with the DA server. Its not a DNS server but it worked. Go figure. Click next.
   
4. Add in your domain suffix. Click next.
   
5. Next you can add in any management servers. I added in our SCCM server but truth be told, I am not 100% on this option.
   
6. Click finish.
   

 

[*]On the setup screen, go to “Step 4 – Application Servers” and click “Edit”

1. I clicked to not extend but alter to our environment.
   

 

[*]Apply the settings:

1. On the setup screen, click at the bottom of the screen to apply settings.
   
2. You should now see that lots of whizzy things are happening, including:
   

    

   [*]Check the settings apply correctly:

   1. Click on the Dashboard link
      
   2. You will probably see that things are still being setup. The DA server needs to retrieve and apply the DA server GPO from a DC. This can take up to 15 mins.
      
   3. When applied you should see lovely green ticks next to all the checks.
      

    

   Once your DA clients have picked up the new DA policy you should be able to take the machine outside of your network and it will connect!

    

   Something to be aware of: It seems that a lot of people report that the DNS entries that the setup process creates are deleted during a scavenging cycle. Therefore I altered the following records to not be deleted when they are stale:

    

   1. directaccess-corpConnectivityHost (both IPv4 and IPv6 records)
      
   2. DirectAccess-NLS (both IPv4 and IPv6 records)
      
   3. directaccess-WebProbeHost
      

    

   Good luck! And post in the forums if you have problems and I’ll see if I can help J

New GPOs for DA server and Clients applied to domain (but filtered to the DA server and clients in the DA group)
DNS entries.