Direct Access - Hair pulling!

[gumbygaz]

Morning Direct Access experts!

 

Trying to get our finance director working via direct access and it's been working fine on her Virgin broadband and phone hotspot until the weekend. Now just sticks on 'Connecting'

 

When the laptop is connected with her phone, she can search the internet and access the Directaccess server via the browser so it's not a proxy/signal/connection issue.

However, If I use my phone hotspot direct access works?!

 

If I log in with a test account on the same laptop or different laptop, and connect with her phone it works.

Used the Direct Access troubleshooting tool and that all comes back ok. And the server is all up ok, but the fact it's working for others means it's not the server?

All devices rebooted (bar the server) etc

 

So ruled out the phone connection, the laptop and the server.... what the ?

 

Seems it's almost black flagged her phone if used on that laptop, but how or where?.

 

Anybody got any amazing powershell scripts or clues to look for to help? Willing to clutch any straws!

[gh5000]

When connected with her phone can she not access files then?

 

Had a install where a lot of the users reported the same problem. The common factor was they all used virgin media home broadband. Can't remember if there was a resolution to that one as it was a few years ago and the school is no longer a client

[cstreet]

I've been pulling my hair out also. We have used Direct Access and it does not work on some ISPs, and here is the reason!

 

DNS service "helpers"!

 

Virgin consumer market routers always return a success record for any bogus DNS lookup you make.

I think the idea is to offer a fancy DNS error page or a list of search results.

 

Windows default DNS lookup behaviour on a domain joined PC is to append the domain suffix. If it's a toplevel domain the expectation is for the initial lookup to fail and then it resolves what you want.

I saw that when doing an nslookup for google.com on virgin that it would return a result for...

google.com.ourdomain.org

Windows added our domain suffix and Virgin DNS servers resolved it! What a pain.

 

Of course when you lookup...

DAServer.mydomain.org.mydomain.org

It fails to resolve the correct IP address and instead tries to connect your device tunnel to their bogus DNS intercept. This causes DA to fail to connect.

 

The fix is pretty simple and can be delivered with Group Policy I believe.

We just set the DNS suffix search order manually to append in this order...

 

. (Dot on it's own)

Ourdomain.org

 

The dot on it's own signifies - no suffix.

 

Reboot after applying and DA connected just fine!

 

Hope that helps some folks keep their hair for a little longer.

 

Thanks,

 

Chris

Edited February 6, 2021 by cstreet