Manage Out Direct Access 2012 - RDP not working RRS feed


  • Yes I have identified the problem.

    DA 2012 didn't create Infrastructure tunnel with SCCM server. 


    • Marked as answer by Vuk Kadija Wednesday, February 13, 2013 10:35 AM
    Thursday, December 27, 2012 11:08 AM

All replies

  • Have you identified how far you can get?

    Does the clients computername resolve to an IPv6 address in DNS? (assuming 'yes' as you can ping the client)

    If you enable firewall logging on the clients, can you see the request actually reaching the client?

    Have you limited the remote IP addresses on the client firewall rule?

    Hth, Anders Janson Enfo Zipper

    Friday, December 21, 2012 10:16 AM
  • Yes I have identified the problem.

    DA 2012 didn't create Infrastructure tunnel with SCCM server. 


    • Marked as answer by Vuk Kadija Wednesday, February 13, 2013 10:35 AM
    Thursday, December 27, 2012 11:08 AM
  • I'm having the same issue.  Everything works fine from the DA client back into the intranet.  But I can't RDP from my sccm server to the DA client.  When attempting to tracert from the sccm server TO the DA Client, it hits the DA Server but that is as far as it gets.  Can you possibly explain how you manually created that infrastructure tunnel between the DA Server and SCCM? 



    Brian D. Davis MCP

    Friday, May 3, 2013 7:01 PM
  • The most likely answer is that the SCCM server had to be added to the Management Servers list in the DirectAccess wizards (inside Step 3). Only the servers identified here in the wizard will be available over the Infrastructure tunnel.

    You of course also need to confirm that your SCCM server is IPv6 connected, either via native IPv6 or ISATAP.

    Monday, May 6, 2013 6:38 PM
  • I'm having the same issue. I can ping my clients from the Direct Access Server but not from the SCCM Server. The SCCM Server is in the Management Servers list in Direct Access, IPv6 is enabled on the Network Adapter, but it has no IPv6 address configured right now.
    @Jordan you said that the SCCM of course Needs to be connected to IPv6. To be honest i am not very familiar with IPv6... what is the easiest way to get it IPv6 connected? Just give it any IPv6 Address? (Really need to get some more info on IPv6...)



    Tuesday, May 7, 2013 6:04 AM
  • If you don't have native IPv6 already running inside your network (which it sounds like you don't, the DirectAccess server would need to have a native IPv6 address as well if that were the case), then the easiest way to get IPv6 working in the network is by using ISATAP. This is a tunneling technology that sort of creates a virtual IPv6 network that runs on top of your IPv4 network. Assuming your DA server only has an IPv4 address, then it's already running as an ISATAP router and you just need to point your SCCM server at it to "grab" an ISATAP address and routing information. At that point your SCCM server will get an ISATAP IPv6 address.

    The issue now is that since your SCCM server only knows how to talk IPv4 on your network, you try to contact "LAPTOP1" for example, the server asks DNS - "How do I get to LAPTOP1?", and DNS replies with the DirectAccess IPv6 address, which the SCCM server doesn't know what to do with. Once you get an IPv6 address on that SCCM server it should then be able to route that traffic successfully to the DA server, outbound to the DA clients.

    Here is an excellent article by Jason Jones on how to establish limited ISATAP functionality inside your network. Please do not follow any of the Test Lab documentation to simply create an "ISATAP record in DNS, that can cause havoc in some network. Follow this guide and you should be all set:

    Tuesday, May 7, 2013 2:06 PM
  • Thanks for the replies.  I have everything setup as in the article above.  My SCCM server was added to the management servers list in the DA 2012 config (both the fqdn and the IPv4 and IPv6 addresses.  SCCM is successfully getting an IPv6 address and doing a tracert from the sccm server to one of my DA Connected Clients, it gets to the DA server but stops.  Any other suggestions?

    Brian D. Davis MCP

    Wednesday, May 8, 2013 1:59 PM
  • Have you created the GPO for your DA client computers that contains the WFAS rules to allow RDP connectivity (and any other ports that SCCM might need access to)? Even once you have taken the internal steps for ISATAP and created IPv6 routability to your DA clients, the clients themselves will deny any packets coming in by default. You must create Firewall rules on the clients to allow any protocols through that you want.

    I would focus first on doing a regular RDP connection from inside your network to an external DA client, make sure you can get that working before trying anything from inside SCCM. This will simplify the traffic and confirm routing outbound. So include an internal Windows 7 computer or something like that into your ISATAP infrastructure so that it gets an ISATAP IPv6 address, then from that machine try to do a straight RDP out to a DA client. Once we get that working, then we can go over and start testing from SCCM.

    Wednesday, May 8, 2013 2:15 PM
  • Yes, rules are in place and understood.  We've been trying to do just a regular RDP session, not using the CM remote tools, to start with.

    Brian D. Davis MCP

    Wednesday, May 8, 2013 2:23 PM