Teredo with UAG SP1 Direct Access not working

This problem was reported on a standard DirectAccess implementation scenario where all clients aren’t able to connect using Teredo and they all fall back to IPHTTPS which is the last resort for any DirectAccess connection.

Symptoms:

1.       When checking the Teredo Interface state, the following was displayed.

Netsh int teredo show state

Client Type             : teredo host-specific relay

The Client type should have been Teredo Client for a successful Teredo connection.

2.       I disabled the IPHTTPS interface to ensure it won’t fall back to the IPHTTPS option, opened wf.msc (windows Firewall with advanced security mmc) and navigate to monitoring – Security associations – Main Mode and Quick Mode. Both displayed nothing as shown in the figure below. This indicated IPSEC connection failure

3.       After capturing both server and client logs and with the help of a Microsoft senior engineer we noticed the following error

 Windows error 13887(ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH)

Resolution:

1.       A recent KB was released from Microsoft to address this specific Certificate problem with a recommended fix. This fix needs to be applied on both the DirectAccess Server and Client.

 http://support.microsoft.com/default.aspx?scid=kb;EN-US;2615847

2.       It turned out that the DirectAccess server has an Antivirus solution which seems to load several modules like NAC and others although it was configured to run normal AV file protection.

 After applying the Fix and removing the AV from the UAG server the clients were able to connect normally using Teredo.