Bye Bye Microsoft UAG !

Yesterday Microsoft Announced officially that there will be no new future full version of Microsoft UAG. Server 2012 and 2012R2 will cover some of the UAG features as Direct Access and basic secure application publishing. This was quite expected especially after the TMG retirement and the new web application proxy that was introduced in Server 2012 R2.


For more details on the latest changes to the Forefront family, please check the below article

http://blogs.technet.com/b/server-cloud/archive/2013/12/17/important-changes-to-the-forefront-product-line.aspx

Read More

UAG 2010 SP4 Released to support Windows 8.1 and IE 11

Good news for all Microsoft UAG 2010 users, Service Pack 4 (SP4) was released officially yesterday to support Microsoft Latest Operating system Windows 8.1 and Internet Explorer 11 (IE 11). This new SP4 provides other important features as the support of Remote Desktop Connection RDC 8.1 and the Remote Apps published from Remote Desktop session Host on Windows 2012 or 2012 R2.

The Link to download the Latest SP4 is as follows:

https://www.microsoft.com/en-us/download/details.aspx?id=41181


For More details about features and fixes included in this Service Pack, please check the following link:

https://support.microsoft.com/kb/2861386


Service Pack 4 includes some other fixes as well as stability and performance enhancements, I will give it a try and hopefully it will be smooth operation.

Read More

UAG 2010 File Access application fails to open/start after UAG 2010 SP3 implementation

After the install of UAG 2010 SP3, all of the portal applications worked fine except for the File Access application. I tried several options with the application, removing it and adding it back but never worked till I asked my friend Ben Ari (UAG Senior Escalation engineer) as I thought it was depreciated. It turned out to be a glitch or bug after implementing the UAG 2010 SP3 and to fix you need to do the following:

 

1.       On the UAG server, Navigate to the following folder under UAG installation folder \Microsoft Forefront Unified Access Gateway\von\FileAccess

2.       Edit the file “default.asp” (I took a backup first before any change)

3.       Modify the word cint to parseInt on Line 20 (Or you can search the file as it appears once). Make sure that the “I” in “parseInt” is written in caps (Check below screenshot)

 

 

4.       Save and activate your Forefront UAG

 It should be noted that incase there are more than one UAG server in the array, this change should be applied on all servers manually by the same method and steps above.

Read More

UAG 2010 Portal error 403.14 after applying UAG 2010 SP3

The UAG 2010 SP3 was officially released on Feb 20, 2013 as promised by the UAG team to resolve several issues mainly to support Microsoft new systems and applications (Windows 8, Server 2012, Exchange 2013, SharePoint 2013...............etc). Thanks UAG team.

Download Link:  http://www.microsoft.com/en-us/download/details.aspx?id=36788

Release Notes: http://support.microsoft.com/kb/2744025


I will discuss my SP3 installation process and my comments for a successful implementation in another Post. One of the main issues that i faced after the installation of the UAG 2010 SP3 was that all my users were unable to access the UAG Portal page or any published site on the UAG (Mail OWA, SharePoint............etc) and the following error is Displayed:

Forbidden Directory, Listing Denied Error code 403.14

Microsoft has a good KB that deals with this error (http://support.microsoft.com/kb/961172) however in my case i needed to reboot the IIS later on. The Steps done to fix this issue is as follows:

1. Open Forefront UAG management on the UAG server.
2. Open/Explore the Trunks under the HTTP and/or HTTPS connections.
3. Right click each Trunk and select Disable.
4. Save and Activate the UAG configuration.
5. Right Click the trunks again and select enable.
6. Save and Activate the Configuration again.
7. Open the IIS Manager
8. Highlight your server name and from the actions hit restart to restart the IIS. This should do the trick.

Hopefully this should help anyone facing this problem after UAG SP3.

Read More

Microsoft UAG backup using DPM 2012

I have been working on this issue for some time and it was always failing with different kind of errors, i consulted Microsoft Team as well and finally it worked with me. I am using DPM 2012 but it shouldn't differ with any earlier DPM version as 2010. The main blocking issue here is the TMG component on the UAG server. Remember that its highly recommended not to touch the TMG configuration on the UAG however this is one of the rare cases that need the administrator to tweak some TMG settings. To enable the DPM to backup UAG and install the client you need to do the following (Make sure to take Full backup from your TMG settings and Rules):



1. Ensure the File and Printer sharing is checked/Enabled on the UAG internal Network card.

2. From the TMG console- Firewall Policy. On the right pane click show system Policy rule

3. You need to disable system Rule number 2 (Allow Remote Management from selected computers using MMC) by Right clicking the rule and edit system policy, I am assuming the default TMG rules are not touched before.

4. You need to disable System Rule number 22 (Allow RPC from Forefront TMG to Trusted servers)

5. From the Right Pane, in the toolbox section create a new Protocol under user defined. The Protocol parameters as follows:

Primary connection: Type: TCP, Direction: Outbound, Port range: 135-135

Secondary Connection: Type: TCP, Direction: Outbound, Port range: 1024 - 65535

6. Final Step, create a new Access Rule (Make sure to move it to the top). Allow - All outbound traffic except selected (Choose - RPC All interfaces) - From DPM server (Create computer object with DPM IP address)- To Local Host (UAG server) - All users................etc



Save the Settings and ensure they are Synced from the monitoring tab. Now try to install the Agent from the DPM on the UAG server and take a simple test backup.

Read More

Microsoft UAG 2010 SP3 Under Work to Support Windows 8 & IE 10

Microsoft officially announced couple of days ago that UAG 2010 SP3 will be released the first quarter of 2013. This new Service pack will provide support for Windows 8 and IE 10 as well as other applications as Exchange 2013, Sharepoint 2013.........etc

The support of DirectAccess clients running Windows 8 as well as the normal Service pack fixes and improvements are expected.

http://blogs.technet.com/b/edgeaccessblog/archive/2012/11/26/uag-2010-service-pack-3-is-in-the-works.aspx

Looking forward to getting the new Service pack and testing it with Windows 8.




Update: Microsoft UAG SP3 is released on Feb 2013 and can be downloaded from http://www.microsoft.com/en-eg/download/details.aspx?id=36788

Also UAG SP3 Rollup 1 which is released to fix several issues with SP3 is released on April 2013 (Need SP3 to be already installed) and can be downloaded from http://support.microsoft.com/kb/2827350

Read More

UAG 2010 RDP Application Failure after applying November 2012 KB2592687 Update

I had a problem accessing any RDP application on my UAG portal (whether its Remote App application , RDP User defined, RDP Gateway or VDI Pool– Predefined Remote Desktop Host), after several hours and investigation with Microsoft team, it turned to be an update released more than 2 weeks ago KB2592687 regarding RDP 8.0 update.

 

http://support.microsoft.com/kb/2592687

 

Looks like UAG Portal is not yet compatible with the new RDP 8.0 update. After uninstalling/Removing this update from my client machine (Windows 7), everything worked fine. I would recommend everyone using the UAG portal to hold for this update till its fully compatible. I escalated this issue for further investigation.

 

For Corporates with WSUS implementation, they may decline/Disapprove this update till further update.

Read More

Microsoft UAG 2010 Web Monitor All Events displays Message ID 108 Every Minute

After applying Microsoft UAG 2010 SP2 released couple of month ago I noticed that the UAG Web Monitor All Events Message ID 108 is repeated all the way and almost every minute as shown below.

After discussing this issue with Microsoft Escalation Team, it turned that its a known issue after UAG SP2 related to group memberships. Microsoft is aware of this issue and they have a private fix for this specific problem. After applying this fix, I didn't encounter this warning again.

I would recommend anyone having this warning to open a case with Microsoft to get this fix, this case shouldn't be counted since its a known bug.

Read More

Manual add of Shares to Microsoft UAG File Access

Microsoft UAG 2010 File Access is a nice feature to securely publish your internal shares on your UAG Portal for Internet users. To successfully publish your shares on UAG portal and for the File access to work, it requires the following:

1. NETBIOS should be enabled, Ports 137-139 should be open and not blocked by any internal Firewall
2. Port 445 for SMB should be open so UAG server can access/Locate the shares.
3. On the UAG NIC facing the internal Network as well as on your Domain Controllers NICs, make sure to enable the NETBIOS Over TCP from the NIC advanced properties (WINS Tab).
4. The File servers should have the Turn On discovery feature enabled (check attached) from the Network card advanced sharing options. By design it will turn off automatically unless you started several services as SSDP and UPnP services, please check this thread for more information http://social.technet.microsoft.com/Forums/en-US/windowsserver2008r2networking/thread/17e7b386-53ea-411c-8d90-cf4a6229ba27

Sometimes its hard to configure all these settings or maybe its restricted by your network policy. To manually add a network share or even DFS share to your UAG file access you need to modify the ShareAccessCfg.xml (This is the core file for the File Access Application). This file is located under ..\Microsoft Forefront Unified Access Gateway\von\FileAccess

The ShareAccessCfg.xml file can be edited easily using a notepad or any Free XML Editor, one editor that i use frequently is the Microsoft XML Notepad 2007 http://www.microsoft.com/en-us/download/details.aspx?id=7973

To manually add a server or Share you need to add them under the Server section or Share section as shown below

   <servers>

<server name="Domain\Server1" marked="1" provider="MS"/>

</servers>

<shares>

<share name="Domain\Server1\Share_name" marked="1" provider="MS"/>

</shares>

After changing and saving the ShareAccessCfg.xml, make sure of the following:

1. Restart Microsoft Forefront UAG File Sharing Service
2. Open the Application from the UAG Console - Admin - File Access and make sure to hit Apply on each item (Domain, Server and Share)
3. Activate UAG

Read More

DNS64 Not Healthy after Applying UAG SP2

For those who missed the latest news on UAG, Microsoft released UAG SP2 early this month. For what is new in Microsoft UAG SP2 please check the following link:

http://technet.microsoft.com/library/jj590875

http://support.microsoft.com/kb/2710791

To Download Microsoft UAG SP2, please follow this link:

http://www.microsoft.com/en-us/download/details.aspx?id=30459

Everything went fine while downloading and updating UAG server with the latest SP2, After reboot i noticed that the DNS64 shows Not healthy under the DirectAccess Monitor/Current Status. This is the same behavior that i faced while installing update 1 Rollup 1 early this year and the workaround to fix it was to disable/enable Direct Access from the UAG 2010 console. For detailed steps please check my earlier link:

http://itcalls.blogspot.com/2012/01/dns64-unhealthy-after-applying-uag-sp1.html

Read More

Microsoft UAG DirectAccess Clients Cannot Reach and Ping your Partner/Newly Acquired Company Network

Its quite often that many corporations acquire a new company or merge with another company with different domain name, subnets................etc. DirectAccess clients in one company cannot reach or ping the different resources, servers, routers..........etc in the other side (acquired/partner company). This can be solved by modifying your DNS infrastructure and UAG DirectAccess Settings as per the following steps:

1. Configure the UAG server to have an IPV4 route to the new acquired network(s). 
2. Make sure that the new acquired Network(s) are added to the UAG internal Networks. This can be done from the UAG Admin Menu – Network Interfaces – Define Internal network IP address range.
3. The DNS servers used by the UAG and DirectAccess clients should be configured to resolve the acquired/Partner Domain either by having their DNS zone or by using conditional Forwarders.
4. Configure your DirectAccess clients to use a DNS suffix search list. This list should include their current original company domain and the newly acquired domain. You may want to test it manually to ensure its working however its preferred to be done on the UAG DirectAcccess clients OU using Group policy as per attached.

5. Microsoft UAG need to be configured to ensure that the client’s NRPT (Name Resolution Policy Table) instructs the client to contact UAG for name resolution of the acquired domain. This will be done from the DirectAccess UAG configuration Step 3 (Infrastructure Servers – DNS Suffixes) as shown below

6. Apply the new config/policy and Activate the UAG.
7. Finally run gpupdate /force on the client to refresh the client group policy. To ensure that the policy is updated on the DirectAccess client you can run the “netsh namespace show pol”.

Read More

RemoteApp and Web Application ICON Customization in UAG 2010 Portal

UAG 2010 Portal customization is one of the key strengths in the UAG system. The Customization of UAG is based on the Custom Update concept, for more details and real life example, please check the following articles:

• http://itcalls.blogspot.com/2012/03/uag-portal-home-page-customization-left.html
• http://technet.microsoft.com/en-us/library/ee861168.aspx

One of the main customization issues that i faced during the last few weeks is changing the Default icons for applications and RemoteApp published applications on the portal. UAG by default is pre-loaded with several default icons for different applications however Custom apps published using the Remote Desktop Services (RDS) RemoteApp or custom Web published apps gets the default ICON which is not sometimes representing the application as per the Owner point of view. In this article i will provide two examples for ICON customization in UAG 2010 Portal.

1. RDS RemoteApp applications, This includes three fairly simple steps:
• You need to have your ICON file saved in PNG format, the size won't matter as the UAG will automatically re-size it according to its placement in the portal. I tried 15x15 and 32x32 and 64x64 Pixels and it worked fine for the three of them.
• The ICON need to be saved under
  C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage\images\AppIcons\CustomerUpdate (Provided that you installed the UAG in the default C-drive Location). The file should be saved under the application name, for example if your RemoteApp published application is named App1, then its icon should be App1.png.
• Activate the UAG
2. Custom Web Application, By default Custom Web application is published with the default App.gif file, to change this you have to do it in two locations:
• The main (Home) Portal area will need a GIF icon 90x50 Pixels and it will be saved same as the RemoteApp under C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage\images\AppIcons\CustomerUpdate (Provided that you installed the UAG in the default C-drive Location). Again Make sure to name the GIF file with the same name as per your published Application (For example App1.GIF).
• Edit the Properties of the published Application on the UAG portal and change the ICON properties on the Portal Link TAB to reflect the new ICON

• The LeftExplorer Menu needs another ICON file with lower Pixel 15x15 and it should be named with the application name_ICON (For example App1_icon.GIF), similar to the above example, its saved under C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage\images\AppIcons\CustomerUpdate (Provided that you installed the UAG in the default C-drive Location).
• Activate the UAG

These two examples should lay the basic knowledge to customize your UAG Portal application ICONS and hopefully you will find it useful.

Read More

Publishing Microsoft Pool VDI on UAG 2010 Portal

Virtual Desktop Infrastructure is becoming a hot issue nowadays with many companies adopting this technology due to its flexibility, machines density, mobility, security, manageability and overall total cost of ownership. VDI can be either dedicated/Personal desktop assigned for specific user or pool of desktops available for all users (First come is first served); both flavors have their own benefits/drawbacks depending on your exact need and infrastructure. Microsoft allows you to publish the VDI solution on its UAG portal/Trunk however it’s not straight forward and not well explained/documented.

For an introduction to VDI components, please check the following link.

http://technet.microsoft.com/en-us/video/microsoft-virtual-desktop-infrastructure-vdi-explained.aspx

To publish your VDI Pool on UAG for External users, you need to do the following:

1.    Ensure the UAG server is fully updated and patched with latest UAG Service Pack and Rollups.

2.      From the UAG 2010 Server Copy the file ...\Microsoft Forefront Unified Access Gateway\common\conf\rd-template.txt to ...\Microsoft Forefront Unified Access Gateway\common\conf\Custom Update\rd-template.txt. This is needed to modify some RDP Parameters to make the VDI redirection work. For more information please check the attached link

 http://technet.microsoft.com/en-us/library/ff607422.aspx

For more information on the UAG Custom Update mechanism and a detailed example please check the following articles

http://technet.microsoft.com/en-us/library/ee861168.aspx#Customizing

http://itcalls.blogspot.com/2012/03/uag-portal-home-page-customization-left.html

3.    Add the below two lines to rd-template.txt and save it in Custom Update folder (mentioned in previous steps).

use redirection server name:i:1

loadbalanceinfo:s:tsv://vmresource.1.1

use redirection server name => Specifies whether a redirection server is allowed.

loadbalanceinfo => Contains the load balancing cookie used to choose the best server for the client computer. If you know your VDI Pool ID then you can change this command to be loadbalanceinfo:s:tsv://vmresource.1.PoolID

To get your VDI Pool ID, you need to connect to your Internal Connection Broker server then open the Server Manager – Roles – Remote Desktop Services – Remote Desktop Connection Manager – RD Virtualization Host servers– Pooled Virtual Desktops and then you can see all the properties including the Pool ID.

4.      From your UAG Portal/Trunk add new Application – Terminal Services– Remote Desktop (Predefined).

5.    In the Server Settings add the VDI Redirector session Host IP or Full Address and in the below space make sure to add all IP addresses or names of any system in your VDI solution (Session Broker, Gateway, Redirector, Session Host Virtualization and Virtual machines subnet). This is very critical step for the publishing rule to work fine. The Easiest thing is to add the full IP range for your VDI subnet. Then Activate your UAG.

Note: If you already created the VDI publishing application and it wasn’t working, make sure to delete this application, apply all previous changes and then add the application again, the Custom update changes won’t work for existing published applications.

Read More

UAG Portal Home Page Customization – Left Side Menu/Scroll Bar Example

Microsoft UAG 2010 offers a very flexible way for customizing different pages and settings. The UAG Customization mechanism is deployed using a “CustomUpdate” Folder structure. Under the “Microsoft Forefront Unified Access Gateway” folder tree you will notice that several folders contain this “CustomUpdate” folder, in this folder the UAG admins can create their own Files and place them in the CustomUpdate folder. 

When the UAG is activated it checks these folders first before checking the default folder. Its highly recommended to try all your customizations in this Folder “CustomUpdate” and the main reason is that if things went wrong, you can just delete these files and everything will be back to the default state before customization. Most of the Customization done for the UAG portal is done via the PortalHomePage folder as per attached screenshot.

An Example of Customization that I came across lately is the ability to increase the width of the Portal Home Page Left Side Menu. To Increase the Left Side Menu are you need to do the following:

1. On the Forefront UAG server, open the folder Microsoft Forefront Unified Access Gateway\von\PortalHomePage
2. Copy the file Standard.Master to the folder Microsoft Forefront Unified Access Gateway\von\PortalHomePage\CustomUpdate.
3. Go to the Below section and modify the Width Portion <td class="midTopSideBarCell" style="width: 200px;"> then Activate the UAG and test the change.

<td class="contentLeftSideBarCell" id="LeftSideBarCell">
                            <table cellpadding="0" cellspacing="0" class="leftSideBarTable">
                                <tr>
                                    <td class="leftTopSideBarCell">
                                        &nbsp;</td>
                                    <%-- Folder View Title --%>
                                    <td class="midTopSideBarCell" style="width: 200px;">

This will increase/Expand the left Side Menu however the Bottom scroll bar is not automatically sized according to the main cell, to adjust it to automatically size/fit with the main left area you will need to customize the Office.css (Thanks to Microsoft team) file as follows:

1. On the Forefront UAG server, open the folder Microsoft Forefront Unified Access Gateway\von\PortalHomePage\App_Themes\Office\Office.css
2. Copy the Office.css file to the \von\PortalHomePage\App_Themes\CustomUpdate\Office\Office.css
3. Go to the below section (.SideBarContent) and modify the Width from 165px to 100% as shown below. Activate the UAG and test the change. This will automatically adjust the scroll bar to fit the left area in the portal.

A very good reference is Technet Article of Customizing the Portal http://technet.microsoft.com/en-us/library/ff607389.aspx and Ben Ari/Rainier Amara Latest comprehensive book dedicated for UAG 2010 Customization.

Read More

Publishing IMAP/IMAPS on Microsoft UAG 2010 – UAG Support Boundary

Recently several users with BlackBerry phones approached me seeking to access their corporate email on their phones. Microsoft UAG doesn’t support Blackberry service however a workaround to this is using the IMAP to access and download their emails on their Blackberry phones.

Microsoft Highly recommend and Advice all UAG administrators to leave the TMG configuration (Installed by default on the UAG box) untouched. The TMG rules and configuration is controlled and configured by the UAG. The administrators should not use the TMG for publishing applications and other stuff. However there are some exceptions to this strict recommendation and its published in the UAG support Boundaries document. I also checked with Microsoft Support team and they confirmed the IMAP publishing based on this document.

UAG Support boundaries:  http://technet.microsoft.com/en-us/library/ee522953.aspx

As per the above mentioned document, Forefront TMG can be used to publish IMAP/IMAPS. Attached below is the section dealing with supported configuration on the TMG as per the above document.

Accordingly IMAP/IMAPS can be published normally from the TMG server (On UAG Box). This will be a simple Server Publishing Rule with the following settings:

1. Action - Allow
2. Traffic - IMAPS Server
3. From - Anywhere
4. To - Type You Exchange Server IP
5. Networks - External or DMZ (As per your setting)
6. Schedule  - Always

Its Highly recommended to use the IMAPS over the IMAP to ensure the traffic is encrypted.

Read More

Manual Install of UAG 2010/Remote App and RDS Portal Components

Microsoft UAG 2010 main functions are Application Publishing and Enhanced DirectAccess deployment. The Application publishing allows you to publish several applications on either HTTP or HTTPS trunk. Application publishing includes Web applications, Non-Web applications, Remote Desktop Services (RDS), RemoteApps and VPN services.

When accessing the UAG portal for the first time from your computer using one of the supported browsers (Please check the Client requirements and Supported browsers in http://technet.microsoft.com/en-us/library/dd920232.aspx) the user will be prompted to download and install the UAG endpoint components, these components are used in many things among them checking device (Endpoint detection), SSL tunneling……………etc. This installation is done once per computer.

Some clients have restricted Internet Explorer settings (Using Group Policies) that prevent them from installing MSI or EXE files from the Internet and they need to install the Endpoint components manually.

There are two types of clients that you need to install manually to fully utilize the UAG portal.

1.    UAG Client Components, these are available on the UAG server under

 C:\Program Files\Microsoft Forefront Unified Access Gateway\von\PortalHomePage

 

Several files are available under this location for each component or you can just take the WhlClientSetup-all.msi from this location and have your users install it manually (Of course they need to have admin rights on their computer). Make sure you are running the latest UAG version on your server. The current latest version is 4.0.1773.10110 http://support.microsoft.com/kb/2647899

 

When manually installing the WhlClientSetup-all.msi, the users will be given the choice for Typical installation or Custom Installation to pick specific components as per the below screenshot.

 

2.    Remote Desktop Services (RDS) and RemoteApp need the latest Remote Desktop Connection 7.0 client update for Remote Desktop Services (RDS) for Windows XP SP3, Windows Vista SP1/SP2 which can be downloaded from the following site  http://support.microsoft.com/kb/969084  

This RDC 7.0 client is already installed by default on Windows 7 systems. If you using Network Level Authentication (NLA) on the RDS servers then you need to check this article http://support.microsoft.com/kb/951608 since the NLA is disabled on XP service pack 3.

 

Once both components (UAG and RDS) are installed manually, the user will be prompted to approve running the ActiveX and adding the portal site to the browser trusted sites.

Read More

DNS64 Not Healthy after Applying UAG SP1 Update 1 Rollup 1

After applying the latest Rollup 1 for UAG SP1 Update 1 released on Jan 12, 2012 I noticed that the DNS64 is unhealthy under the Direct Access Monitor/Current status as shown in the below figure.

I did a reboot to the UAG/Direct Access server (although it’s not required by the fix) however the DNS64 component still showed unhealthy. I disabled/enabled direct access as follows:

1.     Disabled Direct Access

2.     Saved/Activated the configuration

3.     Enabled Direct Access

4.     GPupdate /force on the UAG Server

5.     Applied the policy

6.     Activated the configuration

After that it all worked fine. I am not sure about the reason (Will try to check with Microsoft Team) however that workaround fixed my problem.

Read More

Publishing Direct Access Web Monitor on UAG Portal

Recently I tried publishing the UAG Web Monitor on my External HTTPS Web Portal, the UAG web monitor is very useful monitoring and reporting web application which gives you the ability to view different UAG sessions, applications, Direct Access and the UAG event viewer.

When the UAG Web Monitor is published on the UAG Portal Trunk everything works fine except the Direct Access section (Current Status and Active Sessions). When you try to open the Current Status or Active Sessions you get the below error screen.

This issue looks like a bug with the UAG and I opened a support case with Microsoft and they are considering a permanent fix. Currently to fix this issue you need to add 5 rules as follows:

1. Go to the Trunk Configuration - Configure Trunk Settings - Configure - URL set.
2. Copy any Web Monitor default rule and paste it 5 times
3. Modify/Add the URL in the 5 rules as follows:
1. /damonitor\.asp
2. /damonitorcurrentstatus\.asp
3. /damonitorcurrentstatusrefresh\.asp
4. /damonitoractivesessions\.asp
5. /damonitoractivesessionsrefresh\.asp
4. Save- Activate and this should fix the issue.

Here is a Screen shot of how these rules should be added and modified.



Read More

Teredo with UAG SP1 Direct Access not working

This problem was reported on a standard DirectAccess implementation scenario where all clients aren’t able to connect using Teredo and they all fall back to IPHTTPS which is the last resort for any DirectAccess connection.

Symptoms:

1.       When checking the Teredo Interface state, the following was displayed.

Netsh int teredo show state

Client Type             : teredo host-specific relay

The Client type should have been Teredo Client for a successful Teredo connection.

2.       I disabled the IPHTTPS interface to ensure it won’t fall back to the IPHTTPS option, opened wf.msc (windows Firewall with advanced security mmc) and navigate to monitoring – Security associations – Main Mode and Quick Mode. Both displayed nothing as shown in the figure below. This indicated IPSEC connection failure

3.       After capturing both server and client logs and with the help of a Microsoft senior engineer we noticed the following error

 Windows error 13887(ERROR_IPSEC_IKE_CERT_CHAIN_POLICY_MISMATCH)

Resolution:

1.       A recent KB was released from Microsoft to address this specific Certificate problem with a recommended fix. This fix needs to be applied on both the DirectAccess Server and Client.

 http://support.microsoft.com/default.aspx?scid=kb;EN-US;2615847

2.       It turned out that the DirectAccess server has an Antivirus solution which seems to load several modules like NAC and others although it was configured to run normal AV file protection.

 After applying the Fix and removing the AV from the UAG server the clients were able to connect normally using Teredo.

Read More