Having implemented Direct Access with UAG (Microsoft Unified Access Gateway) at a customer location there were some questions when we were done. Their helpdesk is using SCCM (System Center Configuration Manager) and the remote management tools included, how would they go about managing the clients? Would that work even if the user wasn’t logged in? Well, after some research we found out that they could actually manage the client if someone was logged in. If nobody was, no remote management would occur.

The reason? Well, traffic initiated from the inside of the network have to go through the management tunnel if nobody is logged in. For that to happen the servers or workstations that wish to communicate have to be included in the management group. If you’re going to use a management server or workstation for your work it’ll have to be IPv6 capable too because DA / UAG won’t translate IPv4 to IPv6 for traffic initiated from the inside.

UAG configuration:

The UAG needs to include ALL the computers you want to use for remote management of DA clients where nobody is logged on. Ie using the management tunnel. As soon as a user logs on communication can occur on the user tunnel.

Client configuration:

If you’re using mobile connections you’ll need to make sure that they will register their address in DNS. If you don’t do this your clients won’t register, and you won’t be able to find them from your internal network.

(click for Lightbox)

Clients needs to have their firewall configuration updated with rules that allow the traffic you need, for example RDP. Please note that the profile you must use for this is the PUBLIC profile since that’s the one applied when the DA client is connected from the internet. You must also allow “edge traversal” for these rules to work over all tunnels.

(click for Lightbox)

More resources for manage out with Direct Access:
http://blogs.technet.com/b/edgeaccessblog/archive/2010/04/06/powerful-but-not-so-obvious-benefits-of-directaccess-manage-out-capabilities.aspx
http://blogs.technet.com/b/edgeaccessblog/archive/2009/11/17/deep-dive-into-uag-directaccess-manage-out-basics.aspx
http://technet.microsoft.com/en-us/library/ee809065.aspx

I spent last week installing, configurating and troubleshooting UAG for Direct Access. Considering that nobody likes troubleshooting, I thought I’d share some tips and a list of the steps I took to get it up and running.

This guide/list focuses on troubleshooting Direct Access through Microsoft Forefront Unified Access Gateway (UAG), but also applies on Direct Access enabled through Windows Server 2008 R2.

Thanks to Hasain Alshakarti for answering all my questions and giving me a quick lesson on PKI!

Testing:
Try to test your first client from the same network as your outside addresses on your DA/UAG, I’ve spent almost a day troubleshooting a configuration where it turned out that the 3G operator blocks 6to4 (IP Protocol 41). If it works on that network, then you can try it out with 3G.

If it doesn’t work then, you’ll need to create another GPO that disables 6to4 which will make your clients use either Teredo or IPHTTPS instead. Check the netsh-section further down for how to disable it manually. If you don’t it might work with some operators and not work with others, troubleshooting this when your users are road warriors isn’t as fun as one might think…

Note on images: All ip’s / hostnames are masked for customer security.

Server side:

External interface

IPv4 + Ipv6 enabled
Two consecutive IP’s entered
No DNS – This forces the server to always lookup in the internal DNS / through forwarders
No client for Microsoft networks
No file / printer sharing

(click for Lightbox)

Internal interface

No gateway
Internal DNS

(click for Lightbox)

Client side:
Check certificate – Needs to contain a subject name or SAN (Subject Alternative Name) which matches the DNS name of the client. (This also applies to the certificate used for the UAG-server’s SSL-connection.) If the certificate is not properly configured you’ll most likely get eventid 4653 for IPSec.

(click for Lightbox)

Checking the tunnels:
Start Windows Firewall with Advanced Security
Open Monitoring, Security Associations and check under Main + Quick Mode that your tunnels are established. This could also be done with netsh, see below.

(click for Lightbox)

Netsh

(click for Lightbox)

Show main/quick mode connections (read here for more information on IPSec and connections)

netsh advfirewall monitor
show mmsa
show qmsa

Show 6to4 adapter state
netsh int 6to4
show state

Show Teredo adapter state
netsh int teredo
show state

Show IPHTTPS adapter state
netsh in http
show int

Show dns client settings
netsh dnsclient
show state

Show DNS effective name resolution policy table(NRPT)
netsh namespace
show effective

Useful resources and reading:
A useful 6to4 calculator – http://waldner.netsons.org/f6-6to4.php

Designing a Direct Access solution – http://technet.microsoft.com/en-us/library/dd637836(WS.10).aspx
Direct Access Management – http://technet.microsoft.com/en-us/library/ee624048(WS.10).aspx
The Direct Access Test Lab Step-by-Step Guide – http://www.microsoft.com/downloads/details.aspx?displaylang=en&FamilyID=8d47ed5f-d217-4d84-b698-f39360d82fac
General troubleshooting for Direct Access – http://technet.microsoft.com/es-es/library/ee624058(WS.10).aspx

Hope that you’ll get it up and running. I have another post drafted that will deal with the “manage out”-perspective that will allow you to remotely manage / access your clients, will post ASAP!

If you’re running Server Core or Hyper-V Server 2008 R2 you’ve probably come across the problem of teaming nics. No matter which hardware vendor you choose, they all have they’re special way of doing things. Helping an old colleague out the other day it made me realize that it’s not as straightforward as it is in the full version, so I’ve tried it out with both Intel and Broadcom nics. Which you of course know covers the servers from both HP and Dell (where I work, shameless plug).

Installing the Broadcom software to support network teaming in Server Core / Hyper-V Server

Before you start you must install the prereq’s for the drivers, that comes down to .Net 2.0, .Net 2.0 WOW64 and SNMP.
The easiest way is to use OcSetup to install them:

Start /w ocsetup NetFx2-ServerCore
Start /w ocsetup NetFx2-ServerCore-WOW64
Start /w ocsetup SNMP-SC

The “/w” will let you wait during installation so you know when it’s finished, please note that roles/features are case sensitive for ocsetup so type it as it looks…

When that’s done you’ll need to download the 14.1.x-version of the BACS from Dell’s site and extract them to somewhere on your drive, default is c:\broadcom. Navigate to the c:\broadcom\driver_management_apps_installer and run setup.exe.

The wizard kicks in and when you’re done you can team your nics (and change other things too) through the c:\program files\broadcom\bacs.exe utility.

Installing the Intel software to support network teaming in Server Core / Hyper-V Server

Turns out that Intel has their own great post on the subject of command line installations which you can find at http://www.intel.com/support/network/sb/cs-016040.htm.

A short rundown otherwise is that you’ll need the setup.exe program for your nic, then you have multiple choices on how to install them. The base driver can be installed through the included pnputil.exe for Server Core or you could use the Intel setup.exe instead.

This is from Intel’s site and shows you what switches does what:

Setup.exe support the following command line parameters:

Parameter Definition
ANS Advanced Network Services
“0″, do not install ANS. If ANS is already installed, it will be uninstalled.

“1″, install ANS (default).

NOTE: If the ANS parameter is set to ANS=1, both Intel PROSet and ANS will be installed.

DMIX PROSet for Windows Device Manager
“0″, do not install Intel PROSet feature. If the Intel PROSet feature is already installed, it will be uninstalled.

“1″, install Intel PROSet feature (default).

NOTE: If DMIX=0, ANS will not be installed. If DMIX=0 and Intel PROSet and ANS are already installed, Intel PROSet and ANS will be uninstalled.

SNMP Intel SNMP Agent
“0″, do not install SNMP. If SNMP is already installed, it will be uninstalled.

“1″, install SNMP (default).

NOTE: Although the default value for the SNMP parameter is 1 (install), the SNMP agent will only be installed if:
The Intel SNMP Agent is already installed. In this case, the SNMP agent will be updated.
The Windows SNMP service is installed. In this case, the SNMP window will pop up and you may cancel the installation if you do not want it installed.

BD Base Driver and IOATDMA Driver
“0″, do not install the base driver.

“1″, install the base driver (default).

LOG [log file name]
LOG allows you to enter a file name for the installer log file. The default name is C:\UmbInst.log.

-a Extract the components required for installing the base driver and I/OAT driver to C:\Program Files\Intel\Drivers. The directory where these files will be extracted to can be modified unless silent mode (/qn) is specified. If this parameter is specified, the installer will exit after the base driver and I/OAT driver are extracted. Any other parameters will be ignored.
-f Force a downgrade of the components being installed. NOTE: If the installed version is newer than the current version, this parameter needs to be set.

How to install the base driver on Windows Server 2008 and Windows Server 2003:

:\Setup DMIX=0 ANS=0 SNMP=0

How to install the base driver on Windows Server 2008 and Windows Server 2003 using the LOG option:

:\Setup LOG=C:\installBD.log DMIX=0 ANS=0 SNMP=0

How to install Intel PROSet and ANS silently on Windows Server 2008 and Windows Server 2003 (32-bit version):

:\Setup DMIX=1 ANS=1 /qn

How to install Intel PROSet without ANS silently on Windows Server 2008 and Windows Server 2003 x64 Edition:

:\Setup DMIX=1 ANS=0 /qn

How to install components but deselect ANS for Windows Server 2008 and Windows Server 2003:

:\Setup DMIX=1 ANS=0 /qn /liew C:\install.log

The /liew log option provides a log file for the DMIX installation.

To install teaming and VLAN support on a system that has adapter base drivers and Intel PROSet for Windows Device Manager installed, type the command line :\Setup ANS=1.

After a long wait today the email finally showed up in my inbox. I’ve been awarded the Microsoft MVP award in Cluster / High Availability for another year. As you might or might not know this award is given to those who spent time and effort in teaching others about Microsoft technologies, answering questions both live and on the internet and speaking at events such as TechEd.

Congratulations to fellow Swedish MVP’s: Björn Axell, Andreas Stenhall, Anders Bengtsson and Patrik Löwendahl. (and I’ve probably missed a few…)

This will be celebrated with a glass of champagne with the family, also celebrating the purchase of our summerhouse!

Spent the last two days setting up a solution at a customer together with Mattias Olausson from Callista. Our customer wants automatic testing of the nightly builds of their software, a task managed manually until now.

The setup consists of two servers, one running TFS (Team Foundation Server) and another one running System Center Virtual Machine Manager 2008 R2. Besides this we have a Hyper-V host for running the workloads. In SCVMM we’ve created four templates for the client operating systems that the tests should be run on, Windows 7 x86/x64 and Windows XP x86/x64. On these virtual machines we’ve installed all the necessary agents needed by TFS, converted them to templates in SCVMM and added sysprep.inf / unattend.xml to each template to enable a zero touch installation of each operating system.

In TFS Lab Manager you then create a testing project with a virtual infrastructure connected to it, and you select the templates you wish to run. TFS will then deploy the VM’s and run the tests you’ve configured. A report from the test will be written to your selected output directory and the VM’s will be destroyed.

If you’re interested in setting it up, the TFS team have a really good series of articles explaining everything in detail: http://blogs.msdn.com/b/lab_management/archive/2010/03/29/setting-up-various-topologies-to-test-with-visual-studio-team-lab.aspx

There’s also a basic concept overview at http://blogs.msdn.com/b/lab_management/archive/2009/05/18/vsts-2010-lab-management-basic-concepts.aspx

As far as SCVMM and Hyper-V goes you’ll find the basic configuration steps over at http://blogs.technet.com/b/scvmm/archive/2009/01/05/scvmm-2008-installation-step-by-step.aspx

And once you’ve got that up and running, you can run all your tests in the middle of the night and be a lot more productive during the days (sounded like straight from marketing, didn’t it…)!

Left the convention center right after my TLC-duty yesterday to work on my demo. Spent a few hours in front of the computer and then decided to have dinner with Lidholm/Lindström/Edman, my partners in crime. My plan for dinner and one beer didn’t hold up so I came back to the hotel around 11 PM for some more demo work. Got up at 6 AM to finish the scripts, have breakfast and get ready.

My session went ok, one demo failed (which is a must, there’s always one that fails). Other than that my evals were “ok”, I missed out on the stuff that I should’ve thought about. Like font size, not zooming in and such easy things. Didn’t think of the fact that the session rooms here are like 4 times the size compared to Sweden. I know that now :)

The rest of the day will be spent in the Clustering TLC-booth, if you’re around and have a question or just wanna say hi you know where I’m at. Tonight we’ll go shopping, and we probably will end up at Bourbon Street like the rest of the attendees here…

If you’re not in New Orleans but wanna be part of it you can always watch http://www.msteched.com/ where Channel9 broadcasts live interviews. You can also find a lot of other content there.

Some other useful stuff I’ve learned today:
The System Center stuff found over at https://connect.microsoft.com/MSDSA will give you documentation and VHD’s for trying out / demonstrating System Center software. It’s on Connect as you can see, so you’ll need to sign in / sign up as usual on Connect.

Microsoft will support memory over-”allocation” (the term varies a little depending on how you see it) together with USB-devices in Hyper-V (through RDP-connected clients that is, not on the host-level). Full article here.

If you’re running Hyper-V and System Center Operations Manager you might be interested in the free management pack for Hyper-V. You can find that over at Bridgeways.ca!

And last but not least: Analyzing storage performance in Hyper-V or just monitoring performance, two really good articles.

Now, TLC-booth duty!

Here in New Orleans the day has just started. Had breakfast with Lidholm/Lindström/Edman this morning and now it’s time for the keynote. You can watch it live at http://www.msteched.com and that site will also contain more content during the week, free of charge too!

Will be updating this post during the day.

Nothing is like the calm when you’re done with your presentation, the demo is working (just gotta decide which demo to run) and I’ve packed. Now I’ll hang on the balcony with a beer and a whisky and watch some episodes of Fringe and Mad Men, waiting for the wife to come home.

It’ll be interesting to see New Orleans and how much they’ve restored after Katrina. Have a great list over bars and clubs to visit, and it’ll be fun to meet my old colleagues again. I fear Howl At The Moon already!

Leaving tomorrow morning for Chicago / New Orleans and will post pictures and observations throughout the week.

Are you going? Tweet / email me and I’ll meet you there!