Once again Jason Jones comes to the rescue It’s written with Microsoft UAG in mind but the DirectAccess in UAG is more or less the same as in Windows Server 2012/R2 so it’s applicable. So I’m going with Option 2 which is implementing a mini ISATAP network on top of the regular old IPv4 network.

It’s possible I guess but my fear of taking that specific path is the question if your network is capable of routing IPv6 packets. The process of how to go about that route is described in this article by the brilliant Jason Jones. Option 1 is to manually set an IPv6 address on one or more management computers (instead of the whole network) and go native IPv6 in a minimized fashion. If you’ve never dealt with IPv6 before just looking at the IPv6 addresses is scary enough. In it, Microsoft says “ If ISATAP is deployed in a multisite, load balancing, or multidomain environment, you must remove it or move it to a native IPv6 deployment before you configure DirectAccess.“ For most of us, that’s a pretty tall order. At least not large networks, according to this article by Microsoft. First of all is that it’s not really made for production networks. Okay, so now we know what we want and why we need it, but how to implement it then? There are some things to consider when thinking about making use of ISATAP. Before I bore you to death, my point is that these translators only work one-way from IPv6 to IPv4, not the other way around, which is what we try to do when connecting from an internal IPv4 computer to our IPv6 connected DirectAccess computers.

Two of those protocols that are making DirectAccess IPv6 clients able to talk to internal IPv4-only resources are NAT64 ( RfC:6146) & DNS64 ( RfC:6147). As I guess you know, DirectAccess is a strict IPv6 technology and since almost none of us has implemented IPv6 in our corporate networks yet, we need some sort of magic glue between IPv6 and IPv4. Why is that? It’s because of the mechanism that makes the magic behind DirectAccess work and its limitations. When implementing DirectAccess for the first time it’s easy to believe that if remote computers can connect to inside computers/servers then inside computers/servers must be able to reach DirectAccess connected clients right? Nope, it’s not that easy unfortunately. What is DirectAccess Manage Out and what’s all the fuzz about? Well to begin with, Manage Out is the concept of managing remote DirectAccess connected computers from an internal computer.

What is isatap device