Direct Access name resolution

Hello,

I have a 2012 R2 direct access server running on a site. This is working well.

The site is on a 192.168.1.0/24 IP range and there is a gateway on 1.254.

Also on this site, connected to the router on 1.254 is another router on the 10.32.0.0 IP range.

The site's DNS server has conditional forwards in place for some websites. For examble www.website.int and when clients ping the address, they will get a reply from a 10.32. address. This is normal and expected.

However, any direct access clients on an external network are not able to resolve the names (like in the above example).

I really don't want to enable force tunneling, it's only a handful of sites that need to be routed to the 10.32 network. All other internet traffic can use the clients external internet connections.

Any ideas on how to get the DA clients to resolve the internal names (or use) the site's DNS server?

Thanks,

Jamie

Windows Server 2012DNSRemote Access

Last Comment

JamieD71

8/22/2022 - Mon

DrDave242

3/18/2015

It sounds like the FQDNs of those sites need to be added to the Name Resolution Policy Table. As long as DirectAccess is working properly, the NRPT should designate how those FQDNs are to be resolved by DA clients.

JamieD71

3/18/2015

ASKER

Hi,

Thanks for the reply.

On my DC, I've got conditional forwarders setup so traffic for (example) internalserver.com is pointing to another DNS server on the 10. network.

On the Direct Access console, I've looked at the DNS section on infrastructure setup. I can specify the domain name there, but I think I can only specify the DNS server on my domain... if I try and specify the IP of the DNS server on the 10. network, it complains.

I was hoping that if I specified my DNS server, the request would be forwarded...

Any ideas?

Thanks,

Jamie

DrDave242

3/19/2015

On a DirectAccess client, run netsh namespace show policy from an administrative command prompt and post the output here. You can obscure anything you don't want public.

Experts Exchange is like having an extremely knowledgeable team sitting and waiting for your call. Couldn't do my job half as well as I do without it!

James Murphy

JamieD71

3/21/2015

ASKER

Sorry for the delay.... Not much here, other than the default...

DNS Name Resolution Policy Table Settings

Settings for DirectAccess-NLS.cab.local
----------------------------------------------------------------------
Certification authority :
DNSSEC (Validation) : disabled
DNSSEC (IPsec) : disabled
DirectAccess (DNS Servers) :
DirectAccess (IPsec) : disabled
DirectAccess (Proxy Settings) : Use default browser settings

Settings for .cab.local
----------------------------------------------------------------------
Certification authority :
DNSSEC (Validation) : disabled
DNSSEC (IPsec) : disabled
DirectAccess (DNS Servers) : fd64:74c:631f:3333::1
DirectAccess (IPsec) : disabled
DirectAccess (Proxy Settings) : Bypass proxy

ASKER CERTIFIED SOLUTION

DrDave242

3/23/2015

THIS SOLUTION ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

See Pricing Options

Start Free Trial

GET A PERSONALIZED SOLUTION

Ask your own question & get feedback from real experts

Find out why thousands trust the EE community with their toughest problems.

JamieD71

4/2/2015

ASKER

Hi. Thanks for this - now working after the NRPT entry.