Once complete, an ISATAP tunnel adapter network interface with a unicast IPv6 address will appear in the output of ipconfig.exe, as shown here. Set-NetIsatapConfiguration -State Enabled -Router -PassThru Once the DNS records have been added, you can configure a single computer for manage out by opening an elevated PowerShell command window and running the following command: Removing it is not recommended either, as it will result in ALL IPv6-enabled hosts on the network configuring an ISATAP tunnel adapter. This name is included in the DNS query block list on most DNS servers and will not resolve unless it is removed. To do this, you must first create DNS A resource records for the internal IPv4 address for each DirectAccess server as well as the internal virtual IP address (VIP) assigned to the cluster. For example, ISATAP can easily be deployed in single site DirectAccess deployments where load balancing is provided using Network Load Balancing (NLB). “ Not supported” is not the same as “ doesn’t work” though. ISATAP is not supported when deployed in a multisite or load-balanced environment.

If IPv6 is not deployed natively on the internal network, the Intrasite Automatic Tunnel Addressing Protocol (ISATAP) IPv6 transition technology can be used to enable manage out.Īccording to Microsoft’s support guidelines for DirectAccess, using ISATAP for manage out is only supported for single server deployments.

DirectAccess clients use IPv6 exclusively, so any communication initiated from the internal network to remote DirectAccess clients must also use IPv6. DirectAccess connections are bidirectional, allowing administrators to remotely connect to clients and manage them when they are out of the office.

Tunnel adapter isatap windows 10