Blocking Media over DirectAccess

Microsoft’s DirectAccess technology is another form of remote connectivity that has gained popularity over the past few years. DirectAccess maintains a persistent IPv4 connection to the corporate network’s IPv6 resources using tunneling, which then allows remote users to transparently access internal servers. Lync Server 2010 did not support IPv6 at all, but now that Lync Server 2013 does support IPv6, it is technically possible to use DirectAccess to connect a remote Lync user to a Front End pool.

However, in practice this is still not a good solution for Edge services. DirectAccess suffers the same limitations as any other VPN technology in that it is redundantly encapsulating the media traffic Lync uses for audio or video calls.

Administrators can block remote users from connecting to Lync internal servers over DirectAccess by implementing exceptions in the Name Resolution Policy Table (NRPT) on the DirectAccess servers. DirectAccess is based on FQDNs instead of IP addresses like a traditional VPN technology, so these exclusions prevent remote users from resolving internal Lync resources to their tunneled IPv6 address.