Quantcast
Channel: Forefront Edge Security – DirectAccess, UAG and IAG フォーラム
Viewing all articles
Browse latest Browse all 1485

DA 2016 - NLS DNS resolution retries (reduce from 4 to 2)

$
0
0

Hi folks

I have a problem where DA 2016 takes about 20-30 seconds longer to connect than the *still in production* UAG 2008 Direct Access.

UAG DA takes 30 seconds from joining a new wireless network for example, DA 2016 about 50-60 seconds. In a nutshell, it sees like UAG 2008 clients try to resolve the NLS address twice, and DA 2016 tries to resolve it 4 times.

What I would like to know, is can I reduce the DA 2016 retry attempt?

I've worked with MS a little on this, and through various traces, I can see that BOTH UAG and DA 2016 are trying to resolve the NLS address. Through a strange ISP problem (I think ISP DNS resolution is the issue), both UAG and DA 2016 ARE reporting *successful* NLS DNS resolution within the traces, and this is adding about 15 and 30 seconds worth of delays to the connection time because of TCP retransmits that then take place. 

The NLS address is NOT resolvable externally, but I believe various UK ISP's are redirecting DNS requests to a *friendly* error response when a resoltion isnt possible, and this is being interpretted as "successful" DNS resolution, pausing the DA connection process, and the clients then attempt to access internal resources believing they are within the network, but these resource connections attempts obviously fail.

Anyway, that's something I will need to adress somehow, but for now, can someone advise me if it's possible to reduce the DA 2016 NLS DNS resolution retries from say 4 to 3 or even 2. 

Cheers

Coop.


Viewing all articles
Browse latest Browse all 1485

Trending Articles