All,
I have mitigated the problem, but wanted to understand it. The mitigation is to reconfigure his home router/firewall to stop serving IPv6. He had to reboot his machine to get rid of the served IPv6 address, but then DA started working again.
So, here's the description of the problem - anyone who can tell me what the problem is will have my gratitude. If necessary, I can share DCA logs offline.
A remote worker recently upgraded his ATT Uverse connection at home. DirectAccess stopped working for him. When at home, he had to resort to using our SSL VPN (Aventail), but when he did so, external company resources (we have split brain DNS) were unavailable.
I went through these two links to troubleshoot:
http://directaccessguide.com/2014/02/18/directaccess-client-troubleshooting-guide/
and
http://www.microsoft.com/en-us/download/details.aspx?id=41938
Both passed with flying colors.
o- He sent the DCA (DirectAccess Connectivity Assitant) logs to me, and I worked through them to see if anything was amiss, and I usedhttp://join.me to walk through the above links as well.
o- GPOs are applied and group memberships for the computer are correct (gpresult /h)
o- When not connected via the Aventail client, could ping external company resources (split brain DNS) and couldn't ping internal resources by name (e.g. usdc4.example.com), but can ping internal resources via IPv6 address if manually entered (!?! - very odd).
o- When connected via the Aventail client, could ping internal resources (gets name resolution, returns IPv4 address), but couldn't ping external resources (name resolves to IPv4 address but ping doesn't return (!?! - again, very odd).
o- Tethering to his Verizon phone proved that DA was working fine.
