Setting Up MS DirectAccess

[jharlow]

Trying to configure DireectAccess (Windows Server) to work but I believe it is failing due to the Palo Alto. I created a custom application and application override for the ports needed but still failing. Per a Microsoft Document, "the firewall has to be configured to pass the traffic through transparently. you cannot NAT the traffic".  How do I do this?  Anyone else experience using DA (more so with DA is behind the PA firewall)? 

Thanks, 

[Raido_Rattameister]

I have not set up DirectAccess but few ideas.

Do you have dedicated public IP for DA?

If yes then can you set up bi-directional NAT with Service Any.

Permit all traffic from specific source IP you attempt to connect from to this DA IP.

Review logs. What applications do you see in use?

Disable app-overrides temporarily to see how Palo identifies this traffic.

[jharlow]

DA does have a public IP. The PA is currently setup as a vwire, so NAT is handled by our Cisco ASA. I have all of the ports enabled correctly on the ASA).  As far as the PA, I created application overrides for all of the ports. One thing I noticed and I know this is the default since version 7 ( I believe); the policy for "Inbound Traffic" has application-Default as a service type. Should I change this to any and see if that solves the issue (instead of trying to figure out application overrides)?

You mention premit all traffic from the source IP. Is that as in creating a new policy with that source IP and set any as service and allow?  

Sorry, still a newbie to PAN.  Thanks. 

[Raido_Rattameister]

Yes if you know public ip of client who tries to communicate then create policy where source zone is wan, source ip is client ip, application is any and service is any.

And share logs what you see Monitor > Traffic.