Solution— Remove the internal IPv6 interfaces not configured in the Forefront UAG DirectAccess Configuration Wizard so that all internal traffic passes through the specified internal IPv6 interface.

Cause—If the external interface detects that it can reach a domain controller, it sets the Windows Firewall with Advanced Security Profile to "Domain Profile", which disables the IPsec rules required for the DirectAccess server to receive connections from DirectAccess clients (connection security rules, firewall rules, etc). This event may occur when the external-facing interface was previously connected to the domain, but was later reconfigured so that it could no longer access the domain.

Warning: Serious problems may occur if you modify the registry incorrectly using the Registry Editor or another method. These problems may require that you reinstall your operating system. Modify the registry at your own risk.

Solution 1— Delete the entries in IntranetAuth that contain the external-facing IP addresses:

1. Ensure that the external interface is not configured on the for the domain network.
2. Open the Registry Editor to navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Nla\Cache\IntranetAuth
3. Delete all the entries that apply to the external interface - those will be the ones that have the IP addresses assigned to the external interface. For example, if your two external facing IPv4 addresses are 131.107.0.2, and 131.107.0.3, delete the entries in IntranetAuth that contain those IP addresses.
4. Reactivate Forefront UAG.

Solution 2—Restart the Microsoft Forefront UAG Configuration Manager (ConfigMgrCom) service, and reactivate Forefront UAG.

1. Reactivate Forefront UAG.
2. If the activation was still not successful:
   
   1. Check the activation monitor for more specific error messages.
   2. Look in the Windows Event Viewer for NLB specific events.
   3. Look in the TMG alerts for NLB specific events.

1. Reactivate Forefront UAG.
2. If the activation was still not successful:
   
   1. Check the activation monitor for more specific error messages.
   2. Look in the Windows Event Viewer for NLB specific events.
   3. Look in the TMG alerts for NLB specific events.

1. Reactivate Forefront UAG.
2. If the activation was still not successful:
   
   1. Check the activation monitor for more specific error messages.
   2. Look in the Windows Event Viewer for NLB specific events.
   3. Look in the TMG alerts for NLB specific events.

Cause—The same the internal and external-facing IPv4 addresses specified in the Forefront UAG DirectAccess Configuration Wizard are configured on the same network interface.

Solution— Ensure that the internal and external IPv4 addresses are configured on the correct network interfaces.

---

10096 - The selected internet-facing IPv4 network interface %1 does not support IPv4.

Cause—IPv4 is disabled on the specified Internet-facing network interface of an array node.

Solution— Enable IPv4 on the specified network interface of the array node:

---

 10097 - The selected second internet-facing IPv4 address %1 cannot be found on this server.

Cause—When the second Internet-facing IPv4 address is selected and applied in the Forefront UAG DirectAccess Configuration Wizard, and is then changed between applying and activating Forefront UAG.

Solution—Ensure that:

---

10099 - The UAG DirectAccess server must be configured with two, static, consecutive, public, IPv4 addresses, on the Internet-facing physical interface. Configure the IPv4 addresses, and then try again.

Cause—When a node is added in an external load balancing scenario, and the node is not configured with two static, consecutive, public Internet-facing DIP addresses.

Solution—Ensure that:

---

10100 - The UAG DirectAccess server requires an IPv6 address on the internal-facing interface. Configure an IPv6 address on the internal-facing interface.

Cause—When configuring external load balancing in the Forefront UAG DirectAccess Configuration Wizard, the system validates that the internal facing IPv6 DIP exists on the AMS. When Forefront UAG is activated, if one or more of the nodes is not configured with an internal facing IPv6 DIP the activation fails.

Solution—Ensure that:

---

10111 - The adapter configured as external-facing is not communicating with the external network. Ensure that the adapter is enabled, and that the network cable is connected.

Cause—No communication activity can be detected from the external-facing adapter.

Solution—Verify that:

---

10118 - The selected internet-facing network interface %1 does not support IPv6.

Cause—IPv6 is disabled on the specified Internet-facing network interface of an array node.

Solution— Enable IPv6 on the specified network interface of the array node: