Configure Private Access for Microsoft Active Directory Domain Services

Private Access Configuration

To enable a Windows client running Skyhigh Client 5.x.x to join the <domain.internal>, configure the required Private Access (PA) applications for DNS and Active Directory traffic.

Perform the following steps in the Skyhigh console:

1. Go to Settings > Infrastructure > Private Access Configuration.
2. Click the Applications tab.
3. From the Action menu, select Add Application.
4. In the Add Application window, define the required applications as described below:

1. Configure On-Prem DNS Server (UDP 53)
   Define the on-prem DNS server IP as a PA application. This private DNS application allows users to join Active Directory Domains, query Active Directory group policies.
   • Example. 10.213.139.69
   • Protocol. UDP
   • Port. 53
     
     
      
2. Configure Domain Controller IP for AD Join Traffic
   Define the Domain server IP as a PA application with required TCP and UDP ports to support Active Directory communication.
   • Example. 10.213.139.69
   • Protocol. TCP and UDP
   • Ports. 88, 123, 135, 136, 137, 138, 139, 389, 443, 445, 464, 636, 1512, 3268, 3269, 5357, 49152-65535
     
     
      
3. Configure Domain Controller Access (FQDN)
   Define the domain controller hostname as the PA application to allow clients to communicate with the domain controller.
   • Example. pa-dc.domain.internal
   • Protocol. TCP and UDP
   • Ports. 88, 123, 135, 136, 137, 138, 139, 389, 443, 445, 464, 636, 1512, 3268, 3269, 5357, 49152-65535
     
     

Active Directory Port Definitions

Configuring Skyhigh Client Bypass Rules

Configure the Skyhigh Client to bypass specific private IP address ranges by completing the following steps:

1. Create the IP Range List:

   • Navigate to Skyhigh Client > List Catalog > IP Range.

   • Create a new list containing your required private IP ranges (for example, 172.16.0.0/16, 192.168.0.0/16, and 10.0.0.0/8).
     

2. Configure Client Bypass Settings:

   • Navigate to Skyhigh Client > Policy > Bypass.

   • Disable the following default options:

     • Bypass all local traffic

     • Bypass Windows Core-Generated Traffic
       

   • Configure the custom bypass rule using the IP range list created in Step 1.

3. Apply the Rule to the Network Section:

   • Go to the Network section.

   • Add the custom bypass rule to define the network-level exceptions, as shown in the screenshot below.
     

Configure Name Resolution Policy Table Rules

The Name Resolution Policy Table (NRPT) allows you to redirect traffic for a specific domain to a designated DNS or Domain Controller (DC) server on a Windows client. You can configure these rules locally using PowerShell or deploy them across an enterprise using Group Policy (GPO).

Method 1. Configure NRPT Rules Using PowerShell

1. Run PowerShell as an administrator.

2. Define the namespace and target nameserver by running the command.
   Add-DnsClientNrptRule -Namespace ".domain.internal" -NameServers "10.213.139.69" -DisplayName “Redirect *domain.internal to DC” 

3. Verify that the rule exists by running the below command.
   Get-DnsClientNrptPolicy -Effective 

4. Remove the rule, if it is no longer required, by running the below command.
   Get-DnsClientNrptRule | Remove-DnsClientNrptRule -ErrorAction SilentlyContinue -Force.

Method 2. Configure NRPT Rules Using Group Policy

1. Open the Group Policy Management Console by running gpmc.msc to begin the deployment process.

2. Create a new GPO or select an existing one that targets your client machines.

3. Click Computer Configuration > Policies > Windows Settings > Name Resolution Policy to access the NRPT settings.

4. Choose either FQDN for a specific host or Suffix for an entire domain from the namespace dropdown menu in the Create Rules section.

5. Enter the domain suffix, such as internal.example.com, into the text box.

6. Open the DNS Settings tab and select the Enable DNS settings in this rule checkbox.

7. Add the IP address of your DNS or Domain Controller server under the Generic DNS Server tab.

8. Click Create to add the rule to the Name Resolution Policy Table list.

9. Click Apply to save your changes.

10. Force a policy update on the client machines by executing gpupdate /force in a command prompt.

11. Verify the effective policy by running the Get-DnsClientNrptPolicy -Effective command on the client machine.