So how do you create a firewall exception for DirectAccess client without just opening up service to the entire world? First, we need to determine the scope of the IPv6 / ISATAP network that will be sending traffic to your DirectAccess clients, and then we can create the exceptions and limit the source to that scope.

You cannot (and should not) simply disable the firewall profile on the DA client, not only because it's unsecure, but because the firewall service is used to establish the IPsec tunnels that DirectAccess uses to talk to the Corpnet. If you want to send traffic to the DA client, then you need to create a firewall exception to allow it in. The second reason is because the DirectAccess clients have their Windows Firewall enabled and will block unsolicited traffic. But that's outside the scope of this article. ISATAP enabled clients will then be able to talk IPv6 through the ISATAP router on Remote Access server and reach the DirectAccess clients. This can be a challenge if you are not already using Native IPv6 on the Corpnet, but you can pretty easily accomplish this by using the Remote Access server as an ISATAP router which will establish a sort of link-local IPv6 network on top of your existing IPv4 network. This means if you want to be the first one to start communications with a DA client, then you too must be able to talk IPv6. In most cases the Remote Access / DirectAccess server is then using NAT64 to translate that IPv6 traffic so it can talk to an IPv4 Corpnet, but it does not work the other way IPv4 traffic from the Corpnet cannot be translated into IPv6 to reach the DirectAccess client. Why is that? First, remember that the DirectAccess clients are connecting to the Corpnet using IPv6 addresses. However, many people find that they are unable to use the SCCM Remote Control (or 'Remote Tools' or 'Remote Assistance') to connect to DirectAccess computers. Because everything is done on a 'pull' basis, meaning the client computer pulls updates from the corpnet, things 'just work' as normal. Managing DirectAccess computers with SCCM is a great way to keep your mobile workforce up to date and in compliance with the corporation.

Windows firewall remote management