Change the ISATAP record in the DNS server to include the new VIPs and DIPs: 10.0.0.18, 10.0.0.19, and 10.0.0.30.

Note:
Skip this step if you have IPv6 deployed on your internal network.

If you are using an ISATAP interface on the Forefront UAG DirectAccess server (as described in scenarios 3 and 6, in Assigning IP addresses to the server interfaces), make sure that you have already installed the Windows NLB Hotfix (KB977342) (http://go.microsoft.com/fwlink/?LinkId=178582) on all Forefront UAG DirectAccess array members.

Change the current IP addresses on the Forefront UAG DirectAccess single server to DIPs, as follows:

1. Current IPv4 address: 192.0.2.30 TO new DIP address: 192.0.2.18.
   
   
2. Remove the 192.0.2.31 IPv4 address.
   
   
3. Current IPv4 address: 10.0.0.30 TO new DIP address: 10.0.0.18.
   
   
4. Current IPv6 address: 2001:db8::30 TO new DIP address: 2001:db8::18 (to be configured when IPv6 is deployed on your internal network).
   
   

Open the Forefront UAG Management console. Before the Forefront UAG Management console opens, a message appears informing you that the previous IP address configured on the internal-facing adapter has been removed and a new IP address has been identified. To use the new IP address, click Yes. When a successfully updated message appears, click OK. The Forefront UAG Management console opens.

Make sure that the Internet-facing and internal network facing DIPs on the standalone Forefront UAG DirectAccess server are configured.

In the Forefront UAG Management console, on the Admin menu, click Network Interfaces to start the Network Configuration Wizard.

Configure the network settings, as follows:

1. From the Define Network Adapters screen, specify to which networks the network adapters are connected by assigning them to the Internal and External networks.
   
   
2. From the Define Internal Network IP Address Range screen, if required, configure the internal network IP address range, and complete the Network configuration Wizard.
   
   

On the Admin menu, click Array Management to start the Array Management Wizard.

Define your server topology, as follows:

1. From the Configure Array settings screen, click Set this server as the array manager.
   
   
2. From the Specify Array Credentials screen, enter the credentials required to access the array manager.
   
   
3. From the Defining Managed Server Computers screen, add the Forefront UAG servers that will be configured as array members, and complete the wizard.
   
   

   Note:
   Managed server computers are identified by their internal facing IPv4 DIP. You should enter the internal facing IPv4 DIP for each server that will be a member of the array. If you add another server to the array, you must add it to the list of managed server computers.

Close the Forefront UAG Management console on the array manager. Click Yes to save the changes before exiting.

Configure DIPs on the new node that is joining the array (if not previously configured). These include an internal network facing static IPv4 address (DIP)—10.0.0.19, and 2001:db8::19 (if you have IPv6 deployed on the internal network).

Note:

Make sure that you have added the server to the managed server computers list on the array manager. Make sure that the certificate that is used for IP-HTTPS authentication has been imported to the computer personal store on the new node. If you are using an ISATAP interface on the Forefront UAG DirectAccess server, (as described in scenarios 3 and 6, in Assigning IP addresses to the server interfaces in SP1), make sure that you install the Windows NLB Hotfix (KB977342) (http://go.microsoft.com/fwlink/?LinkId=178582) on all Forefront UAG DirectAccess server array members.

Install Forefront UAG on the new node. The Getting Started Wizard starts. For more information, see Running the Getting Started Wizard.

Configure the network settings, as follows:

1. From the Define Network Adapters screen, specify to which networks the network adapters are connected by assigning them to the Internal and External networks.
   
   
2. From the Define Internal Network IP Address Range screen, configure the internal network IP address range if it is required, and complete the Network configuration Wizard.
   
   

Define your server topology, as follows:

1. From the Select Configuration screen, click Array member, click Next two times, and then from the Configure Array Settings screen, click Add this server to an array.
   
   
2. From the Select Server screen, enter the IP address or FQDN of the array manager, and the credentials required to access the array manager.
   
   

   Note:
   The credentials must be those of a user who belongs to a Forefront UAG group that has the correct permissions to add array members.

3. Complete the wizard, make sure that the server successfully joined the array, and exit the Forefront UAG Management console (this is the default option).
   
   

   Note:
   After the Forefront UAG array is created, you must perform all Forefront UAG Management console configuration from the array manager.

On the array manager, open the Forefront UAG Management console, click the Admin menu, and then click Network Load Balancing.

Warning:
If the Forefront UAG Management console was open when the new node was joined to the array, restart the Forefront UAG Management console.

Configure the following VIPs:

Note:
Forefront UAG DirectAccess supports NLB only in Unicast mode; multicast modes are not supported.

• An Internet-facing IPv4 VIP—192.0.2.30.
  
  
• An Internet-facing IPv4 VIP—192.0.2.31.
  
  
• An internal network facing IPv4 VIP—10.0.0.30.
  
  
• An internal network facing IPv6 VIP—2001:db8::30 (to be configured when IPv6 is deployed on your internal network).
  
  

On the array manager, open the Forefront UAG Management console, and then click DirectAccess to start the Forefront UAG DirectAccess Configuration Wizard.

From the Forefront UAG DirectAccess Configuration Wizard, in the DirectAccess Server box, click Edit, click Windows Network Load Balancing, and then click Next.

On the Connectivity page, make the following changes:

1. Assign a new First Internet-facing IPv4 address. The new IP address should be the address of the first address of the sequential Internet-facing IPv4 VIPs configured in NLB (192.0.2.30).
   
   
2. If IPv6 is not deployed on your internal network, assign a new Internal IPv4 address. The new IPv4 address should be the internal network facing IPv4 VIP address configured in NLB: 10.0.0.30. If IPv6 is deployed on the internal network, assign an Internal IPv6 interface: 2001:db8::30.
   
   

In the left panel, click Server Groups, and then click Finish.

On the taskbar, click Start, point to Administrative Tools, click Group Policy Management, open the Domain tree, click the domain in which Forefront UAG DirectAccess is deployed, and then click the UAG DirectAccess: Gateways object. In Security Filtering, Add the computer name of the new node, click OK, and then exit the Group Policy Management.

Note:
Alternatively, you can click Generate Policies from the Forefront UAG DirectAccess Configuration Wizard, and reapply them. For more information, see Applying or exporting the Forefront UAG DirectAccess configuration in SP1.

On the new node, from the Windows command prompt, run the command: gpupdate /force.

Note:

Before starting NLB on the new node, confirm that the IPsec configuration of the Forefront UAG DirectAccess server is in effect, as follows: On the taskbar, click Start, point to Administrative Tools, and then click Windows Firewall with Advanced Security. On the console, click Connection Security Rules. Forefront UAG DirectAccess rules should appear in the list of Connection Security Rules and show Yes in the Enabled column.

From the Forefront UAG Management console, click the Activate configuration icon, and then on the Activate Configuration dialog box, click Activate.

Important:
If you receive the error message "The UAG DirectAccess configuration cannot be activated. The selected internal IPv6 address cannot be found on this server", repeat the Activation step.

Wait for all of the array members to synchronize. You can confirm synchronization, as follows:

1. On the taskbar, click Start, click All Programs, click Microsoft Forefront UAG, and then click Forefront UAG Activation Monitor.
   
   
2. On the console, in the left pane, click each array member and confirm in the right pane, that the UAG DirectAccess configuration was activated successfully message appears for each array member.
   
   

On the array manager, open the Forefront UAG Management console, then, on the Admin menu, click Web Monitor.

In the left pane, under Array Monitor node, click Current Status.

In the Array Monitor – Current Status pane, select the nodes that will be part of the array, and then in the Action list, select Start, and then click Apply. When completed successfully, the Array Status for the node should be synched and converged. For more information, see Managing load balanced array members.

If you are using an ISATAP interface on the Forefront UAG DirectAccess server, (as described in scenarios 3 and 6, in Assigning IP addresses to the server interfaces), make sure that you install the Windows NLB Hotfix (KB977342) (http://go.microsoft.com/fwlink/?LinkId=178582) on all Forefront UAG DirectAccess array members.

Configure DIP addresses on the new node that is joining the array (if not previously configured). These include an Internet-facing static IPv4 DIP address, an internal network facing static IPv4 DIP address, and an internal network facing static IPv6 DIP address (to be configured when IPv6 is deployed on your internal network).

Note:

Add the DIP address of the new node to the ISATAP record on the DNS server, if not previously added. Make sure that you have added the server to the managed server computers list on the array manager (see step 4c in Changing the single server to an array manager). Make sure that the certificate that is used for IP-HTTPS authentication has been imported to the computer personal store on the new node.

Install Forefront UAG on the new node. The Getting Started Wizard starts. For more information, see Running the Getting Started Wizard.

Configure the network settings, as follows:

1. From the Define Network Adapters screen, specify to which networks the network adapters are connected by assigning them to the Internal and External networks.
   
   
2. From the Define Internal Network IP Address Range screen, configure the internal network IP address range if it is required, and complete the Network configuration Wizard.
   
   

Define your server topology, as follows:

1. From the Select Configuration screen, click Array member, click Next two times, and then from the Configure Array Settings screen, click Add this server to an array.
   
   
2. From Select Server screen, enter the IP address or FQDN of the array manager, and the credentials required to access the array manager.
   
   

   Note:
   The credentials must be those of a user who belongs to a Forefront UAG group that has the correct permissions to add an array member.

3. Complete the wizard, make sure that the server successfully joined the array, and exit the Forefront UAG Management console (this is the default option).
   
   

On the array manager:

Warning:
If the Forefront UAG Management console was open when the new node was joined to the array, restart the Forefront UAG Management console.

1. From the Forefront UAG Management console, click the Activate configuration icon, and then on the Activate Configuration dialog box, click Activate.
   
   
2. Wait for all the array members to synchronize. You can confirm synchronization, as follows:
   
   
   1. On the taskbar, click Start, click All Programs, click Microsoft Forefront UAG, and then click Forefront UAG Activation Monitor.
      
      
   2. On the console, in the left pane, click each array member and confirm in the right pane, that the UAG DirectAccess configuration was activated successfully message appears for each array member.
      
      

On the taskbar, click Start, point to Administrative Tools, click Group Policy Management, open the Domain tree, and then click the UAG DirectAccess server object. In Security Filtering, Add the computer name of the new node, click OK, and then exit the Group Policy Management.

Note:
Alternatively, you can click Generate Policies from the Forefront UAG DirectAccess Configuration Wizard, and reapply them.

On the new array member, from the Windows command prompt, run the command: gpupdate /force.

On the array manager, open the Forefront UAG Management console:

1. On the Admin menu, click Web Monitor.
   
   
2. In the left pane, under Array Monitor, click Current Status.
   
   
3. In the Array Monitor – Current Status pane, select the new node that will be part of the array, and then in the Action list, select Start, and then click Apply. When completed successfully, the Array Status for the nodes should be synched and converged. For more information, see Managing load balanced array members.