{"id":1047,"date":"2012-01-16T22:35:02","date_gmt":"2012-01-16T22:35:02","guid":{"rendered":"http:\/\/refraction.co.uk\/blog\/?p=1047"},"modified":"2012-01-16T22:40:15","modified_gmt":"2012-01-16T22:40:15","slug":"directaccess-and-ocs-lync-edge-services","status":"publish","type":"post","link":"https:\/\/refraction.co.uk\/blog\/2012\/01\/16\/directaccess-and-ocs-lync-edge-services\/","title":{"rendered":"DirectAccess and OCS \/ Lync Edge Services"},"content":{"rendered":"

It\u2019s been a while since I posted anything about DirectAccess<\/a>, and while this isn\u2019t new info I thought it was worth sharing.<\/p>\n

DirectAccess (DA) is a remote access technology included in Windows 7 and Server 2008 R2.\u00a0 Unlike traditional VPN solutions it establishes a connection into a private network automatically, and transparently.\u00a0 From the end users perspective once a connection to the internet is made, they can access both websites and any internal resources such as email or file shares.<\/p>\n

It\u2019s not all easy going however, as DirectAccess uses IPv6 there are some services which just don\u2019t work well over a DirectAccess tunnel, for example Office Communications Server or Lync.\u00a0 There are also services such as Outlook Web Access which are typically published to the internet anyway so are better accessed directly.<\/p>\n

As DirectAccess gives the remote client access to both the internet directly, and internal services through the DA tunnel, its perfectly possible to access external and internal resources.\u00a0 To configure this you can specify whether a given DNS name is resolved via the DNS server allocated from the ISP or via the DNS servers on the internal network. This is achieved using the Name Resolution Policy Table (NRPT) which is used to define which namespaces (domains) or DNS records should be resolved where.<\/p>\n

Generally this is pretty easy, you use the table to direct your internal namespace down the DA tunnel.\u00a0 Where you encounter exceptions such as OCS or Lync which may use the internal namespace but should be accessed externally, you can add specific DNS names to the NRPT as exceptions to the NRPT.<\/p>\n

\"DirectAccess<\/a><\/p>\n

So for example, you may have an internal namespace of mycompany.com with OCS installed.\u00a0 You\u2019ll probably have a \u2018myname@mycompany.com\u2019 SIP address, and OCS will usually be accessed via the name sip.mycompany.com both internally and externally.\u00a0 If you add DirectAccess you would configure the NRPT to resolve *.mycompany.com addresses via the internal DNS \u2013 and therefore access them on the internal namespace over DA \u2013 but with exceptions (see below) to ensure that the OCS DNS records are resolved externally and therefore via the internet.<\/p>\n

You configure an NRPT exception by adding the relevant fully qualified DNS record, but without an associated DirectAccess DNS server address.\u00a0 Without the server address the client will use the local ISP assigned DNS server to resolve the address.<\/p>\n

As an example, for OCS you\u2019d need to configure exceptions for the following:<\/p>\n

Service records (SRV) for auto-config<\/em><\/p>\n

_sip._tls.mycompany.com<\/em><\/em><\/p>\n

_sip._tcp.mycompany.com<\/em><\/em><\/p>\n

_sipinternaltls._tcp.mycompany.com<\/em><\/em><\/p>\n

_sipinternal._tcp.mycompany.com<\/em><\/em><\/p>\n

<\/em><\/em><\/strong><\/p>\n

<\/em><\/strong><\/p>\n

Servers<\/p>\n

<\/strong> sip.mycompany.com<\/em><\/em><\/p>\n

sipinternal.mycompany.com<\/em><\/em><\/p>\n

sipexternal.mycompany.com<\/em><\/em><\/p>\n

<Your Access Edge>.mycompany.com<\/em><\/p>\n

<Your Web Conferencing Edge>.mycompany.com<\/em><\/p>\n

<Your AV Edge>.mycompany.com<\/em><\/p>\n

For more info on how the NRPT works, the MS Cable Guys did a pretty good write up here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Windows 7 DirectAccess is a great remote working technology, but services such as OCS and Lync are best accessed outside of the DA tunnel. This is configured using the NRPT to set exceptions and direct traffic to external Edge servers.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[304,448,495,97,494,306,122,179],"class_list":["post-1047","post","type-post","status-publish","format-standard","hentry","category-tech","tag-directaccess","tag-lync","tag-nrpt","tag-ocs","tag-owa","tag-remote-access","tag-remote-working","tag-windows-7","entry"],"_links":{"self":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/1047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=1047"}],"version-history":[{"count":1,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/1047\/revisions"}],"predecessor-version":[{"id":1048,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/1047\/revisions\/1048"}],"wp:attachment":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=1047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=1047"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=1047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}