{"id":450,"date":"2009-07-21T21:19:40","date_gmt":"2009-07-21T21:19:40","guid":{"rendered":"http:\/\/refraction.co.uk\/blog\/?p=450"},"modified":"2009-07-21T21:22:14","modified_gmt":"2009-07-21T21:22:14","slug":"so-what-is-windows-7-directaccess","status":"publish","type":"post","link":"https:\/\/refraction.co.uk\/blog\/2009\/07\/21\/so-what-is-windows-7-directaccess\/","title":{"rendered":"So what is Windows 7 DirectAccess?"},"content":{"rendered":"

A couple of weeks ago I was fortunate to be offered a place on a two day class at Microsoft to learn about the DirectAccess functionality of Windows 7 and Server 2008 R2.\u00a0 The class was run by Fernando Cima<\/a> from MS in Brazil (who it has to be said really<\/em> knows his stuff).<\/p>\n

For many years now private company networks have been completely separate from the hostile environment of the Internet.\u00a0 This separation is achieved through the use of firewalls etc, and in many cases internal networks use private IP address ranges that can\u2019t be directly addressed from the internet.<\/p>\n

Whilst this separation provides a level of security, it does make life difficult for mobile workers, after all they\u2019re on the Internet wanting to gain access to the very resources company\u2019s want to protect.\u00a0 Many organisations use solutions like VPN\u2019s<\/a>, Citrix and application publishing (for example Outlook Web Access published through a reverse proxy<\/a>) to get around these limitations and make services available to remote workers.<\/p>\n

These solutions are definitely useful, but the user experience for mobile workers is often less than ideal.\u00a0 To maintain security they\u2019ll almost certainly have to logon to these remote services separately, probably using complex passwords or two-factor authentication<\/a> like RSA SecurID<\/a>.\u00a0 It\u2019s hardly seamless.\u00a0 Using a VPN probably also means that any traffic between the laptop and the Internet is routed though the VPN, into the company network, out of the company Internet connection and back again.\u00a0 Again, not exactly ideal (though split-tunnelling can help).<\/p>\n

What\u2019s more, supporting remote clients is often a support nightmare.\u00a0 Devices not on the network are hard to manage.\u00a0 Using a VPN they are only accessible if and when the user launches the VPN.\u00a0 Whether the connection is up and running long enough for patches to download etc. is often down to chance.\u00a0<\/p>\n

So all in all there\u2019s a lot of room for remote access solutions to be improved.\u00a0 This is where DirectAccess tries to help.\u00a0 It provides remote clients with seamless access to both the Internet and the internal network (intranet).\u00a0 If the remote client has internet access, it automatically has access the intranet and the services within it.\u00a0 No client software to launch, no additional authentication nothing.\u00a0 Sounds good eh?<\/p>\n

So how does it work\u2026 well the first thing to note is that DirectAccess isn\u2019t a fancy new product in its own right \u2013 it\u2019s really just a clever implementation of IPv6 and IPSec.\u00a0 There is however a DirectAccess server role, and a wizard to set the whole thing up.\u00a0<\/p>\n

At a high level it makes sure that both the client computer and the Intranet resources are globally addressable, and secures communication between them.\u00a0 Of course to do this there are a number of problems to overcome:<\/p>\n

Addressing<\/strong>
\nAs mentioned, internal networks often use private address ranges<\/a>, and even if they didn\u2019t there simply aren\u2019t enough IPv4<\/a> addresses available for companies to use globally unique addressing.\u00a0 <\/em><\/p>\n

Fortunately IPv6<\/a> is here to save the day\u2026 (this is the scary part).\u00a0 IPv6 provides globally unique addressing, allowing the client and intranet services to address each other.\u00a0 The techie among you are probably now thinking about how your networks are all IPv4 and that this is never going to work.\u00a0 <\/em><\/p>\n

From Windows Vista onwards, the IP stack in Windows has natively supported IPv6, and enables it by default.\u00a0 In fact, Windows now favours IPv6 and will use it to communicate with other Vista\/2008\/7 nodes if it can.\u00a0 So there\u2019s a fair chance that some of your computers have an IPv6 address already.\u00a0\u00a0 <\/em><\/p>\n

In many cases of course computers will be sitting on an existing IPv4 networks.\u00a0 IPv6 traffic would therefore need to traverse these older networks to be of any use.\u00a0 To achieve this IPv6 can be encapsulated<\/a> within IPv4 packets.\u00a0 Windows also now supports a number of protocols for achieving this natively, and will automatically encapsulate IPv6 should it determine that there is IPv4 connectivity between two IPv6 nodes (it can also be forced).\u00a0 On an Intranet the ISATAP<\/a> (Intra-Site Automatic Tunnel Addressing Protocol) is used to achieve this, and is enabled when DirectAccess is setup.\u00a0 Older IPv4 based resources (for example Window Server 2003 and earlier) can be accessed through the use of IP translation devices such as Network Address Translation-Protocol Translation (NAT-PT)<\/a>.<\/em><\/p>\n

The other area where IPv6 traversal over IPv4 networks has to be considered is over the internet, which is IPv4, and on the clients local network which is likely to be IPv4.\u00a0 DirectAccess clients will attempt to use traversal technologies to gain access to the DirectAccess server, in these cases either 6to4<\/a> or Teredo<\/a> depending on whether the client has a public internet address or is on a NAT\u2019ed<\/a> network.\u00a0 Again this is automatic and handled by the Windows IP stack.\u00a0 As a last resort, if 6to4 and Teredo traffic is blocked, a new protocol IP-HTTPS is used to encapsulate IPv6 packets inside HTTPS.<\/em><\/p>\n

So in short, you should be able to use IPv6 for DirectAccess with only minimal work to the underlying network.\u00a0 MS themselves are very clear that IPv6 is a long term goal, and have provided a heap of technologies in Windows to help deal with a long transition.<\/em><\/p>\n

Security<\/strong>
\nIf both your remote clients and your internal services are globally addressable, security is going to be a big concern.\u00a0 DirectAccess uses the IPSec features of IPv6 to authenticate the client connecting to the DirectAccess server, and protect the traffic that passes between them.<\/em>\u00a0<\/p>\n

Computer authentication certificates can be either issued from a central CA<\/a> in the domain to validate that the remote client is a company asset, or can be issued by the health authority within a Network Access Protection (NAP)<\/a> environment.\u00a0 In that case computers are validated as being \u2018healthy\u2019 before being granted access.<\/em><\/p>\n

Name Resolution<\/strong>
\nUsing DirectAccess clients effectively have access to both the Internet and the intranet.\u00a0 You therefore need to ensure that traffic intended for the intranet goes there, and not out to the Internet.\u00a0 Windows 7 does this using a Name Resolution Policy Table.\u00a0 This table contains entries for internal namespaces and corresponding internal DNS servers.\u00a0 When an application wants to access a resource, the resources name is compared to entries in the NRPT, if there\u2019s a match the internal DNS server is used to resolve the name, if not the Internet connections DNS server is used.\u00a0 In this way traffic is routed to the correct location.<\/em><\/p>\n

So at a high level that\u2019s how direct access works.\u00a0 There\u2019s a lot more to it than that, and I\u2019ll try to post more over the next few days.\u00a0 It\u2019s a pretty complex thing to deal with \u2013 my head hurt after the two day class having struggled to take it all in.\u00a0 I\u2019ve never done anything with IPv6, so that was a hell of a learning curve, but once to you go though is a few times is make a lot of sense.<\/p>\n

IPv6 is probably going to be Microsoft\u2019s biggest obstacle in gaining traction with DirectAccess, many people I\u2019ve spoken to about is run away when you point out that IPv6 is required.\u00a0 Having worked though the implementation in a few labs however it\u2019s not all that bad.\u00a0 Whilst there are things you would want to do before enabling IPv6, it\u2019s far less work than I though it would be \u2013 at least to get to a point where DirectAccess works.<\/p>\n

Do the benefits of DirectAccess make it worthwhile?\u00a0 Well it\u2019s certainly a great solution.\u00a0 Once it\u2019s working remote clients are on the internal network, so communication is bi-directional and remote clients can not only access internal resources, but can be accessed from those internal resources for management and support.\u00a0 Group policy applies as the computer starts up and users logon, patches apply and applications can be delivered.\u00a0 For organisations with large numbers of remote users that\u2019s are pretty compelling functionality.\u00a0<\/p>\n

Whilst IPv6 might be perceived as an obstacle for DirectAccess, DirectAccess is probably the first \u2018killer app\u2019 for IPv6.<\/p>\n","protected":false},"excerpt":{"rendered":"

A couple of weeks ago I was fortunate to be offered a place on a two day class at Microsoft to learn about the DirectAccess functionality of Windows 7 and Server 2008 R2. So what is Windows 7 DirectAccess?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,4],"tags":[304,305,13,83,306,179],"class_list":["post-450","post","type-post","status-publish","format-standard","hentry","category-tech","category-work","tag-directaccess","tag-ipv6","tag-microsoft","tag-mobile-working","tag-remote-access","tag-windows-7","entry"],"_links":{"self":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=450"}],"version-history":[{"count":1,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/450\/revisions"}],"predecessor-version":[{"id":451,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/posts\/450\/revisions\/451"}],"wp:attachment":[{"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/refraction.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}