Condividi tramite

Questions and Answers for Planning a Small Business DirectAccess Deployment

  • Articolo

imageWhile I spend most (all) of my time working with the UAG DirectAccess solution, UAG DirectAccess is functionality essentially represents a superset of Windows DirectAccess functionality. Therefore, I thought it might be interesting to share with you all some questions I received from a fellow who is interested in deploying Windows DirectAccess. Maybe the questions and answers contained here will help you with your own planning for deploying DirectAccess in your SMB environment.

==============================

Question/issue 1:
I’m in the process of putting together a DirectAccess solution for a small client of mine that needs the features of DirectAccess but can’t lay down the cash for multiple physical servers or UAG.  They don’t need the additional complexities of access to IPv4 only resources as this is basically going to be a new network starting from scratch.

I know this may not be ideal from a performance perspective because of the many shared roles and limited scalability, but this is not going to be a network with many users; rather it will be a network of a dozen or so kiosks that will always be remotely connected.  I’m starting to experiment some but haven’t found many resources for the absolute simplest implementation of DirectAccess.

I will certainly be going through the test lab documentation and other papers from Microsoft regarding the set up, but I thought I’d ask just in case anyone knows of some resources I haven't found yet (or just has some good tidbits of info themselves).

My concept is this:

  1. A single physical server running Win2008 R2 as the domain controller (also DNS server, DHCP server, CA, NL server, File Server)
  2. A virtual server within that physical server running Win2008 R2 as the DirectAccess server
  3. The server will have the appropriate dedicated physical NICs (one internal facing for the domain controller, one internal facing for the DirectAccess server, one external facing for the DirectAccess server)
  4. A firewall appliance will sit in between the external NIC of the DirectAccess server and the internet connection to provide basic protection (not NAT, just firewall)
  5. The remote kiosk clients will, of course, be running Win7 Enterprise

What I’d ultimately really love is a "test lab" document similar to the one  already out there from Microsoft but designed to interface with the real internet instead of a fake internet.  The document makes several references to "problems" trying to adapt that test environment into a real world scenario, but it doesn’t give a whole lot of information about what "problems" they are referring to.

ANSWER: First off, these are great questions and thanks for sending them my way. Examples of planning for real-world deployments help everyone on their trek to DirectAccess goodness.

Since your customer can’t afford UAG at this time (maybe he will in the future as the company grows), the place to start is with the Windows DirectAccess solution. You are right that you will not have support for IPv4-only resources on the intranet, and your high availability options are somewhat limited. But you recognize these conditions and we can work within these parameters.

We generally recommend that you don’t put the Network Location Server on the domain controller, especially in pure IPv6 scenarios for some reasons regarding interface timings. While I don’t have the details in front of me, I have received information from a DirectAccess PM who strongly recommends that the Network Location Server not be placed on a DC – so if you could create a VM for the NLS, that would be a good way to go.

You can put the DirectAccess server in a virtual machine. However, there are performance implications and therefore we generally recommend that you put the DirectAccess servers on physical machines. With that said, you mention that this is going to be a relatively lightly used configuration, and therefore you might be able to get acceptable performance. You’ll need to monitoring your deployment and see if you are running into processor bottlenecks.

It is good that you’re planning on dedicated NICs for the virtual and physical interfaces. DirectAccess will perform better this way.

It’s also good you recognize that the firewall in front of the DirectAccess server will perform only firewall functionality and not NAT, because DirectAccess is not supported from behind a NAT device (although it can be done with the help of a few routing tricks, but that configuration is not supported by the product group).

Windows 7 Enterprise or Ultimate is required – so you’re good with the OS on your clients. Keep in mind that these must be domain members.

Regarding the problems that we suggest with the Test Lab Guides here are a few things that I can think of:

  • In the UAG TLGs, we configure a certificate template that disables CRL checking. You don’t want to do this in a production environment
  • In the Windows DirectAccess TLG, I believe Joe configure the DirectAccess server to host the CRL. You wouldn’t do this in a production environment
  • The IP addressing scheme we use in the TLGs for the public is based on network IDs that Microsoft owns, so you can’t use those
  • I think we didn’t configure the DHCP server to assign a default gateway, you want to do that in a production environment
  • The certificate bound to the IP-HTTPS listener is a private certificate in the TLGs. While you can use a private certificate (one that you generate from your own CA), most organizations are going to use commercial certificates. If you don’t use a commercial certificate, you’ll need to find a way to securely publish your CRL

With those things in mind, you can create a “live” pilot deployment. I’d recommend that you obtain a commercial certificate for the IP-HTTPS listener, and not use the CRL checking disablement steps I deployed in the UAG DirectAccess Test Lab Guides.

-----------------------------------------

Question 2:
What are the advantages/disadvantages of using a native IPv6 infrastructure (with a tunnel broker like Hurricane Electric) vs just using ISATAP?  Are there any compelling reasons to go ahead and go native (especially if the network is going to be new with no legacy devices)?

ANSWER:

ISATAP is useful if your network infrastructure isn’t IPv6 aware, since you can tunnel your IPv6 traffic over IPv4 and use your current IPv4 routing infrastructure. However, if your routing, DNS and DHCP infrastructure is all IPv6 capable, there’s no need to deploy ISATAP and I’d recommend that you go native IPv6. You will need to configure your routers (and maybe the hosts) on your network so that they know the route back to the DirectAccess clients.

In most cases that will require that you make the DirectAccess server the IPv6 route of last resort since this is the only way to get the messages back to the 6to4 DirectAccess clients – or better, you can disable 6to4 on your DirectAccess clients and they will use Teredo instead – then your routing tables will be a bit “cleaner” and you want need to make the DirectAccess server the IPv6 route of last resort.

-----------------------------------------

Question 3:
What are the security implications with opening up inbound IPv6 traffic into your network?  Since DirectAccess requires Protocol 41 traffic to be let through the firewall directly to the external NIC on the DirectAccess server, doesn't this open up some potential security issues without an IPv6 firewall in place?  Maybe I am missing something, but since Protocol 41 is encapsulating ALL IPv6 traffic in IPv4 packets isn't letting Protocol 41 traffic through essentially the same thing as having a computer directly connected to the IPv6 internet with no firewall at all?

ANSWER:

IP Protocol 41 is used to indicate that there is direct encapsulation of IPv6 packets within an IPv4 header to support 6to4. So, we’re not really allowing all IPv6 traffic through the firewall, just 6to4 traffic. Also, keep in mind that both of infrastructure tunnel and the intranet tunnel require authentication – for the infrastructure tunnel, both computer certificate and NTLMv2 authentication is required, and for the intranet tunnel, both computer certificate and Kerberos v5 authentication is required.

While all IPv6 traffic is allowed through the IPv4 tunnel – traffic to the DirectAccess server is allowed only after the client authenticates and establishes a valid IPv6 IPsec connection . We also have some Denial of Service Protection technology built into to take care of malicious users who try to take advantage of this situation, though. However, if you don’t think this is enough – you can take my earlier recommendation and disable 6to4 on the DirectAccess clients and let them use only Teredo or IP-HTTPS. Keep in mind that this is the same situation – the Teredo and IP-HTTPS clients are also encapsulating all IPv6 traffic. But the same protections still apply regarding IPsec and DoSP.

==============================

I hope you find these answers helpful and would be happy to carry on the conversation in the comments section.

Thanks!

Tom

Tom Shinder
tomsh@microsoft.com
Principal Knowledge Engineer, Microsoft DAIP iX/Forefront iX
UAG Direct Access/Anywhere Access Group (AAG)
The “Edge Man” blog (DA all the time): https://blogs.technet.com/tomshinder/default.aspx
Follow me on Twitter: https://twitter.com/tshinder
Facebook: https://www.facebook.com/tshinder

Visit the TechNet forums to discuss all your UAG DirectAccess issues https://social.technet.microsoft.com/Forums/en-US/forefrontedgeiag/threads Stay up-to-date with “just in time” UAG DirectAccess information on the TechNet wiki https://social.technet.microsoft.com/wiki/tags/DirectAccess/default.aspx

Comments

  • Anonymous
    January 01, 2003
    @Davison - I'm very tempted to put together a blog post on this and just put a big UNSUPPORTED on it - so that people can at least play around with the solution. I'll put together a Visio diagram of this and send it to you. Mind you, we haven't tested this, but theoretically it should work. Tom

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    Hi Davison, Good questions! I'll do a blog post tomorrow on these subjects as I think many people are interested in the same issues. Thanks! Tom

  • Anonymous
    January 01, 2003
    The comment has been removed

  • Anonymous
    January 01, 2003
    @Shannon - Oh! OK, it makes sense. What the real goal is to assign another IP address that is used only by the NLS web site and not used by the DC for any other functions. Good idea and should get around the IPv6 issues. Thanks! Tom

  • Anonymous
    January 04, 2011
    The comment has been removed

  • Anonymous
    January 04, 2011
    Hi Shannon, Are you thinking of making the NLS a virtual machine on the host operating system (which is the DC)? If so, that would work fine. Also, I don't see a strong need to dedicate a NIC to the NLS VM - you can create an External Virtual Network (Hyper-V terminology) that is bound to the same NIC used for the DC's internal interface. Thanks! Tom

  • Anonymous
    January 05, 2011
    The comment has been removed

  • Anonymous
    January 06, 2011
    The comment has been removed

  • Anonymous
    January 22, 2011
    Hi Tom, can you clarify a couple points related to Certificate Authorities and CRLs?  I plan on getting a commercial certificate for the IP-HTTPS listener as you recommended, but how does that affect all of the other certificate related configurations in the test lab guide?  The CA created on the domain server is completely separate from this commercial certificate, right? And you mentioned that you wouldn't want to host the CRL on the DirectAccess server in a production environment.  Is this only because of performance reasons or because of something else?  And is this CRL not related to the IP-HTTPS listener?  So, just to make sure I'm getting it, there is one CA and a corresponding CRL for the active directory domain, and then another CA/CRL (in this case commercial) for the DirectAccess connections.  Is that right? Thanks!