DirectAccess

DirectAccess enables remote users to securely access shared resources, Web sites, and applications on an internal network without connecting to a virtual private network (VPN). DirectAccess establishes bi-directional connectivity with an internal network every time a DirectAccess-enabled computer is connected to the Internet.

  • DirectAccess Overview

  • Understanding DirectAccess Components

  • Understanding DirectAccess Deployment Models

  • Checklist: Before You Configure DirectAccess

  • Checklist: Install and Configure Single-Server DirectAccess

  • Configuring DirectAccess

  • Use the DirectAccess Snap-in to Monitor DirectAccess

  • Troubleshooting DirectAccess

  • Resources for DirectAccess


DirectAccess Overview

DirectAccess allows remote users to securely access internal network file shares, Web sites, and applications without connecting to a virtual private network (VPN). An internal network is also known as a private network or intranet. DirectAccess establishes bi-directional connectivity with an internal network every time a DirectAccess-enabled computer connects to the Internet, even before the user logs on. Users never have to think about connecting to the internal network and IT administrators can manage remote computers outside the office, even when the computers are not connected to the VPN.

You can use the DirectAccess Management Console to set up a DirectAccess infrastructure by performing the following tasks:

  • Specify the client computers that can use DirectAccess by selecting the security groups to which they belong

  • Configure the network adapters on the DirectAccess server that are connected to your internal network and the Internet and the certificates that you want to use for authentication

  • Configure the location of an internal Web site so that DirectAccess client computers can determine when they are located on the internal network

  • Configure the Domain Name Service (DNS) names that must be resolved by internal network DNS servers

  • Identify infrastructure servers (network location, DNS, and management servers)

  • Identify application servers for optional authentication

When you monitor DirectAccess, use the DirectAccess Management Console to determine the state of DirectAccess components that are running on the server.

Additional references

Understanding DirectAccess Components

Understanding DirectAccess Deployment Models

For more information, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkID=142598).


Understanding DirectAccess Components

This topic provides information about the components of a DirectAccess deployment, DirectAccess client connectivity methods, firewall configuration for DirectAccess traffic, and integration with smart cards.

DirectAccess components

A DirectAccess deployment consists of the following components:

  • DirectAccess clients

  • At least one DirectAccess server

  • An Active Directory® Domain Services (AD DS) domain

  • A public key infrastructure (PKI)

  • Network location server

  • An Internet Protocol version 6 (IPv6)-capable internal network and applications or Network Address Translation-Port Translation (NAT-PT) devices

DirectAccess clients

A DirectAccess client is a computer running Windows 7 or Windows Server 2008 R2 that is joined to an AD DS domain and uses IPv6 and Internet Protocol security (IPsec) to automatically initiate and maintain remote connectivity to an internal network from the Internet.

Computers that are not joined to an AD DS domain or computers running Windows Vista or earlier versions of Windows do not support DirectAccess.

At least one DirectAccess server

A DirectAccess server is a computer running Windows Server 2008 R2 that is joined to an AD DS domain and uses IPv6 and IPsec to respond to DirectAccess clients on the Internet and transparently connect them to an internal network.

Computers that are not joined to an Active Directory domain or computers running Windows Server 2008 or earlier versions of Windows Server do not support DirectAccess server functionality.

To install DirectAccess, see Install DirectAccess.

Do not host any other primary functions on DirectAccess servers. DirectAccess servers should be dedicated to DirectAccess. Depending on your deployment and scalability requirements, you might need more than one DirectAccess server or to use manual configuration to separate DirectAccess functions between multiple servers. For more information about multiple-server deployments, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).

For more information about the requirements of the DirectAccess server, see Checklist: Before You Configure DirectAccess.

An AD DS domain

DirectAccess relies on AD DS for authentication credentials, autoenrollment of computer certificates, and centralized Group Policy-based configuration of IPsec, IPv6, and other settings. DirectAccess clients and servers must be members of an AD DS domain.

PKI

DirectAccess relies on computer certificates issued by an Active Directory Certificate Services (AD CS) certification authority for authentication of IPsec sessions and IP-HTTPS-based connections.

Network location server

A network location server is an internal network server that hosts an HTTPS-based uniform resource locator (URL). DirectAccess clients access the URL to determine whether they are located on the internal network. The DirectAccess server can be the network location server but a high-availability Web server is recommended. The Web server does not have to be dedicated as a network location server.

IPv6-capable internal network and applications or a NAT-PT device

DirectAccess clients exclusively use IPv6 to access internal network resources. Therefore, DirectAccess clients can only communicate with internal network servers and resources that are reachable by using IPv6. There are three ways to achieve IPv6 connectivity to an internal network:

  • Configure your internal network routing infrastructure to support native IPv6. Internal network servers and applications that support IPv6 are then reachable. Computers running Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008 are configured to use IPv6 by default.

  • Deploy the Intra-Site Automatic Tunnel Addressing Protocol (ISATAP) on your internal network. By using ISATAP, IPv6-capable internal network servers and applications can tunnel IPv6 traffic over your IPv4-only internal network. Computers running Windows 7, Windows Server 2008 R2, Windows Vista, or Windows Server 2008 support ISATAP host functionality. ISATAP allows these computers to use IPv6 without requiring native IPv6 routing. The DirectAccess server will automatically configure itself as an ISATAP router in the absence of IPv6 connectivity on your internal network.

  • Use a Network Address Translation-Protocol Translation (NAT-PT) device to translate traffic between your DirectAccess clients that are using IPv6 and servers and applications that can only use IPv4. Windows Server 2008 R2 does not provide NAT-PT functionality. NAT-PT devices are typically available from Layer 2 and Layer 3 switch and router vendors. See your switch and router documentation for information about NAT-PT capabilities and configuration.

DirectAccess client connectivity methods

The following table lists possible DirectAccess client configurations and their corresponding method of sending IPv6 traffic to the DirectAccess server.

Client configuration | Preferred connectivity method
Assigned a global IPv6 address | Global IPv6 address
Assigned a public IPv4 address (addresses that are not in the ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) | 6to4, an IPv6 transition technology that provides IPv6 connectivity across the IPv4 Internet for hosts or sites that have a public IPv4 address.
Assigned a private IPv4 address (addresses that are in the ranges 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16) | Teredo, an IPv6 transition technology that provides IPv6 connectivity across the IPv4 Internet for hosts that are assigned a private IPv4 address and are located behind an IPv4 network address translation (NAT) device that does not support 6to4 router functionality.
The client cannot connect using 6to4 or Teredo | IP-HTTPS, a new protocol for Windows 7 and Windows Server 2008 R2 that allows hosts behind a Web proxy server or firewall to establish connectivity by tunneling IPv6 packets inside an IPv4-based secure Hypertext Transfer Protocol (HTTPS) session. IP-HTTPS is typically used only if the client cannot connect to the DirectAccess server by using the other IPv6 connectivity methods.

Firewall configuration for DirectAccess traffic

External firewalls between the Internet and your perimeter network must be able to pass the following types of traffic to and from the DirectAccess server:

  • For native IPv6 traffic, Internet Control Message Protocol for IPv6 (ICMPv6) traffic (IPv6 protocol 58) and IPsec Encapsulating Security Payload (ESP) traffic (IPv6 protocol 50).

  • For 6to4 traffic, IPv4 traffic that encapsulates IPv6 traffic (IPv4 protocol 41).

  • For Teredo traffic, IPv4 traffic with the User Datagram Protocol (UDP) port 3544.

  • For IP-HTTPS traffic, IPv4 traffic with the Transmission Control Protocol (TCP) port 443.

For example, the exceptions on your external firewall’s Internet interface will be in the following format:

  • Input filter: [Any] allowed inbound to [IPv4 address of Internet-facing adapter on DirectAccess server] for [IPv4 or IPv6] with [IPv4/IPv6 protocol number or UDP/TCP port]
  • Output filter: [IPv4 address of Internet-facing adapter on DirectAccess server] for [IPv4 or IPv6] with [IPv4/IPv6 protocol number or UDP/TCP port] allowed outbound to [Any]

Internal firewalls between the perimeter network and the internal network must be able to pass the following types of traffic to and from the DirectAccess server:

  • For native IPv6 traffic, all types of IPv6 traffic.

  • For ISATAP traffic, IPv4 traffic that encapsulates IPv6 traffic (IPv4 protocol 41).

  • For IPv4 and NAT-PT traffic, all TCP, UDP, and UDP 500 Internet Key Exchange (IKE)/AuthIP traffic.

To allow Teredo-based connectivity, you must configure and deploy the following additional Windows Firewall with Advanced Security rules for all of the domain member computers in your organization:

  • Inbound ICMPv6 Echo Request messages (required)

  • Outbound ICMPv6 Echo Request messages (recommended)

Do not use the predefined File and Printer Sharing (Echo Request – ICMPv6-In) inbound rule or the File and Printer Sharing (Echo Request – ICMPv6-Out) outbound rule for this purpose. If you use these predefined rules, they can be disabled by turning off file and printer sharing within an organization, which will result in a lack of Teredo-based connectivity.

The easiest way to deploy these Windows Firewall settings to all of the member computers in your organization is through the Default Domain Group Policy object (GPO). For more information, see Checklist: Implementing a Basic Firewall Policy Design (http://go.microsoft.com/fwlink/?LinkId=147688).

Rule 1: Inbound ICMPv6 Echo Request messages

Create and enable a custom inbound rule with the following settings:

  • All programs

  • ICMPv6 protocol type with the Echo Request message

  • Any local and remote IP addresses

  • Allow action

  • All profiles (domain, work, public)

This rule is required.

Rule 2: Outbound ICMPv6 Echo Request messages

Create and enable a custom outbound rule with the following settings:

  • All programs

  • ICMPv6 protocol type with the Echo Request message

  • Any local and remote IP addresses

  • Allow action

  • All profiles (domain, work, public)

This rule is recommended as a best practice unless you are using Windows Firewall to block all outbound traffic, in which case this rule is required.

Integration with smart cards

You can require the use of smart cards when DirectAccess clients make a connection to the DirectAccess server. Users can log on to their computers and access the Internet without a smart card, but require smart card authentication to access any internal network resources.

Additional resources

For information about DirectAccess integration with server and domain isolation and Network Access Protection (NAP), see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).


Understanding DirectAccess Deployment Models

DirectAccess can be deployed using a combination of the following:

  • An access model, which defines the types of internal network resources that a DirectAccess client can access and whether the DirectAccess client and internal network server perform authentication and traffic protection by using Internet Protocol security (IPsec)

  • A scalability model, which defines how many DirectAccess servers that you need to scale your DirectAccess infrastructures to meet the demands of DirectAccess clients

Access models

You can deploy a DirectAccess server by using the DirectAccess Setup wizard with the following access models:

  • End-to-edge

  • End-to-end for selected servers

End-to-edge

The end-to-edge access model allows DirectAccess clients to connect to all of the resources inside the internal network but does not use IPsec to protect the end-to-end communication with internal network servers. IPsec-based tunnel policies require authentication and encryption and the IPsec sessions terminate by default at the DirectAccess server. This access model works with network servers running Windows Server 2003 that do not support policy-based IPsec protection of IPv6 traffic.

End-to-end for selected servers

In addition to the encryption of traffic between the DirectAccess client and server over the Internet, the end-to-end for selected servers access model also ensures that communications between the DirectAccess client and internal network servers are authenticated and protected. This allows the DirectAccess client to confirm that they are communicating with their intended servers.

For this access model, you can also specify the use of authentication without protection, which uses the new Authenticate only (Null Encapsulation) IPsec policy option available in Windows 7 and Windows Server 2008 R2. Authentication without protection requires that the DirectAccess client and internal network resource perform IPsec peer authentication, but subsequent data packets exchanged are not protected with an IPsec header. This option might be needed for networks that contain packet processing or forwarding devices that cannot parse or forward IPsec-protected traffic.

Scalability models

DirectAccess can be set up using a single server, which allows DirectAccess to provide all of the baseline functionality required to operate. However, because the purpose of DirectAccess is to provide connectivity to remote users, reliability and scalability with multiple servers and division of tasks are also important.

Single server

In the single server scenario, all of the components of DirectAccess are hosted on the same server computer. The benefit of this scenario is a relatively simple deployment, requiring only a single DirectAccess server. The limitations of this scenario are a single point of failure and server performance bottlenecks can limit the maximum number of concurrent DirectAccess connections. The DirectAccess Setup wizard configures the single server scenario.

Multiple servers

If high availability is a priority, multiple servers can minimize any network outages to approximately two minutes. To achieve this, a minimum of four servers are required for a deployment. A Network Load Balancing (NLB) cluster configured with two servers provide IPv6 connectivity to DirectAccess clients on the Internet. Two servers provide IPsec session termination and failover. If any server fails, the service is restored because the connection is re-routed through an operational server.

For more information about the multiple-server scalability model and how to configure the components of DirectAccess on different servers, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).


Checklist: Before You Configure DirectAccess

This checklist provides the tasks needed to ensure that your internal network meets the requirements for a DirectAccess deployment.

Task | Reference
Deploy an Active Directory Domain Services (AD DS) domain on your internal network and ensure that at least one domain controller in the domain containing user accounts is running Windows Server 2008 or later. | Active Directory Domain Services Home page on Microsoft Technet (http://go.microsoft.com/fwlink/?Linkid=127814)
Deploy a public key infrastructure (PKI) with Active Directory Certificate Services (AD CS) and configure autoenrollment for computer certificates. | Active Directory Certificate Services Home page on Microsoft Technet (http://go.microsoft.com/fwlink/?Linkid=127816)
Configure a certificate revocation list (CRL) distribution point that is reachable from the Internet. | Specify CRL Distribution Points (http://go.microsoft.com/fwlink/?Linkid=137744)
Install Windows 7 on your DirectAccess clients and join them to your AD DS domain. | Understanding DirectAccess Components
Create AD DS security groups that contain the computer accounts of your DirectAccess clients. | Create a New Group (http://go.microsoft.com/fwlink/?Linkid=133523)
Configure your Internet firewall to allow DirectAccess traffic. | Understanding DirectAccess Components
Configure and deploy Windows Firewall settings for Teredo traffic. | Understanding DirectAccess Components
If your DirectAccess server is not acting as the network location server, determine or create an HTTPS-based uniform resource locator (URL) on a highly available Web server on your internal network. DirectAccess clients use this URL to determine whether they are located on the Internet or the internal network. | Identify Infrastructure Servers for DirectAccess
For each of your Domain Name System (DNS) servers that are running Windows Server 2008 or later, remove the ISATAP name from the global query block list. | Update the Global Query Block List (http://go.microsoft.com/fwlink/?LinkId=146153)


Checklist: Install and Configure Single-Server DirectAccess

This checklist provides the tasks required to install DirectAccess on a single server.

Task | Reference
Ensure that your network meets the requirements for DirectAccess. | Checklist: Before You Configure DirectAccess
Install two network adapters (interfaces) on your DirectAccess server. Connect the internal network interface to your internal network. | See your hardware documentation.
From the Network Connections folder, configure your network connections (interfaces) with meaningful names indicating the network to which they are attached, such as “Internet” and “Internal network.” |
Configure your internal network interface with a static IPv4 address configuration. | IPv4 General tab (http://go.microsoft.com/fwlink/?LinkId=145843)
Join your DirectAccess server to your Active Directory Domain Services (AD DS) domain. | Active Directory Domain Services Home page on Microsoft Technet (http://go.microsoft.com/fwlink/?Linkid=127814)
Ensure that your DirectAccess server is not a domain controller. |
Connect the Internet interface to the Internet. Verify that a domain controller is not reachable from the Internet interface. | See your Internet hardware documentation.
On the Internet interface, configure at least two consecutive, static, public IPv4 addresses that are resolvable and reachable on the Internet. Addresses within the address ranges 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16 are not public IPv4 addresses. | IPv4 General tab ( http://go.microsoft.com/fwlink/?LinkId=145843)
Configure connection-specific DNS suffixes on your Internet and internal network interfaces. | IPv4 and IPv6 Advanced DNS tab ( http://go.microsoft.com/fwlink/?LinkId=145844)
Ensure that the DirectAccess server has a computer certificate installed with the computer authentication Enhanced Key Usage (EKU). | View Certificates (http://go.microsoft.com/fwlink/?LinkId=145845)
If the DirectAccess server is acting as the network location server, install Internet Information Services (IIS). | Identify Infrastructure Servers for DirectAccess; Installing IIS 7.0 on Windows Server 2008 (http://go.microsoft.com/fwlink/?LinkId=145846)
Install DirectAccess on the DirectAccess server. | Install DirectAccess
Run the DirectAccess Setup wizard and apply the settings. | Use the DirectAccess Snap-in to Configure DirectAccess


Configuring DirectAccess

This section describes how to install and configure DirectAccess.

  • Install DirectAccess

  • Open the DirectAccess Snap-in

  • Use the DirectAccess Snap-in to Configure DirectAccess

  • Use Netsh to Configure DirectAccess

  • Use Group Policy to Configure DirectAccess Clients

  • Use Scripts to Configure DirectAccess


Install DirectAccess

You can install DirectAccess by using the Add Features wizard in Server Manager or in the Initial Configuration Tasks window.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To install DirectAccess

  1. Perform one of the following two steps to open the Add Features Wizard:

    • Open Server Manager. In the main window, under Features Summary, click Add features.

    • In the Initial Configuration Tasks window that appears when you first log on, under Customize This Server, click Add features.

  2. On the Select Features page, select DirectAccess Management Console.

  3. In the Add Features Wizard window, click Add Required Features.

  4. On the Select Features page, click Next.

  5. On the Confirm Installation Selections page, click Install.

  6. On the Installation Results page, review the status, and then click Close.
Note

After you complete the installation, DirectAccess Management Console appears in the list of features in Server Manager. You must now run the DirectAccess Setup wizard to configure your server for DirectAccess. For more information, see Checklist: Install and Configure Single-Server DirectAccess and Use the DirectAccess Snap-in to Configure DirectAccess.

Additional references

  • Configuring DirectAccess


Open the DirectAccess Snap-in

Use these procedures to open the DirectAccess Microsoft Management Console (MMC) snap-in.

Membership in the local Administrators group, or equivalent, is the minimum required to complete this procedure.

To open the DirectAccess snap-in by using Server Manager

  1. To start Server Manager, click Start, click Administrative Tools, and then click Server Manager.

  2. Expand Features, and then click DirectAccess.
To open the DirectAccess snap-in as a stand-alone console

  • Click Start, click Administrative Tools, and then click DirectAccess Management.
To open the DirectAccess snap-in from the Windows shell

  • Click Start, type damgmt.msc, and then press ENTER.

Additional references

  • Configuring DirectAccess

  • Use the DirectAccess Snap-in to Configure DirectAccess


Use the DirectAccess Snap-in to Configure DirectAccess

The DirectAccess Setup wizard has four steps for the initial configuration that must be followed in order:

  • Step 1: Configure DirectAccess Clients

  • Step 2: Configure the DirectAccess Server

  • Step 3: Identify Infrastructure Servers for DirectAccess

  • Step 4: Identify Application Servers for DirectAccess

After you complete the four steps, click Finish to display the DirectAccess Review dialog box, which summarizes the settings. To configure the DirectAccess server and create Group Policy objects (GPOs) and settings, click Apply.

To reset the default DirectAccess Setup wizard settings, right-click the Setup node in the DirectAccess snap-in, and then click Reset console settings. When you reset the settings, you cannot load a previous configuration that is stored in an Extensible Markup Language (XML) file.

To reset the default settings for the DirectAccess Setup wizard, DirectAccess server settings, and GPO settings, right-click the Setup node in the DirectAccess snap-in, and then click Undo configuration. The GPOs that were previously created by the DirectAccess Setup wizard are not removed, but the DirectAccess settings within them are removed.

Additional references

Configuring DirectAccess


Configure DirectAccess Clients

In this step of the DirectAccess Setup wizard (step 1), you configure settings for DirectAccess clients. For the initial configuration of DirectAccess client settings in the DirectAccess snap-in, expand the DirectAccess node, click the Setup node, and then click Configure for step 1.

The security groups containing the computer accounts of DirectAccess clients must exist before you configure step 1. For more information, see Create a New Group (http://go.microsoft.com/fwlink/?LinkId=145847).

On the DirectAccess Client Setup page, click Add and specify the Active Directory Domain Services (AD DS) security groups that contain the computer accounts for the computers that you want enabled as DirectAccess clients. These computers receive Group Policy settings that configure DirectAccess behavior. Computers that are not members of the specified security groups are not enabled as DirectAccess clients and cannot access the internal network by using the DirectAccess server. When you have specified the groups, click Finish. To change the DirectAccess client settings, click Edit for step 1.

Additional references

  • Use the DirectAccess Snap-in to Configure DirectAccess


Configure the DirectAccess Server

In this step of the DirectAccess Setup wizard (step 2), you configure settings for the DirectAccess server. For the initial configuration of DirectAccess server settings in the DirectAccess snap-in, expand the DirectAccess node, click the Setup node, and then click Configure for step 2. You cannot click Configure for step 2 until you have finished the configuration for step 1. To change DirectAccess server settings, click Edit for step 2.

Before performing step 2, see Checklist: Install and Configure Single-Server DirectAccess for DirectAccess server hardware and configuration requirements.

When you click Configure or Edit for step 2, there are pages in the wizard to configure connectivity, IPv6 prefixes for your organization if you have already deployed IPv6, and certificate use.

Connectivity

On the Connectivity page, you must specify the network connection (interface) that is attached to the Internet and the network connection that is attached to your internal network. You can click Details to obtain the configuration of the selected network connection.

Note

If you are testing DirectAccess on your internal network, the Internet network connection must not be connected to a network that contains a domain controller.

On the Connectivity page, you can also specify whether you require remote users to use smart cards when performing authentication with the DirectAccess server. For more information about smart cards, see Windows Authentication (http://go.microsoft.com/fwlink/?LinkId=146076).

Prefix configuration

If you already have native IPv6 deployed on your network, the Prefix Configuration page allows you to specify the 48-bit IPv6 address prefix that your entire internal network uses. You must use a 48-bit prefix.

The DirectAccess Setup wizard determines a default prefix based on the first global IPv6 address that is assigned to your internal network interface. If your internal network interface has multiple IPv6 addresses assigned and you do not want to use the prefix of the first address that is assigned to your internal network interface, you can manually specify the correct prefix. To view the set of IPv6 addresses assigned to your internal network interface, click Details on the Connectivity page.

The DirectAccess Setup wizard also determines a 64-bit prefix for IP-HTTPS connections. You must use a 64-bit prefix. The DirectAccess Setup wizard determines a default prefix based on the 48-bit internal network prefix, and then chooses a value for the Subnet ID portion of the prefix (the fourth block of the 64-bit prefix). You can also manually specify the correct 64-bit prefix based on your subnetting scheme. The 64-bit prefix must be based on the 48-bit prefix for the internal network.

Certificate components

On the Certificate Components page, you must specify the following:

  • The certificate for the root or intermediate certification authority (CA) in the certification path of the computer certificates that are installed on DirectAccess clients. The DirectAccess server uses this root or intermediate CA certificate to validate the computer certificates sent by the DirectAccess client computers during the initial connection to the DirectAccess server.

  • A certificate that the DirectAccess server uses for connectivity over IP-HTTPS. Because DirectAccess clients perform certificate revocation checking on the HTTPS certificate submitted by the DirectAccess server, you must ensure that the certificate revocation list (CRL) distribution points configured in this certificate are accessible and available from the Internet. If these CRL distribution points are not accessible to DirectAccess clients, authentication fails for IP-HTTPS-based DirectAccess connections. For information about configuring CRL distribution points for Active Directory Certificate Services (AD CS), see Specify CRL Distribution Points (http://go.microsoft.com/fwlink/?LinkId=145848).

Additional references

  • Use the DirectAccess Snap-in to Configure DirectAccess


Identify Infrastructure Servers for DirectAccess

In this step of the DirectAccess Setup wizard (step 3), you configure settings for infrastructure servers. For the initial configuration of DirectAccess server settings in the DirectAccess snap-in, expand the DirectAccess node, click the Setup node, and then click Configure for step 3. You cannot click Configure for step 3 until you have finished the configuration for step 2. To change infrastructure server settings, click Edit for step 3.

Before performing step 3, determine the following:

  • Whether a highly available internal network Web server can act as the DirectAccess network location server and has an HTTPS-based uniform resource locator (URL) on that Web server. This is optional but highly recommended.

  • The set of Domain Name System (DNS) namespaces that correspond to internal network resources (for example, contoso.com).

  • The Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6) addresses of the internal network DNS servers that you want answering name queries for DirectAccess clients.

  • The host names, IPv4 addresses, or IPv6 addresses of the management servers on your internal network that you want to initiate communications with DirectAccess clients. Management servers can include servers that distribute updates or perform software or hardware inventories.

When you click Configure or Edit for step 3, there are pages in the wizard to configure the network location server, DNS and domain controllers, and management servers.

Location

On the Location page, you specify the network location server, which is a server that a DirectAccess client uses to determine whether it is located on the internal network or the Internet. If the DirectAccess client can reach the network location server and access a specified Web page, the DirectAccess client determines that is on the internal network and DirectAccess functionality is not used.

You can specify whether the network location server function is on the DirectAccess server or another server on your internal network.

  • If the network location server function is not on the DirectAccess server (recommended), you must type an HTTPS-based URL of a Web page on that server.

  • If the network location server function is on the DirectAccess server, you must specify the certificate that is used for authentication of HTTPS-based connections between DirectAccess clients and the DirectAccess server.

In both cases, the network location server must be highly available and is a critical element of the DirectAccess infrastructure. If the network location server cannot be reached on the internal network, DirectAccess clients will enable DirectAccess functionality while they are located on the internal network, which can impair their ability to reach internal network resources.

DNS and domain controller

On the DNS and Domain Controller page, you configure the Name Resolution Policy Table (NRPT) and DirectAccess client name resolution behavior.

NRPT

The NRPT is a table that DirectAccess clients use to determine where to send their DNS name requests. Entries consist of a DNS domain name that can represent the fully qualified domain name (FQDN) of a specific computer (such as emailsrv21.europe.contoso.com) or a portion of the DNS namespace (such as contoso.com) and a corresponding set of addresses for DNS servers that serve the FQDN or namespace. If no DNS server addresses are specified, the entry is an exemption entry. If a DNS name matches an entry in the NRPT containing the addresses of DNS servers, the DirectAccess client sends the name query to the specified internal network DNS servers. If a DNS name matches an entry in the NRPT that does not contain addresses of DNS servers or does not match an entry in the NRPT, the DirectAccess client sends the name query to an Internet-facing DNS server.

The NRPT might have an existing entry based on the DNS suffix and DNS server configuration of the DirectAccess server. The NRPT might also have an exemption entry corresponding to the network location server. This entry is added so that DirectAccess clients that are on the Internet never attempt to resolve the name of the network location server by using an internal network DNS server.

To add more entries, right-click an empty row, and then click New. Alternately, you can double-click an empty row. In the Namespace Access Information dialog box, type the DNS suffix and specify the set of IPv4 or IPv6 addresses for the internal network DNS servers that resolve names ending with the DNS suffix. After you specify the IPv4 or IPv6 addresses, click Validate to test whether the DNS servers are running and reachable from the DirectAccess server.

To edit an entry in the NRPT, right-click the entry, and then click Edit. Alternately, you can double-click the existing entry. To delete an entry from the NRPT, right-click the entry, and then click Delete.

Name resolution behavior

On the DNS and Domain Controller page, you can also specify the local name resolution behavior of DirectAccess clients. Local name resolution is the use of name resolution techniques that do not include checking the entries in the DNS resolver cache and the querying of internal network DNS servers. These techniques include using Internet-facing DNS servers and querying the local subnet.

You have three options:

  • Use local name resolution only if the internal network DNS servers determined that the name does not exist

    This is the most secure option because the DirectAccess client will only send DNS queries to Internet-facing DNS servers for server names that cannot be resolved.

  • Use local name resolution if the internal network DNS servers determined that the name does not exist or if the internal network DNS servers are not reachable and the DirectAccess client computer is on a private network

    This option is recommended because it allows the resolution of names on a separate internal network.

  • Use local name resolution if there is any type of error when attempting to resolve the name using internal network DNS servers

    This is the least secure option because the names of internal network servers that the DirectAccess client is attempting to resolve can be sent out to Internet-facing DNS servers, allowing an eavesdropper between the DirectAccess client and the Internet-facing DNS server to determine the names of internal network servers.

Management

On the Management page, you configure the list of IPv4 or IPv6 addresses of internal network servers that you want to initiate communications with DirectAccess clients. These servers are typically management servers that contact DirectAccess client computers to perform management functions such as software or hardware inventory assessments or to install updates. Only the DirectAccess clients that are members of the security groups specified in step 1 of the DirectAccess Setup wizard can be contacted by the management servers specified on the Management page.

To add a management server, right-click an empty row, and then click New. Alternately, you can double-click an empty row. In the IPv4 Address or IPv6 Address/Prefix dialog boxes, you can obtain an IPv4 or IPv6 address from the host name of the server or type it manually:

  • To obtain an IPv4 or IPv6 address from the host name, select Host name of the specific machine, and then type the name of the server. Click Check Name to resolve the name to its registered addresses. Click one of the addresses, and then click OK.

  • To manually specify an IPv4 address, select IPv4 address in the IPv4 Address dialog box, and then type the address. When you are done, click OK.

  • To manually specify an IPv6 address or prefix, select IPv6 address or IPv6 prefix in the IPv6 Address/Prefix dialog box, and then type the address or prefix. When you are done, click OK.

To edit an IPv4 address or an IPv6 address or prefix entry in the list, right-click the entry, and then click Edit. To delete an entry, right-click the entry, and then click Delete.

Additional references

  • Use the DirectAccess Snap-in to Configure DirectAccess


Identify Application Servers for DirectAccess

In this step of the DirectAccess Setup wizard (step 4), you configure settings for end-to-end authentication and protected communication with application servers on your internal network. For the initial configuration of DirectAccess application server settings from the DirectAccess snap-in, expand the DirectAccess node, click the Setup node, and then click Configure for step 4. You cannot click Configure for step 4 until you have completed the configuration for step 3. To change application server settings, click Edit for step 4.

Before doing step 4, determine the following:

  • Whether you want DirectAccess clients to perform end-to-end authentication and data protection for specific internal network servers. If so, create security groups that contain the computer accounts of those internal network servers.

  • Whether you want to restrict communication from DirectAccess clients to only those servers that are members of specific security groups.

  • Whether you have network equipment that cannot forward IPsec-protected traffic.

On the DirectAccess Application Server Setup page, if you do not want DirectAccess clients to perform end-to-end authentication with internal network servers, select Require no additional end-to-end authentication.

If you want DirectAccess clients to perform end-to-end authentication for internal network servers, select Allow selected servers to perform end-to-end authentication and traffic protection for the specified servers, and then click Add to specify the security groups that contain the internal network servers.

To restrict the access of DirectAccess clients to the set of servers that are the members of the specified security groups, select Allow access to only those servers in the selected security groups.

It is not possible to use the DirectAccess Setup wizard to configure limited access to a specific set of servers without end-to-end authentication and optional data protection. To configure this scenario, you must modify the resulting connection security rules that are applied to DirectAccess clients. For more information, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).

If you have network equipment that discards or cannot analyze IPsec-protected traffic, select Configure the IPsec connection security rules on these servers to perform authentication without traffic protection. With this setting enabled, DirectAccess clients and the specific internal network servers perform end-to-end IPsec authentication, but do not use IPsec protection to provide data integrity or privacy for the packets sent between DirectAccess clients and internal network servers.

Additional references

  • Use the DirectAccess Snap-in to Configure DirectAccess


Use Netsh to Configure DirectAccess

You can use the Network Shell (Netsh) command-line tool to create customized and scripted DirectAccess deployments. Scripts that use Netsh commands provide you with the flexibility to create unique DirectAccess deployment solutions.

The following Netsh.exe contexts can be used to configure interface, IPv6, IPv6 transition technology, IPsec, or firewall settings:

  • interface

  • interface ipv6

  • interface 6to4

  • interface isatap

  • interface teredo

  • interface httpstunnel

  • http

  • advfirewall

  • ipsecdosprotection

For more information about using Netsh to customize a DirectAccess configuration, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).

Additional references

  • Configuring DirectAccess


Use Group Policy to Configure DirectAccess Clients

Group Policy provides an object-based method to create, distribute, and apply DirectAccess settings to clients. The DirectAccess Setup wizard automatically creates Group Policy objects (GPOs) with the appropriate settings and applies them to the specified security groups.

For more information about using GPOs and settings in a customized or scripted setup, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).

Additional references

  • Configuring DirectAccess


Use Scripts to Configure DirectAccess

DirectAccess scripting allows you to use a PowerShell script to run a combination of Network Shell (Netsh) and PowerShell commands to configure DirectAccess with all of the required Group Policy objects and settings.

The DirectAccess snap-in generates an Extensible Markup Language (XML) data file whenever you save or apply settings. The default location for this file is %windir%\DirectAccess\DirectAccessConfig.xml. You can modify and customize this XML file by using the XML tags in the file. For example, the <InternalNetworkInterface> tag allows you to manually specify the name and ID of the internal network interface on the DirectAccess server. The customized XML file can then be passed as an input to a PowerShell script named Engine.ps1 to configure a DirectAccess server and all of the required Group Policy settings.

The Engine.ps1 PowerShell script is available at the Script Center Script Repository on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=145944).

The syntax for executing the script is the following:

engine.ps1 –mode {serveronly|gpsettingonly|all} [–data <dataFilePath>] [-log <logFilePath>]
  • The mode parameter is required, and you must specify one of the following:

    • serveronly: This value configures only the DirectAccess server and does not create or configure Group Policy objects and settings.

    • gpsettingonly: This value configures only the Group Policy objects and settings and does not create or configure the DirectAccess server.

    • all: This value configures both the DirectAccess server and the Group Policy objects and settings. This is equivalent to clicking Apply from the DirectAccess Review page.

  • The data parameter is the path to the customized XML file. This is optional. If a location is not specified, the script runs the DirectAccessConfig.xml file in the %windir%\DirectAccess folder.

  • The log parameter is the path to the log file. This is optional. If a location is not specified, the script creates the DirectAccess_log.txt file in the folder from which you run the script.

Additional references

  • Configuring DirectAccess

  • Windows PowerShell (http://go.microsoft.com/fwlink/?LinkID=102372)


Use the DirectAccess Snap-in to Monitor DirectAccess

The DirectAccess snap-in in Windows Server® 2008 R2 allows you to monitor the components of DirectAccess that are running on a DirectAccess server. To view the components and their status, click the Monitoring node in the DirectAccess snap-in. The contents pane displays the overall status of the server and the status of the following DirectAccess components:

  • Teredo Relay

  • Teredo Server

  • 6to4

  • IP-HTTPS

  • ISATAP

  • Network Security

  • DNS Server

The status of each component is refreshed every 10 seconds. The refresh interval is not configurable. For all of the components except the DNS Server component, click Details to view the Performance Monitor snap-in with preconfigured counters for the selected component.

Each of the components can be in one of the following states: Active, idle, warning, error, or unconfigured. The system state reflects the worst state of its components. For example, if both warning and error states are reported by components, the system state is in the error state.

To configure DirectAccess monitoring settings, right-click the Monitor node, and then click Configure. In the DirectAccess Monitoring Setup dialog box, you can configure the Internet and internal network interfaces and the Internet Protocol version 6 (IPv6) addresses of internal network Domain Name System (DNS) servers.

For more information about the states of the DirectAccess server components and the Performance Monitor counters, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).


Troubleshooting DirectAccess

This topic lists some common issues you might encounter when setting up or using DirectAccess.

For the most up-to-date troubleshooting information, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).

What problem are you having?

  • I get the “The Internet interface must not be classified as a domain network” error message in step 2.

  • A DirectAccess client does not have access to the internal network.

  • A DirectAccess client cannot access a resource on the internal network.

I get the “The Internet interface must not be classified as a domain network” error message in step 2.

  • Cause: A domain controller for the domain of which the DirectAccess server is a member is reachable on the network to which the selected Internet interface is attached.

  • Solution: This error is most commonly encountered when the DirectAccess server is also configured as a domain controller, and then you try to run the DirectAccess Setup wizard. The DirectAccess server cannot be a domain controller. If the DirectAccess server is not a domain controller, select the correct Internet interface or determine why a domain controller can be located on network to which the selected Internet interface is attached. For more information, see Checklist: Before You Configure DirectAccess and Checklist: Install and Configure Single-Server DirectAccess.

A DirectAccess client does not have access to the internal network.

  • Cause #1: The DirectAccess client is not a member of the configured security groups for DirectAccess clients.

  • Solution #1: Verify that the correct security groups are configured in step 1 of the DirectAccess wizard and that the computer account of the DirectAccess client computer is a member of one of the configured groups. For more information, see Configure DirectAccess Clients.

  • Cause #2: Your Internet or internal network firewalls are blocking traffic to and from the DirectAccess server.

  • Solution #2: See Understanding DirectAccess Components for information about configuring your Internet and internal network firewalls.

A DirectAccess client cannot access a resource on the internal network.

  • Cause #1: The resource on the internal network is not Internet Protocol version 6 (IPv6)-capable.

  • Solution #1: To access a resource on the internal network, the resource must either be IPv6-capable, which requires that the computer and the application making the resource available are both IPv6-capable, or that you use a Network Address Translation-Port Translation (NAT-PT) device between the DirectAccess client and the resource. For more information, see Understanding DirectAccess Components.

  • Cause #2: The Name Resolution Policy Table (NRPT) is configured incorrectly.

  • Solution #2: To determine where to send Domain Name System (DNS) name query requests, the DirectAccess client uses the NRPT. If the name of an internal network resource server is not matched to an entry in the NRPT, the DirectAccess client uses Internet-facing DNS servers and other methods to resolve the name. Verify the NRPT has the correct entries as configured in step 3 of the DirectAccess Setup wizard. For more information, see Identify Infrastructure Servers for DirectAccess.

See Also

  • Understanding DirectAccess Components
  • Checklist: Before You Configure DirectAccess
  • Checklist: Install and Configure Single-Server DirectAccess


Resources for DirectAccess

For more information, see the DirectAccess home page on Microsoft Technet (http://go.microsoft.com/fwlink/?LinkId=142598).

For links to additional DirectAccess resources, see the Microsoft DirectAccess Web page (http://go.microsoft.com/fwlink/?Linkid=140994).