Vishal Shirodkar Technology Specialist Microsoft India Session Code:
Session Objectives And Takeaways Explain how DirectAccess differs from a traditional VPN Identify some of the key requirements for installing DirectAccess Discuss various methods for deploying IPv6 in the enterprise to support DirectAccess
Agenda Secure Access Landscape What is Direct Access DirectAccess Solution Benefits Deployment Models Deployment considerations Demo Questions & Answers
Information Worker s World Has Been Changing CENTRAL OFFICE REMOTE WORK MOBILE & DISTRIBUTED WORKFORCE BRANCH OFFICES
Building A Trusted Stack Core Security Components Identity Claims Authentication Authorization Access Control Mechanisms Audit I+4A Trusted Data Trusted Stack Trusted People Trusted Software Trusted Hardware Secure Foundation SDL and SD3 Integrated Protection Defense in Depth Threat Mitigation
Industry Trends Assume the underlying network is always unsecure Redefine the corporate edge to protect the datacenter Security policies based on identity, not location DirectAccess Server Data Center and Business Critical Resources Local User Remote User
What Is DirectAccess? Comprehensive anywhere access solution available in Windows 7 and Windows Server 2008 R2 Provides seamless, always-on, secure connectivity to on-premise and remote users alike Eliminates the need to connect explicitly to corpnet while remote Facilitates secure, end-to-end communication and collaboration Leverages a policy-based network access approach Enables IT to easily service/secure/update/provision mobile machines whether they are inside or outside the network
The DirectAccess Vision ISA FW, TSG 802.1x Non-compliant Lab, Client Client Device Non-compliant Client Device Secure Boundary X Internet Dedicated Resources VPN Gateway Compliant Windows 7 Client Healthy Resources Always on Always healthy Always secure RODC Compliant Client Corporate Network Compliant Windows 7 Client Customer Site Compliant Windows 7 Client Cust FW Downlevel or Mobile Client Business Partner Always-on connectivity across different networks A focus on driving access decisions based on policy and a trusted identity, rather than the limitations of network topology. Non-compliant Client Device Requires users to connect (lost productivity) Client must be made healthy prior to network access (Lost productivity plus IT time and expense) NPS/NAP Servers
More productivity More secure More manageable and cost effective Always-on access to corpnet while roaming No explicit user action required it just works Same user experience on premise and off Connects Automatically Adapts to changing networks Internet connectivity=corpnet connectivity Healthy, trustable host regardless of network Fine grain per app/server policy control Richer policy control near assets Ability to extend regulatory compliance to roaming assets Incremental deployment path toward IPv6 Fully supports smart card authentication Simplified remote management of mobile resources as if they were on the LAN Lower total cost of ownership (TCO) with an always managed infrastructure Unified secure access across all scenarios and networks Integrated administration of all connectivity mechanisms
VPN vs. DirectAccess - Value VPN DirectAccess
DirectAccess Solution Overview Internet NAP / NPS Servers Compliant Client Compliant Client Tunnel over IPv4 UDP, HTTPS, etc. Intranet User DirectAccess Server Assume the underlying network is always insecure Data Center and Business Critical Resources Enterprise Network Intranet User Redefine CORPNET edge to insulate the datacenter and business critical resources Security policies based on identity, not location
Microsoft Windows 7 clients Microsoft Windows 7 DirectAccess Server Application servers Windows Server 2008 (for native IPv6 support) Exception: When Windows Firewall Authentication policy is used, application servers must be Windows Server 2008 R2 DC/DNS servers Windows Server 2008 Exception: When two-factor authentication is required for end-to-end authentication a Windows 7 DC-based Active Directory NAT-PT server if IPv4 access is desired
Deployment Scenario Trusted, compliant, healthy machine Internet DirectAcc ess Server (Win7) Optional NATPT DC & DNS (Win 2008) Corporate Network Applications & Data Windows 7 client IPsec ESP tunnel using machine cert (DC/DNS access) IPsec ESP tunnel using machine cert and user credentials (App server access)
Deployment Scenario What Happens At Client Client tries to access Client tries to connect to target.corpnet.com Looks in provisioned list for DNS server(s) associated with.corpnet Connects IPv6 route with again DNS thru server DAS. (using IPsec. IPv6 is required. is thru DAS What happens at DAS/DNS DAS lets thru AuthIP packets from client to DNS After negotiation, DAS lets ESP packets thru between client and DNS. DNS returns target address information to client. DNS registers clients current address information
DirectAccess wizard to set up DirectAccess Server(s) Policies controlled via Group Policy Configuring for DirectAccess Client Receives configuration while directly connected to corpnet (provisioning) via Group Policy NAP used to check configuration and health when remotely connected Server
Server Runs on Windows Server 2008 R2 Sits on network edge Single box by default Services can be split up for scalability Client Runs on Windows 7 Domain-joined Initial configuration done on Corpnet or over VPN
Roles of DirectAccess Server Facing Internet Forwarding Gateway for native IPv6 IPv6 over IPv4 services 6to4 relay Teredo Relay (optionally also Teredo Server) Firewall/Proxy Travel Internal IP-TLS relay IPsec Dos Protection Facing Corpnet Gateway for native IPv6 IPv6 over IPv4 Service for Enterprise SATAP Relay IPsec Gateway (Tunnel Mode Endpoint)
DirectAccess Deployment Be ready to monitor IPv6 traffic Choose an Access Model: Full Intranet Access vs. Selected Server Access? Assess deployment scale
DirectAccess Deployment Configure DirectAccess Server Requires Windows Server 2008 R2 Use DirectAccess server MMC Author DirectAccess policies for clients, application servers, DC/DNS and IPsec gateway Windows 7 Enterprise & Ultimate SKU Client Machines Done using DirectAccess configuration wizard Customize policies as needed
DirectAccess Supporting Technologies Trusted, compliant, healthy machine DC & DNS (Win 2008) Corporate Network Applications & Data Windows 7 client NAP (includes Server & Domain Isolation [SDI]) Forefront Client Security Windows Firewall BitLocker + Trusted Platform Module (TPM) IAG SP2
DirectAccess User Interface DirectAccess is available! 1 Built-in Troubleshooting
Why Windows 7 only? Significant component changes for DirectAccess: Name Resolution Policy Table IP-HTTPS Group Policy changes And others
Direct Access in Action
It Works Today, Simply Evolution, not revolution Upgrade your network to an IPv6 end state Requires Windows 7 on the client Transition to Windows Server 2008 simplifies the solution Little or no change to applications upgrade the server platform 30 Microsoft LOB applications today on Windows Server 2008 running end-to-end IPsec/IPv6 Additional 40 planned to upgrade in next two months Allows you to take concrete steps toward satisfying any IPv6 mandate Seamless integration with your current access and security solutions Seamless transition to DirectAccess over time Integrates with Forefront solutions
2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.