Home / server / Questions / 756
In Process
vzczc
Asked: 2009-05-01 05:28:56 +0800 CST

Windows 7 Direct Access

  • 772

Windows 7 Direct Access is a feature that enables safe direct access to a network without using third party software.

What are its requirements and how do you set up this feature?

windows windows-server-2008 windows-7 direct-access

3 Answers

  1. DirectAccess requirements

    • One or more DirectAccess servers running Windows Server 2008 R2 with two network adapters: one that is connected directly to the Internet, and a second that is connected to the intranet.
    • On the DirectAccess server, at least two consecutive, public IPv4 addresses assigned to the network adapter that is connected to the Internet.
    • DirectAccess clients running Windows 7.
    • At least one domain controller and Domain Name System (DNS) server running Windows Server 2008 or Windows Server 2008 R2. When smart card-based authentication is required for end-to-end protection, you must use Active Directory Domain Services (AD DS) in Windows Server 2008 R2.
    • A public key infrastructure (PKI) to issue computer certificates, smart card certificates, and, for NAP, health certificates. For more information, see http://www.microsoft.com/pki.
    • IPsec policies to specify protection for traffic. For more information, see http://www.microsoft.com/ipsec.
    • IPv6 transition technologies available for use on the DirectAccess server: ISATAP, Teredo, and 6to4.
    • 4

  2. This feature does look to rock. Should see a decline in SSL VPN sales I would think...

    Technical Overview of DirectAccess in Windows 7 and Windows Server 2008 R2

    • 2

  3. To configure DirectAccess (DA), you can see the answer provided by vzczc to see what is needed. Once you have the systems and infrastructure in place you need to do the following:

    Prepare AD/DNS

    1. Create a security group for computers that will be DA clients
    2. Create a DNS host record for the Network Location Server for intranet DA clients.
    3. Create a DNS host record for the server that hosts the certificate revocation list (CRL) in the intranet.
    4. On public DNS create a DNS host record for the host that will provide access to the CRL for internet based DA clients.

    Configure your PKI environment

    1. Add/configure CA server role
    2. Configure CRL distribution settings
    3. Publish the CRL to designated intranet location
    4. Create certificate template and configure security settings on the template so Authenticated Users can enroll the certificate
    5. Distribute the computer certificates (this can be done via GPO and auto-enrollment)

    Configure DA clients

    1. Verify DA clients have computer cert required for DA authentication
    2. Verify clients can connect to intranet resources

    Configure DA server

    1. Install two NIC in DA server
    2. Install web server role on DA server
    3. Create a virtual directory to host the CRL
    4. Publish the CRL to the virtual directory
    5. Install DA Management Console feature
    6. Run DA Management wizard to configure DA

    The Network Location Server functionality is used by the DA clients to determine if they are on the intranet. Depending on the response (or non-response) of the Network Location Server, the DA client will institute the profiles and rules appropriate for DA or non-DA (intranet) access.

    The Network Location Server can run on the DA server, it needs the web server role to function.

    • 0