How DirectAccess Works


When a client provisioned for DirectAccess is outside of the corporate network, it will automatically endeavour to institute a secure remote connection to the DirectAccess server over the Net. The DirectAccess connection takes place at the machine level and requires no user interaction. About commonly, the DirectAccess client will exist on the IPv4 Internet, so an IPv6 transition technology will be selected and a tunnel will be established with the DirectAccess server.

Inside the IPv6 transition tunnel, authenticated and encrypted IPsec tunnels are established between the client and the server. It is over these tunnels that communication to resources on the corporate network takes identify. The DirectAccess IPsec tunnels are defined equally Connection Security Rules (CSR) in the Windows Firewall with Advanced Security on both the DirectAccess client and the server.

DirectAccess provides support only for Domain-joined clients that include operating arrangement support for DirectAccess.

The post-obit server operating systems support DirectAccess.

  • You can deploy all versions of Windows Server 2016 as a DirectAccess customer or a DirectAccess server.
  • Yous can deploy all versions of Windows Server 2012 R2 as a DirectAccess client or a DirectAccess server.
  • You can deploy all versions of Windows Server 2012 as a DirectAccess client or a DirectAccess server.
  • You can deploy all versions of Windows Server 2008 R2 as a DirectAccess customer or a DirectAccess server.

The following client operating systems support DirectAccess.

  • Windows 10 Enterprise
  • Windows x Enterprise 2015 Long Term Servicing Branch (LTSB)
  • Windows 8 and eight.i Enterprise
  • Windows vii Ultimate
  • Windows vii Enterprise

DirectAccess vs. VPN

  1. VPN connections are user initiated and therefore optional. Information technology is up to the user to decide when they desire to connect to the corporate network. By comparison, DirectAccess is seamless and transparent in nature, is completely automated, and requires no user interaction to establish a connectedness.
  2. Many VPN protocols aren't firewall friendly, which can impede the successful institution of a VPN connection. DirectAccess can institute its secure remote connection using HTTPS, which is commonly allowed through almost firewalls.
  3. VPNs oft crave investments in proprietary hardware and per-user licensing. DirectAccess can be deployed on existing virtual infrastructure and does non require boosted user licensing.
  4. Proprietary software is commonly required to leverage all of the features provided by VPN solutions. This software must be deployed and managed by IT administrators. DirectAccess requires no additional 3rd-party software to be installed. All settings for DirectAccess are managed through Group Policy Objects (GPOs) in Agile Directory.
  5. A VPN connection can be established from any customer machine with the VPN customer software installed.This makes integration with a multifactor hallmark solution an essential requirement, which makes the solution more complex and hard to support. A DirectAccess connection tin simply be established from a client computer that has been provisioned for DirectAccess past It, reducing the need to employ strong authentication for DirectAccess connections.

Organization Requirements


Windows Server 2016 and DirectAccess should exist installed on a defended concrete server for optimum performance. However, Windows Server 2016 and DirectAccess can be installed on a virtual machine hosted on any Microsoft Server Virtualization Validation Plan (SVVP) validated hypervisor, including Microsoft Hyper-V, VMware, and many others. It is recommended that the server (concrete or virtual) be provisioned with a minimum of iv processor cores, 8GB of RAM, and 60GB of hard disk drive space.

For more than information, please browse to : https://docs.microsoft.com/en-united states/windows-server/remote/remote-access/directaccess/directaccess-deployment-paths-in-windows-server

For this demo purposes, i volition be using3 VM, consists of2 Windows Server 2016 VM and 1 Windows ten client VM which is all running in Hyper-V.

Infrastructure Requirement (this is based on the Isolated Environment) it might different in the Real Production implementation.

  • ane Domain Controller Server (DC-CLOUD)
  • 1 Member Server (SUB-01 )
  • 1 Client PC running Windows 10 (Client-x)

01 – lets verify the network configuration for all our VM's (Please Refer to the Pictures)

(SUB-01.Windows.ae)

i – Open Network Connections by pressing Window Key + X and clicking Network Connections .

1.png

2 – Ren ame the network connections intuitively and then they tin be speedily identified in the time to come. Renaming them Internal and External should be sufficient. Network adapters can be renamed by right-clicking them and choosing Rename or by simply highlighting a network adapter and pressing.

2.png

3 – To configure the Internal network interface, right-click the Internal network connection and choose Properties . Highlight Internet Protocol Version four (TCP/IPv4) and then click Properties . Provide an IPv4 accost and a subnet mask. Do NOT specify a default gateway! Provide the IP addresses for DNS servers on the corporate LAN as necessary.

3.png

02 – External Interface

one – To configure the External interface, right-click the External adapter and choose Properties . Highlight Cyberspace Protocol Version 4 (TCP/IPv4) and then click Properties . Provide an IPv4 accost, subnet mask, and default gateway. DO NOT specify any DNS servers.

4.png

2 – Click Avant-garde . If Teredo support is required, click Add nether the IP addresses section and specify the next consecutive public IPv4 accost and subnet mask.

5.png

3 – Select the DNS tab and uncheck the box next to Register this connection's addresses in DNS.

6.png

4 – Select the WINS tab and uncheck the box side by side to Enable LMHOSTS lookup . In add-on, in the NetBIOS setting section select the option to Disable NetBIOS over TCP/IP.

7.png Note : As the External network interface is public facing and connected to an untrusted network (public Internet or perimeter/DMZ network), it is recommended that all protocols and services other than IPv4 and IPv6 exist disabled to reduce the attack surface of the DirectAccess server.

03 – Creating DirectAccess OU & Group in Active Directory

(DC-Cloud.Windows.ae)

~*~ You demand to create the OU & Group because we going to add Customer-ten into this group and so that the customer can have DirectAccess connection. ~*~

ane – Create a new OU – In the New Object – Organizational Unit dialog box, in the Proper name box, type "DirectAccess Clients", and then click OK.

8.png

ii- In the Active Directory Users and Computers console, aggrandize Windows.ae, right-click DirectAccess Clients OU, click New, and then click Grouping.

9.png

3 – In the New Object – Group dialog box, in the Grouping proper noun box, blazon DA Clients.

10.png

4 – Side by side, right-click DA Clients, and then click Properties.

11.png

5 – In the DA ClientsProperties dialog box, click the Members tab, and then click Add and so click Object Types.

13.png

six – Next, clickComputers cheque box, and then click OK.

14

7 – In the Enter the object names to select (examples) box, type CLIENT-x, and then click OK.

15

8 – Verify that CLIENT-10 is displayed nether Members, and then click OK.

16

04 – Installing the Remote Admission server function

(SUB-01.Windows.ae)

one – Open Server Manager , click Add together Roles and Features . (Please Refer to the Pictures)

3

ii – On the Earlier You Begin page, click Next .

4

iii – On the Select installation type folio, click Next.

5

four – On the Select destination server page, click Adjacent .

17.png

5 – On the Select server roles page, click Remote Access , and then click Side by side.

11

6 – On the Select Features page, click Next.

12

7 – On the Remote Access page, click Next.

13

8 –On the Select role services folio, click DirectAccess and VPN (RAS) a nd Add Roles and Features Wizard dialog box, click Add together Features , and then verify that DirectAccess and VPN (RAS) is selected.

14 15

9 – On the Select function services folio, click Adjacent .

17

x – On the Confirm installation selections page, click Install .

18

11 – When the installation completes, click Close.

19

05 – Configure DirectAccess by running the Getting (Please Refer to the Pictures)

one – Open Server Manager, click Tools, and then click Remote Access Direction.

18.png

2 –In the Remote Access Management console, under Configuration , click DirectAccess and VPN , then click Run the Getting Started Wizard .
19.png

3 – In the Getting Started Magician , on the Configure Remote Access page, click Deploy DirectAccess only .

20.png

4 – On the Network Topology page, verify that Border is selected, in the Type the public proper noun or IPv4 address used past clients to connect to the Remote Access server text box, type 131.10.15.254 , and then click Next .

21.png

5 – In the Configure Remote Access interface, click thehere link.

22.png

6 – On the Remote Admission Review interface,verify that two GPOs are created, DirectAccess Server Settings and DirectAccess Customer settings, and then next toRemote Clients, click the Change.

23.png

7 – Next, select Domain Computers(Windows\Domain Computers), and and so clickRemove.

24.png

8 – Next, on the same interface, clickAdd, and then typeDA Clients, and then clickOK.

26

9 – Make sure you clear the Enable DirectAccess for mobile computers onlycheck box, and so click Side by side.

26.png

x – On the DirectAccess Client Setup interface, click Finish.

DirectAccess connection proper noun: NewHelpTech connexion

27.png

11 – On the Remote Access Review interface,verify that Windows\DA Clients listed under Remote Clients and then click OK.

28.png

12 – On the Configure Remote Access page, click Finish and wait for the configuration to cease.

29.png

13 – In the Applying Getting Started Magician Settings dialog box, verify that the configuration was successful, and so click Close .

30.png 31

06 – DirectAccess connectivity to Client Windows ten (Delight Refer to the Pictures)

Verify DirectAccess Grouping Policy configuration settings for Windows ten clients

ane – Switch to CLIENT-ten.

11

2 – Restart CLIENT-10, and so sign in again as Windows \Ambassador with the password of asd@123.

32.png

3 – Open a Command Prompt window, and then type the following commands, pressing Enter at the end of each line:

gpupdate /force
gpresult /R

33 34 Verify that DirectAccess Client Settings GPO displays in the list of Applied Policy objects for the Computer Setting, Close the Command Prompt window.

Move the client figurer to the Internet virtual network (Please Refer to the Pictures)

1 – Open Network Connections past pressing Window Key + X and clicking Network Connections .

36.png

ii –In the Network Connections window, right-click Internal , and then click Disable .

37.png

three –Right-click External , then click Enable .

38.png

4 – Open the External IPv4 to verify the IP settings.

39.png

Verify connectivity to the DirectAccess server

1. On Client-x , open a command prompt, blazon the following command, and then press Enter:

ipconfig

40.png Notice the IPv6 address that starts with 2002. This is an IP-HTTPS address

2 – At the control prompt, type the post-obit command, and then press Enter:

Netsh name show effectivepolicy

41.png

3 – Click Beginning , and so click Settings

42.png

4 – In Settings , select Network & Internet , and so click DirectAccess .

43.png

5 – Verify that Your PC is set up correctly for single-site DirectAccess is displayed nether Location .

44.png Notice the Collect button under Troubleshooting info

two – Next, in the Customer-10, open PowerShell and blazon :

~*~ this command just to get the DirectAccess customer settings ~*~

Become-DAClientExperienceConfiguration

46.png

3 – Now, its time for usa to test the DirectAccess connectivity.

~*~ In Client-10, open up IE then type : http://www.Windows.ae ~*~

47.png

DirectAccess Server (SUB-01.Windows.ae) : Monitoring DirectAccess connectivity

one – click Remote Client Condition, then in the central pane, review the data
nether the Continued Clients list.

45.png Close the Remote Access Management Console

Common Issues and Troubleshooting Tips

Common Issue Troubleshooting Tip
You have configured DirectAccess, just users are complaining about connectivity issues. You want an efficient style to troubleshoot their issues. Basic troubleshooting is integrated in the Network Connectivity aid, then educate users how to access it and to decide what is preventing the client figurer from communicating with the
DirectAccess server.
The DirectAccess client tries to connect to the DirectAccess server by using IPv6 and IPsec with no success. If you are using Teredo as the IPv6 transition technology, verify whether you accept two public addresses on the external network adapter of the DirectAccess server. This is required for establishing

that's all for now.., whatsoever Doubts type a commend.. ðŸ™‚