directaccess with unified access gateway (uag)
DESCRIPTION
DirectAccess with Unified Access Gateway (UAG). Ronald Beekelaar [email protected]. Introductions. Presenter – Ronald Beekelaar MVP Security MVP Virtual Machine Technology E-mail: Beekelaar Consultancy BV [email protected] Work Security consultancy Virtualization consultancy - PowerPoint PPT PresentationTRANSCRIPT
DirectAccess withUnified Access Gateway (UAG)
Ronald [email protected]
Introductions• Presenter – Ronald Beekelaar– MVP Security– MVP Virtual Machine Technology– E-mail: Beekelaar Consultancy BV
• Work– Security consultancy– Virtualization consultancy– Create many VM-based labs and demos– Software to optimize, manage and run VM
Session Objectives• Main goals:
– Make it easier for you to talk to customers about using the remote access and management solution of DirectAccess in combination with Unified Access Gateway
– Or: implement DirectAccess in combination with Unified Access Gateway in your own organization
– How to do that?• Help understand the function of DirectAccess (DA)• Understand relationship between UAG and DA• Know that UAG DirectAccess + IPv6 + IPsec is "easy"
– Sub goal:• Use the lab environment for demos
Demo and Lab Environment
• For study, testing, demo, POC, etc– Download from:
• http://go.microsoft.com/fwlink/?LinkId=190269
– Contains all Forefront products• Including FIM and AD FS
What is DirectAccess• Connect with roaming client "directly" to
the company network• No VPN needed• No extra IP address needed• No terminal server "trick"• Use same "internal" server names: \\hrserver1,
http://portal• Requires IPv6 addresses• Also: connect from company network to
roaming client computer – even before user logs on
IPv6 ?
• Successor to IPv4, but not well-understood• Multiple transition techniques to have IPv4
plus IPv6Internet
Companynetwork
IPv6 in IPv4 ? ? ?IPv4IPv6 IPv4
IPv6IPv4
IPv6 ??
Technologies used
• Internal network– Isatap: automatically map ipv4 to ipv6
• External network (Internet)– 6to4 tunneling
or– Teredo
or– IP-HTTPs
UAG DirectAccess
• Provides DirectAccess 'access' to IPv4 servers on the company network
• Is IPv6 "isatap" router on company network
• Implements DNS64 and NAT64
DNS64 and NAT64 - say"6-to-4"
From: http://blogs.technet.com/edgeaccessblog/archive/2009/09/08/deep-dive-into-directaccess-nat64-and-dns64-in-action.aspx
Terminology "Cheat sheet"
• IPv6 addresses– fe80: - link-local (no routing) ~~ 169.254.x.x– 2002: - 6to4 (with routing)– 2001: - Teredo addresses
• Transition– Isatap - generates link-local IPv6 based on IPv4– 6to4 - tunneling on Internet– Teredo - (if NAT) uses UDP 3544– IP-HTTPs - when no Teredo possible
Networking in lab environment
InternetCompanynetwork