Test Lab Guide: Demonstrate Forefront UAG 2010 SP1 RC DirectAccess Force Tunneling

Microsoft CorporationPublished: October 2010

AbstractDirectAccess is a new feature in the Windows® 7 and Windows Server® 2008 R2 operating systems that enables remote users to securely access intranet shared folders, Web sites, and applications without connecting to a virtual private network (VPN). Forefront UAG SP1 RC DirectAccess extends the benefits of Windows DirectAccess across your infrastructure by enhancing availability and scalability, as well as simplifying deployments and ongoing management. This paper contains an introduction to DirectAccess and step-by-step instructions for extending the Test Lab Guide: Demonstrate UAG SP1 RC DirectAccess to demonstrate UAG

SP1 RC DirectAccess Force Tunneling.

Copyright InformationThis document is provided for informational purposes only and Microsoft makes no warranties, either express or implied, in this document. Information in this document, including URL and other Internet Web site references, is subject to change without notice. The entire risk of the use or the results from the use of this document remains with the user. Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation.

Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.

© 2010 Microsoft Corporation. All rights reserved.

Author: Thomas W Shinder (tomsh@microsoft.com)

Date of last update: October 29, 2010

Microsoft, Windows, Active Directory, Internet Explorer, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries.

All other trademarks are property of their respective owners.

ContentsIntroduction.................................................................................................................................................1

In this guide.............................................................................................................................................2

Overview of the Test Lab scenario...............................................................................................................3

Configuration component requirements.....................................................................................................5

Steps for configuring the test lab................................................................................................................6

STEP 1: Complete the UAG SP1 RC DirectAccess Test Lab Guide.............................................................7

STEP 2: Configure INET1 for Internet Access...........................................................................................7

A. Add and Configure a Second Network Adapter on INET1............................................................8

B. Install the Routing and Remote Access Services on INET1...........................................................8

C. Configure INET1 as a NAT Server.................................................................................................8

STEP 3: Install and Configure TMG1........................................................................................................9

A. Install the Operating System on TMG1........................................................................................9

B. Configure TCP/IP Properties on TMG1.......................................................................................10

C. Rename TMG1 and Join TMG1 to the CORP Domain.................................................................11

D. Install Forefront Threat Management Gateway (TMG) 2010 Standard Edition.........................11

E. Configure the TMG Firewall for Internet Access........................................................................13

STEP 4: Configure the Default Gateway on UAG1 and DC1...................................................................14

A. Configure the Default Gateway on UAG1..................................................................................15

B. Configure the Default Gateway on DC1.....................................................................................15

STEP 5: Configure UAG1 for Force Tunneling and Web Proxy Access to the Internet...........................16

STEP 6: Update CLIENT1 and Test Proxy Access to the Internet............................................................17

A. Update Group Policy on CLIENT1...............................................................................................17

B. Test Internet Access from CLIENT1 when Connected to Homenet............................................17

C. View CLIENT1 Internet Activity in TMG1 Log Files.....................................................................18

STEP 7: Configure UAG1 for Force Tunneling and NAT64/DNS64 Internet Access................................19

STEP 8: Update CLIENT1 and Test NAT64/DNS64 Access to the Internet..............................................20

D. Update Group Policy on CLIENT1...............................................................................................20

E. Test Internet Access from CLIENT1 when Connected to Homenet............................................20

F. View CLIENT1 Internet Activity in UAG TMG Log Files...............................................................21

STEP 9: Snapshot the Configuration......................................................................................................22

Additional Resources.................................................................................................................................22

IntroductionForefront Unified Access Gateway (UAG) 2010 SP1 RC DirectAccess provides users with the experience of being seamlessly connected to their intranet any time they have Internet access. When DirectAccess is enabled, requests for intranet resources (such as e-mail servers, shared folders, or intranet Web sites) are securely directed to the intranet, without the need for users to connect to a VPN. DirectAccess enables increased productivity for a mobile workforce by offering the same connectivity experience both inside and outside of the office. Forefront UAG SP1 RC DirectAccess extends the benefits of Windows DirectAccess across your infrastructure by enhancing availability and scalability, as well as simplifying deployments and ongoing management. For more information, see Overview of Forefront UAG DirectAccess.

IT professionals can benefit from UAG 2010 SP1 RC DirectAccess in many ways:

Improved Manageability of Remote Users. Without DirectAccess, IT professionals can only manage mobile computers when users connect to a VPN or physically enter the office. With DirectAccess, IT professionals can manage mobile computers by updating Group Policy settings and distributing software updates any time the mobile computer has Internet connectivity, even if the user is not logged on. This flexibility allows IT professionals to manage remote computers on a regular basis and ensures that mobile users stay up-to-date with security and system health policies.

Secure and Flexible Network Infrastructure. Taking advantage of technologies such as Internet Protocol version 6 (IPv6) and Internet Protocol security (IPsec), DirectAccess provides secure and flexible network infrastructure for enterprises. Below is a list of DirectAccess security and performance capabilities:

Authentication. DirectAccess authenticates the computer, enabling the computer to connect to the intranet before the user logs on. DirectAccess can also authenticate the user and supports two-factor authentication using smart cards.Encryption. DirectAccess uses IPsec to provide encryption for communications across the Internet.Access to IPv4-only intranet resources. UAG SP1 RC DirectAccess extends the value of Windows DirectAccess with NAT64/DNS64, an IPv6/IPv4 protocol transition technology that enables DirectAccess client connectivity to IPv4-only resources on the intranet.

High availability and array configuration. UAG DirectAccess extends the value of Windows DirectAccess by adding integrated support for Network Load Balancing and array configuration, which work together to enable a highly available DirectAccess deployment.

IT Simplification and Cost Reduction. By default, DirectAccess separates intranet from Internet traffic, which reduces unnecessary traffic on the intranet by sending only traffic destined for the intranet through the DirectAccess server. Optionally, IT can configure DirectAccess clients to send all traffic through the DirectAccess server, which is referred to as Force Tunneling.

1

The following figure shows a DirectAccess client on the Internet.

In this guideThis paper contains instructions for configuring and demonstrating UAG SP1 RC DirectAccess using six server computers and two client computers. The starting point for this paper is a Test Lab based on the Test Lab Guide: Demonstrate UAG SP1 RC DirectAccess. The resulting DirectAccess test lab simulates an intranet, the Internet, and a home network and demonstrates DirectAccess functionality in different Internet connection scenarios when DirectAccess Force Tunneling is enabled.

Force tunneling is used when you want all traffic, both intranet and Internet, to go through the UAG DirectAccess server. The default setting for UAG DirectAccess is split tunneling. When Force Tunneling is enabled, all traffic must go through the DirectAccess tunnels. For a DirectAccess client to reach the Internet, the client must be configured to use a web proxy server, or to use the NAT64/DNS64 service on the UAG DirectAccess server to route connections to the Internet (sometimes referred to “bouncing” the connections off the UAG DirectAccess server to the Internet). This guide provides step by step instructions that allow you to demonstrate how to use both methods of Internet access for Force Tunneling enabled DirectAccess clients.

Important:

These instructions are designed for configuring a Test Lab using the minimum number of computers. Individual computers are needed to separate the services provided on the network, and to show clearly the required functionality. This configuration is not designed to reflect best practices, nor does it reflect a required or recommended configuration for a production network.

2

The configuration, including IP address assignment and all other configuration parameters, is designed to work only on a separate Test Lab network. For more information on planning and deploying DirectAccess with Forefront UAG for your production network, please see the Forefront UAG DirectAccess design guide and the Forefront UAG DirectAccess deployment guide

Overview of the Test Lab scenarioIn this test lab scenario, Forefront UAG DirectAccess is deployed with:

One computer running Windows Server 2008 R2 Enterprise Edition (DC1), that is configured as an intranet domain controller, Domain Name System (DNS) server, Dynamic Host Configuration Protocol (DHCP) server, and an enterprise root certification authority (CA).

One intranet member server running Windows Server 2008 R2 Enterprise Edition (UAG1), that is configured as a Forefront UAG SP1 RC DirectAccess server.

One intranet member server running Windows Server 2008 R2 Enterprise Edition (APP1) that is configured as a general application server and Network Location Server.

One intranet member server running Windows Server 2003 SP2 Enterprise Edition (APP3), that is configured as a IPv4 only web and file server. This server is used to highlight the NAT64/DNS64 capabilities.

One intranet member server running Windows Server 2008 R2 Enterprise Edition (TMG1), that is configured as a web proxy server for DirectAccess clients. Threat Management Gateway 2010 will be installed on TMG1 to provide web proxy services.

One standalone server running Windows Server 2008 R2 Enterprise Edition (INET1), that is configured as an Internet DNS and DHCP server. INET1 will also be configured to provide Internet access to the live Internet.

One standalone client computer running Windows 7 (NAT1), that is configured as a network address translator (NAT) device using Internet Connection Sharing (ICS).

One roaming member client computer running Windows 7 Enterprise or Ultimate (CLIENT1) that is configured as a DirectAccess client.

The test lab consists of four subnets that simulate the following:

A home network named Homenet (192.168.137.0/24) connected to the Internet subnet by NAT1.

The Internet subnet (131.107.0.0/24).

3

An intranet subnet named Corpnet (10.0.0.0/24) separated from the Internet subnet by the Forefront UAG DirectAccess server.

A “live” network connection that provides a path to your actual Internet gateway. INET1 will be connected to the Internet subnet and the “live” network connection so you can test actual Internet access when CLIENT1 is acting as a DirectAccess client.

Computers on each subnet connect using either a physical or virtual hub or switch, as shown in the following figure.

This guide provides step by step instructions on how to build a test lab that will enable you to test the new UAG SP1 RC Force Tunneling configuration feature. Force Tunneling forces DirectAccess clients to always use the DirectAccess tunnels for any kind of communication, including both intranet and Internet communications. When you configure DirectAccess clients to use Force Tunneling, you can enable one of two methods of Internet access for the DirectAccess client.

These methods include:

Web proxy – You can configure the force tunneling DirectAccess clients on the Internet to use a web proxy on your intranet to gain Internet access. When using the web proxy option, the

4

DirectAccess clients are limited to using web proxy supported protocols when connecting to Internet resources, which typically are HTTP and HTTPS.

UAG NAT64/DNS64 – If you need your force tunneling DirectAccess clients to access Internet using protocols other than those supported by a web proxy, and you configure them to use the UAG server’s NAT64/DNS64 service to route the connections through the UAG server to the Internet. You can put a web proxy or other web content filtering device in front of the UAG DirectAccess server if you want to control site access and perform malware filtering.

Note that the default configuration for DirectAccess clients is split tunneling. When split tunneling is enabled, connections to the intranet are forwarded through the DirectAccess IPsec tunnels and connections to the Internet are made through the client’s existing Internet connection. Force Tunneling represents a departure from the default configuration.

Configuration component requirementsThe following components are required for configuring Forefront UAG DirectAccess in the test lab:

The product disc or files for Windows Server 2008 R2 Enterprise Edition.

The product disc or files for Windows Server 2003 Enterprise SP2

The product disc or files for of Windows 7 Ultimate.

Six computers or virtual machines that meet the minimum hardware requirements for Windows Server 2008 R2 Enterprise; three of these computers have two network adapters installed (UAG1, TMG1, INET1.

One computer or virtual machine that meets the minimum hardware requirements for Windows Server 2003 SP2

Two computers or virtual machines that meet the minimum hardware requirements for Windows 7 Ultimate; one of these computers has two network adapters installed (NAT1).

The product disc or a downloaded (.iso) version of Microsoft Forefront Unified Access Gateway (UAG) SP1 RC.

The product disc or downloaded (.iso) version of Microsoft Forefront Threat Management Gateway 2010 Standard Edition.

Steps for configuring the test labThe following steps describe how to configure the server and client computers, and configure the Forefront UAG DirectAccess server, in a test lab. Following these configurations you can verify DirectAccess connectivity from the Internet and Homenet subnets, and show how Force Tunneling

5

DirectAccess clients connect to the Internet using both Internet access models (web proxy and NAT64/DNS64).

Note:

You must be logged on as a member of the Domain Admins group or as a member of the Administrators group on each computer to complete the tasks described in this guide. If you cannot complete a task while you are logged on with an account that is a member of the Administrators group, try performing the task while you are logged on with an account that is a member of the Domain Admins group.

Step 1: Complete the UAG SP1 RC DirectAccess Test Lab Guide. The UAG SP1 RC Test Lab Guide provides step by step instructions on how to create a working DirectAccess solution. The steps in this Test Lab Guide build on the steps in the UAG SP1 RC Test Lab Guide.

Step 2: Configure INET1 for Internet Access. INET1 is currently configured with a single network adapter that is connected to the Internet subnet. In this step you will add a second network adapter and connect that adapter to a “live” network that provides a path to the actual Internet. You will then install and configure RRAS on INET1 so that it can act as a NAT router for live Internet connections from UAG1 and TMG1.

Step 3: Install and Configure TMG1. When force tunneling is enabled for DirectAccess clients, you can provide DirectAccess clients access to the Internet through a web proxy server. In this step you will install the operating system on TMG1 and then install Forefront Threat Management Gateway 2010 on TMG1 so that TMG1 can provide web proxy services to CLIENT1.

Step 4: Configure the Default Gateway on UAG1 and DC1. UAG1 requires a path to the Internet. In this step you will configure UAG1 to use INET1 as its default gateway to provide that path. DC1 requires a path to the Internet to provide Internet name resolution. In this step you will configure DC1 to use TMG1 as its default gateway to provide that path.

Step 5: Configure UAG1 for Force Tunneling and Web Proxy Access to the Internet. In this step you will configure UAG1 to require DirectAccess client Force Tunneling and enable Internet access for DirectAccess clients through the TMG web proxy on TMG1.

Step 6: Update CLIENT1 and Test Proxy Access to the Internet. In this step you will update the Group Policy configuration on CLIENT1 and test its ability to reach the Internet through the web proxy on TMG1.

Step 7: Configure UAG1 for Force Tunneling and NAT64/DNS64 Internet Access. In this step you will configure UAG1 to require DirectAccess client Force Tunneling and enable Internet access for DirectAccess clients through UAG1 by taking advantage of the UAG NAT64/DNS64 feature.

6

Step 8: Update CLIENT1 and Test NAT64/DNS64 Access to the Internet. In this step you will update the Group Policy configuration on CLIENT1 and test its ability to reach the Internet through the NAT64/DNS64 service on UAG1.

Step 9: Snapshot the Configuration – At the completion of the lab, snapshot the configuration so that you can later return to a working UAG DirectAccess Test Lab.

Note You will notice that there are several steps that begin with an asterisk (*). The * indicates that the step requires that you move to a computer or virtual machine that is different from the computer or virtual machine you were at when you completed the previous step within the same section.

STEP 1: Complete the UAG SP1 RC DirectAccess Test Lab GuideThis Test Lab Guide uses the UAG SP1 RC DirectAccess Test Lab Guide as a starting place. Please complete the steps in Test Lab Guide: Demonstrate UAG SP1 RC DirectAccess before proceeding with the remainder of the steps in this guide. If you have already completed the steps in the UAG SP1 RC DirectAccess Test Lab Guide and have saved a disk image or a virtual machine snapshot of the working DirectAccess configuration, then you can restore the configuration and proceed to the next step.

STEP 2: Configure INET1 for Internet AccessIn order to demonstrate a Force Tunneling DirectAccess client’s ability to access the Internet, you need a gateway to the live Internet. The Corpnet subnet, the Internet subnet, and the Homenet subnets you created when you completed the Base Configuration are isolated from the live network. In order to provide actual Internet access for CLIENT1 when acting as a DirectAccess client, you need to provide an Internet gateway that UAG1 and TMG1 can use to reach the Internet. INET1 will be this Internet gateway.

You will perform the following operations to configure INET1:

A. Add and Configure a Second Network Adapter on INET1. INET1 is currently connected to the Internet subnet. The first step is to add a second network adapter to INET1 and connect that adapter to a “live” network that provides access to the Internet.

B. Install the Routing and Remote Access Service. In this step you will install the Routing and Remote Access Service on INET1 so that it can provide NAT-based access to the Internet for UAG1 and TMG1.

C. Configure INET1 as a NAT server. In this step you will configure the Routing and Remote Access service so that INET1 can act as a NAT server.

A. Add and Configure a Second Network Adapter on INET1The first step is to install a second network adapter on INET1. This adapter must be connected to your live network and be assigned IP addressing information that enables it to reach the Internet through

7

your existing Internet gateway. If your live network is configured to provide addressing information through DHCP, you can configure this second network adapter to use DHCP. If your network doesn’t provide IP addressing information that would enable Internet access automatically, then you will need to manually configure the IP addressing information on the second adapter to provide INET1 Internet access. In both cases, make sure that the IP addressing information provided includes a DNS server that can resolve Internet host names so that you can test Internet connectivity from INET1.

After the second adapter is installed and configured, test Internet connectivity on INET1. To test Internet connectivity, open a command prompt on INET1 and enter ping www.arin.net and press ENTER. You should receive four responses to your ping request. You can then close the command prompt window.

B. Install the Routing and Remote Access Services on INET1Now that you have installed the second network adapter on INET1, you are ready to install the Routing and Remote Access service. Perform the following steps to install the Routing and Remote Access Service on INET1:

1. Log on to the INET1 computer or virtual machine as Administrator. Open Server Manager if it does not open automatically. In Server Manager, in the left pane of the console, click Roles. In the right pane of the console, click Add Roles.

2. On the Before You Begin page, click Next.

3. On the Select Server Roles page, select Network Policy and Access Services and then click Next.

4. On the Network Policy and Access Services page, click Next.

5. On the Role Services page, select Routing and Remote Access Services and then click Next.

6. On the Confirmation page, click Install.

7. On the Results page, click Close.

C. Configure INET1 as a NAT ServerYou are now ready to configure INET1 as a NAT server. Perform the following steps to configure INET1 as a NAT server:

1. At INET1, click Start, point to Administrative Tools and click Routing and Remote Access.

2. In the left pane of the Routing and Remote Access console, right click on INET1 and click Configure and Enable Routing and Remote Access.

3. On the Welcome to the Routing and Remote Access Server Setup Wizard page, click Next.

4. On the Configuration page, select the Network address translation (NAT) option and click Next.

8

5. On the NAT Internet Connection page, confirm that the Use this public interface to connect to the Internet is selected. From the Network Interfaces list, select the adapter that represents the interface connected to the live network. Click Next.

6. On the Completing the Routing and Remote Access Server Setup Wizard, click Finish.

7. Close the Routing and Remote Access console.

STEP 3: Install and Configure TMG1When Force Tunneling is enabled for DirectAccess clients, they cannot access the Internet the Internet directly as split tunneling is disabled. There are two methods available that provide DirectAccess clients Internet access when Force Tunneling is enabled: Internet access through a web proxy device, or Internet access through the UAG DirectAccess server’s NAT64/DNS64 service. When Internet access is enabled through a web proxy, only HTTP and HTTPS Internet access is enabled.

In this step you will perform the following procedures:

A. Install the Operating System on TMG1. TMG1 is a new computer that is in first introduced in this Test Lab Guide. There you need to start by installing the operating system on the TMG1 computer or virtual machine. TMG1 must have two network adapters installed prior to installing the operating system.

B. Configure TCP/IP Properties on TMG1. After installation of the operating system is complete, the next step is to configure the IP addressing settings on the internal and external interfaces of TMG1.

C. Rename TMG1 and Join TMG1 to the CORP Domain. As a security best practice, the TMG firewall should be configured as a domain member. In this step you will rename the computer or virtual machine to TMG1 and join it to the CORP domain.

D. Install Forefront Threat Management Gateway (TMG) 2010 Standard Edition. After the operating system is installed and IP addressing is assigned, and the machine renamed and joined to the domain, the next step is to install the Threat Management Gateway 2010 software.

E. Configure the TMG Firewall for Internet Access. By default, the TMG firewall does not allow traffic to pass through it. In this step you will configure the TMG firewall to allow Internet traffic outbound.

A. Install the Operating System on TMG1Perform the following steps to install the operating system on the TMG1 computer or virtual machine:

1. Start the installation of Windows Server 2008 R2.

2. Follow the instructions to complete the installation, specifying Windows Server 2008 R2 Enterprise Edition (full installation) and a strong password for the local Administrator account. Log on using the local Administrator account.

9

3. Connect TMG1 to a network that has Internet access and run Windows Update to install the latest updates for Windows Server 2008 R2.

4. After the updates installation is complete, connect one network adapter to the Corpnet subnet and the other to the Internet subnet.

B. Configure TCP/IP Properties on TMG1Perform the following steps to configure the TCP/IP Properties on the adapters installed on TMG1:

1. Log on to the TMG1 computer or virtual machine as Administrator. At the TMG1 computer or virtual machine, in Initial Configuration Tasks, click Configure networking.

2. In Network Connections, right click the network connection that is connected to the Corpnet subnet, and then click Rename.

3. Enter Corpnet and then press ENTER.

4. Right click the Corpnet interface and click Properties.

5. Click Internet Protocol Version 4 (TCP/IPv4) and then click Properties.

6. Select Use the following IP address. In IP address, enter 10.0.0.10. In Subnet mask, enter 255.255.255.0.

7. Select Use the following DNS server addresses. In the Preferred DNS server, enter 10.0.0.1.

8. Click the Advanced button and then click the DNS tab.

9. In DNS suffix for this connection, enter corp.contoso.com and click OK twice, and then click Close.

10. In the Network Connections window, right click the network connection that is connected to the Internet subnet and click Rename.

11. Enter Internet and press ENTER.

12. Right click Internet and click Properties.

13. Click Internet Protocol Version 4 (TCP/IPv4) and click Properties.

14. Confirm that obtain an IP address automatically is selected. Then select the use the following DNS server addresses option. In the Preferred DNS server text box, enter 10.0.0.1. Click OK and then click Close.

15. Close the Network Connections window.

10

C. Rename TMG1 and Join TMG1 to the CORP DomainPerform the following steps to rename the TMG1 computer or virtual machine and join it to the CORP domain:

1. At the TMG1 computer or virtual machine, in the Initial Configuration Tasks window, click Provide computer name and domain.

2. In the System Properties dialog box, on the Computer Name tab, click the Change button.

3. In the Computer Name/Domain Change dialog box, in the Computer name text box, enter TMG1. In the Member of frame, select the Domain option and enter corp.contoso.com in the text box. Click OK.

4. In the Windows Security dialog box, enter User1 in the User name text box, and then enter User1’s password in the Password text box. Click OK.

5. In the Computer Name/Domain Changes dialog box that welcomes you to the corp.contoso.com domain, click OK.

6. In the Computer Name/Domain Changes dialog box that informs you that you must restart your computer, click OK.

7. In the System Properties dialog box, click Close.

8. In the Microsoft Windows dialog box, click Restart Now.

9. Log on as CORP\User1.

D. Install Forefront Threat Management Gateway (TMG) 2010 Standard EditionTMG1 will act as a web proxy server to support Internet access for Force Tunneling enabled DirectAccess clients. Perform the following steps to install Threat Management Gateway (TMG) 2010, which will provide web proxy services to CLIENT1:

1. At the TMG1 computer or virtual machine, insert the Threat Management Gateway 2010 Standard Edition DVD into the DVD tray or mount the .iso file into the virtual machine’s virtual DVD drive.

2. In the AutoPlay dialog box, click Run Splash.hta.

3. On the Forefront Threat Management Gateway 2010 Standard splash page, click Run Preparation Tool. Click Yes in the User Account Control dialog box.

4. On the Welcome to the Preparation Tool for Microsoft Forefront Threat Management Gateway (TMG) page, click Next.

11

5. On the License Agreement page, put a checkmark in the I accept the terms of the License Agreements checkbox and click Next.

6. On the Installation Type page, select the Forefront TMG services and Management option and click Next.

7. On the Preparation Complete page, confirm that there is a checkmark in the Launch Forefront TMG Installation Wizard checkbox and click Finish. In the User Account Control dialog box, click Yes.

8. On the Welcome to the Installation Wizard for Forefront TMG Standard page, click Next.

9. On the License Agreement page, select I accept the terms in the license agreement option and click Next.

10. On the Customer Information page, click Next.

11. On the Installation Path page, click Next.

12. On the Define Internal Network page, click Add. In the Addresses dialog box, click Add Adapter. In the Select Network Adapters dialog box, put a checkmark in the Corpnet checkbox and then click OK. In the Addresses dialog box, click OK.

13. On the Define Internal Network page, confirm that in the Internal Network Address Ranges (from-to) section that says 10.0.0.0-10.0.0.255. Click Next.

14. On the Services Warning page, click Next.

15. On the Ready to Install the Program page, click Install.

16. On the Installation Wizard Completed page, put a checkmark in the Launch Forefront TMG Management when the wizard closes checkbox and click Finish.

17. Internet Explorer opens to display the Protect the Forefront TMG Computer page. On the Welcome to Internet Explorer 8 page, click Next. On the Turn on Suggested Sites page, select No, don’t turn on and click Next. On the Choose your settings page, select use express settings and click Finish. Close the Internet Explorer Window.

E. Configure the TMG Firewall for Internet AccessBy default, the TMG firewall does not pass any traffic. In this step you will configure the TMG firewall with important initial configuration settings and then create a firewall rule that allows outbound traffic. Perform the following steps to configure the firewall and create the firewall rule:

1. In the Getting Started Wizard dialog box, click Configure network settings.

2. On the Welcome to the Network Setup Wizard page, click Next.12

3. On the Network Template Selection page, confirm that Edge firewall is selected and click Next.

4. On the Local Area Network (LAN) Settings page, from the Network adapter connected to the LAN drop down list, select Corpnet. Click Next.

5. On the Internet Settings page, confirm that Internet appears in the Network adapter connected to the Internet drop down list. Click Next.

6. On the Completing the Network Setup Wizard page, click Finish.

7. In the Getting Started Wizard dialog box, click Configure System Settings.

8. On the Welcome to the System Configuration Wizard page, click Next.

9. On the Host Identification page, click Next.

10. On the Completing the System Configuration Wizard page, click Finish.

11. In the Getting Started Wizard dialog box, click Define deployment options.

12. On the Welcome to the Deployment Wizard page, click Next.

13. On the Microsoft Update Setup page, select Use the Microsoft Update service to check for updates (recommended) option and click Next.

14. On the Forefront TMG Protection Features Settings page, click Next.

15. On the NIS Signature Update Settings page, click Next.

16. On the Customer Feedback page, click Next.

17. On the Microsoft Telemetry Reporting Service page, select Advanced and click Next.

18. On the Completing the Deployment Wizard page, click Finish. Note: if the wizard appears to hang up and does not respond after several minutes, close the wizard. This will also close the TMG console. Restart the wizard by opening the TMG console again from the Start menu. You will see the Getting Started Wizard dialog box again. Click Define deployment options and run through the wizard again. When you complete the wizard, it will take you to the Getting Started Wizard dialog box again, and there will be a green checkmark to the left of each of the steps. Remove the checkmark from the Run the Web Access checkbox and click Close.

19. In the left pane of the Forefront TMG console, expand Forefront TMG (TMG1) and then click Firewall Policy.

20. In the right pane of the console, click the Tasks tab. On the Tasks tab, click Create Access Rule.

13

21. On the Welcome to the New Access Rule Wizard page, in the Access rule name text box, enter All Open. Click Next.

22. On the Rule Action page, select Allow and click Next.

23. On the Protocols page, from the This rule applies to drop down list, select All outbound traffic. Click Next.

24. On the Malware Inspection page, select Enable malware inspection for this rule and click Next.

25. On the Access Rule Sources page, click Add. In the Add Network Entities dialog box, click Networks, then double click Internal. Click Close. Click Next.

26. On the Access Rule Destinations page, click Add. In the Add Network Entities dialog box, click Networks, then double click External. Click Close. Click Next.

27. On the User Sets page, click Next.

28. On the Completing the New Access Rule Wizard page, click Finish.

29. In the middle pane of the console, click the Apply button.

30. In the Configuration Change Description dialog box, click Apply.

31. In the Saving Configuration Changes dialog box, click OK.

STEP 4: Configure the Default Gateway on UAG1 and DC1When DirectAccess clients are configured for Internet access using the UAG NAT64/DNS64 services, the UAG server must be able to forward the connections to the Internet. This requires that UAG1 be configured with a default gateway that provides a route to the Internet. The default gateway for UAG1 is the Internet subnet interface on INET1. DC1 needs a gateway to the Internet in order to resolve Internet host names for the UAG server’s DNS64 service and for the web proxy service on TMG1. DC1 will use TMG1 as its gateway to the Internet.

The following operations are performed to configure UAG1 and DC1:

A. Configure the Default Gateway on UAG1. In this step you will configure UAG1 to use the Internet subnet interface on INET1 as its default gateway.

B. Configure the Default Gateway on DC1. In this step you will configure DC1 to use the Corpnet subnet interface on TMG1 as its default gateway.

A. Configure the Default Gateway on UAG1Perform the following steps to configure the default gateway on UAG1:

1. At the UAG1 computer or virtual machine, click Start and enter View network connections in the Search box and press ENTER.

14

2. In the Network Connections window, right click on Internet and click Properties.

3. In the Internet Properties dialog box, click Internet Protocol Version 4 (TCP/IPv4) and click Properties.

4. In the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box, in the Default gateway text box, enter 131.107.0.1. Click OK, then click Close.

5. Close the Network Connections window.

B. Configure the Default Gateway on DC1Perform the following steps to configure the default gateway on DC1:

1. Log on to the DC1 computer or virtual machine as User1. Click Start and enter View network connections in the Search box and press ENTER.

2. In the Network Connections window, right click on Local Area Connection and click Properties.

3. In the Internet Properties dialog box, click Internet Protocol Version 4 (TCP/IPv4) and click Properties.

4. In the Internet Protocol Version 4 (TCP/IPv4) Properties dialog box, in the Default gateway text box, enter 10.0.0.10. Click OK, then click Close.

5. Close the Network Connections window.

6. Open a command prompt window. In the command prompt window, enter nslookup www.microsoft.com and press ENTER. You should see the IP addresses that resolve to this name, as well as several aliases. If the request times out, repeat the nslookup command. Close the command prompt window.

7. *Move to the UAG1 computer or virtual machine. Open a command prompt and enter nslookup www.microsoft.com and press ENTER. You should see the IP address and name that resolves to this name, as well as several aliases. Note that the record is returned as non-authoritative, since it was retrieved from the DNS cache on DC1. Close the command prompt window.

STEP 5: Configure UAG1 for Force Tunneling and Web Proxy Access to the InternetWhen DirectAccess clients are configured to use Force Tunneling, they are not able to reach the Internet except through the DirectAccess tunnel. There are two methods available for providing the Force Tunneling DirectAccess client access to the Internet: web proxy and NAT64/DNS64. In this step you will configure Force Tunneling on the UAG DirectAccess server so that Internet access is provided by the web proxy on TMG1. Perform the following steps to configure Force Tunneling and web proxy Internet access:

15

1. At the UAG1 computer or virtual machine, click Start and then click All Programs. Click Microsoft Forefront UAG and then click Forefront UAG Management. Click OK in the User Account Control dialog box.

2. In the left pane of the Microsoft Forefront Unified Access Gateway Management console, click DirectAccess.

3. In the right pane of the console, In the Step 2 DirectAccess Server section, click the Force Tunneling link.

4. In the Force Tunneling Configuration wizard, on the Connectivity Method page, select Use force tunneling. Send Internet requests from DirectAccess clients through the UAG DirectAccess server. Click Next.

5. On the Force Tunneling page, select Route requests directly to a corporate Web Proxy server. In the Server name text box, enter TMG1.corp.contoso.com. In the Port text box, enter 8080. Click the Validate Connectivity button. You should see a green checkmark and Validation successful. Click Finish.

6. Click the Apply Policy button at the bottom of the right pane.

7. On the Forefront UAG DirectAccess Configuration Review page, click Apply Now.

8. In the DirectAccess Policy Configuration dialog box, click OK after you see Script run completed with no error or warnings.

9. On the Forefront UAG DirectAccess Configuration Review page, click Close.

10. Open an elevated command prompt. In the command prompt window, enter gpupdate /force and press ENTER. Wait for the command to complete and then close the command prompt window.

11. Click the Activate button at the bottom of the right pane.

12. On the Activate Configuration page, click Activate.

13. On the Activate Configuration page, click Finish.

STEP 6: Update CLIENT1 and Test Proxy Access to the InternetIn this step you will update the Group Policy settings on CLIENT1 so that it uses Force Tunneling when acting as a DirectAccess client. You will then move CLIENT1 to the Homenet subnet to test the force tunneling configuration. After CLIENT1 connects to the Internet, you will review the log file entries on TMG1 to prove that the Internet connection was make through the web proxy.

The following operations configure CLIENT1:

16

A. Update Group Policy on CLIENT1. CLIENT1 needs updated Group Policy to enable Force Tunneling. In this step you will update Group Policy on CLIENT1.

B. Test Internet Access from CLIENT1 when Connected to Homenet. In this step you will move CLIENT1 to the Homenet subnet and test DirectAccess and Internet connectivity using Force Tunneling.

C. View CLIENT1 Internet Activity in TMG1 Log Files. In this step you will review the log file on TMG1 to confirm that CLIENT1 accessed the Internet through the TMG1 web proxy.

A. Update Group Policy on CLIENT1Perform the following steps to update Group Policy on CLIENT1:

1. Connect CLIENT1 to the Corpnet subnet and log on to CLIENT1 as User1. At the CLIENT1 computer or virtual machine, open an elevated command prompt. In the command prompt window, enter gpupdate /force and press ENTER. You will notice that User Policy will update correctly, but you will get an error that says machine policy cannot be updated. This is an expected error.

2. In the command prompt window, enter netsh namespace show policy and press ENTER. You should see an entry Settings for . That section should have a line for DirectAccess (Proxy Settings): TMG1.corp.contoso.com:8080. This demonstrates that the new Group Policy settings were applied to CLIENT1. This entry tells CLIENT1 to connect to all sites over the DirectAccess tunnel using the proxy, with the exception of the other entries in the NRPT.

3. Close the command prompt window.

B. Test Internet Access from CLIENT1 when Connected to HomenetIn this step, you will connect CLIENT1 to the Homenet subnet and test Internet access across the DirectAccess tunnel through the web proxy on TMG1. Perform the following steps to test Internet access from the CLIENT1 DirectAccess client:

1. Move CLIENT1 from the Corpnet subnet to the Homenet subnet. Open an elevated command prompt. In the command prompt window enter ipconfig /all. You should see an entry for Tunnel adapter iphttpsinterface and an IPv6 address associated with that interface. CLIENT1 does not use Teredo because Force Tunneling requires the DirectAccess client to use IP-HTTPS.

2. In the command prompt window, enter netsh interface httpstunnel show interfaces and press ENTER. You should see that the Interface Status is IPHTTPS interface active.

3. In the command prompt window, enter ping app1 and press ENTER. You should see four responses from APP1.

4. In the command prompt window, enter net view \\APP1 and press ENTER. You should see a list of shares. This indicates that User1 was able to authenticate with the UAG DirectAccess server and user Kerberos authentication.

17

5. In the command prompt window, enter ping www.microsoft.com. You will receive an error that the host could not be found. The reason for this is that CLIENT1 only has access to the web proxy for names outside of the corp.contoso.com domain. The web proxy resolves names on behalf of the client, which enables the client to connect to web sites through the web proxy. Close the command prompt window.

6. Open Internet Explorer. In the address bar, enter www.microsoft.com and press ENTER. You should see the home page on the www.microsoft.com web site. Click several links on the page. Try to visit other web sites you are interested in. You should be able to connect to all web sites. Close the Internet Explorer window.

C. View CLIENT1 Internet Activity in TMG1 Log FilesTo demonstrate that the web connections were made over the web proxy on TMG1, we will look at the log file on the TMG1 computer or virtual machine. Perform the following steps to view the log file:

1. *Move to the TMG1 computer or virtual machine. Click Start and click All Programs. Click Microsoft Forefront TMG and click Forefront TMG Management. In the User Account Control dialog box, click Yes.

2. In the Forefront TMG console, in the left pane, click the Logs & Reports node. In the right pane of the console, click the Tasks tab. Click the Edit Filter link.

3. In the Edit Filter dialog box, click the Log Time entry. In the Condition drop down list, select Last Hour. Click the Update button.

4. From the Filter by drop down list, select Client IP. From the Condition drop down list, select Equals. In the Value text box, enter 10.0.0.2. When DirectAccess clients connect to an IPv4 proxy like TMG, NAT64/DNS64 on the UAG DirectAccess server is used, and all connections from the DirectAccess clients will appear to source from the internal IPv4 address on the UAG DirectAccess server. Click Add To List. Click Start Query.

5. In the lower left side of the TMG console, wait until it says (Query is done). After the query is done, look in the Destination IP column and click on lines that include a public IP address. After clicking on one of those lines, look in the lower pane that contains details of the connection. On the Request line you will see the URL that CLIENT1 connected to over the TMG web proxy service. This demonstrates that CLIENT1 used the TMG web proxy to reach the Internet and did not connect directly to any Internet resources because when Force Tunneling is enabled, split tunnel is disabled. Click on several of these lines to see various URLs that have been visited.

6. Close the Forefront TMG console.

18

STEP 7: Configure UAG1 for Force Tunneling and NAT64/DNS64 Internet AccessThe second method DirectAccess clients configured for Force Tunneling can use to access the Internet is by using the NAT64/DNS64 service. When you use the UAG NAT64/DNS64 service, the connection is routed to the Internet by the UAG DirectAccess server. Perform the following steps to configure Force Tunneling to enable DirectAccess client access to the Internet through the NAT64/DNS64 services:

1. *Go to the UAG1 computer or virtual machine. Confirm that the UAG console is open. If it is not open, open the UAG console from the Start menu. Click on the DirectAccess node in the left pane of the console.

2. In the Step 2 DirectAccess Server section in the right pane, click Force Tunnel (On).

3. In the Force Tunneling Configuration wizard, on the Connectivity Method page, confirm that the Use force tunneling. Send Internet requests from DirectAccess clients through the UAG DirectAccess server option is selected. Click Next.

4. On the Force Tunneling page, select Resolve and route requests using UAG DirectAccess DNS64 and NAT64. Click Validate Connectivity. You should see a green checkmark with the text Validation successful next to it. Click Finish.

5. At the bottom of the right pane of the console, click Apply Policy.

6. On the Forefront UAG DirectAccess Configuration Review page, click Apply Now.

7. In the DirectAccess Policy Configuration dialog box, click OK after you see Script run completed with no errors or warnings.

8. On the Forefront UAG DirectAccess Configuration Review page, click Close.

9. Open and elevated command prompt. In the command prompt window, enter gpupdate /force and press ENTER. Wait for the command to complete and then close the command prompt window.

10. At the bottom of the right pane of the console, click Activate.

11. In the Activate Configuration dialog box, click Next.

12. Click Finish in the Activate Configuration dialog box.

STEP 8: Update CLIENT1 and Test NAT64/DNS64 Access to the InternetIn this step you will update the Group Policy settings on CLIENT1 so that it uses Force Tunneling when acting as a DirectAccess client. After CLIENT1 connects to the Internet, you will review the log file entries on TMG1 to prove that the Internet connection was make through the web proxy.

19

The following operations configure CLIENT1:

A. Update Group Policy on CLIENT1. CLIENT1 is currently connected to the Homenet subnet. You will update Group Policy over the DirectAccess connection.

B. Test Internet Access from CLIENT1 when Connected to Homenet. In this step you will test Internet access from CLIENT1 through the UAG NAT64/DNS64 services.

C. View CLIENT1 Internet Activity in UAG1 TMG Log Files. In this step you will view the TMG log files on UAG1 to demonstrate that Internet connectivity is provided through UAG1.

D. Update Group Policy on CLIENT1Perform the following steps to update Group Policy on CLIENT1:

1. While still located on the Homenet subnet, at the CLIENT1 computer or virtual machine, open an elevated command prompt. In the command prompt window, enter gpupdate /force and press ENTER. You will notice that User Policy will update correctly, but you will get an error that says machine policy cannot be updated. This is an expected error.

2. In the command prompt window, enter netsh namespace show policy and press ENTER. You should see an entry Settings for . That section should have a line for DirectAccess (Proxy Settings): Bypass Proxy. This demonstrates that the new Group Policy settings were applied to CLIENT1. This entry tells CLIENT1 to connect to all sites over the DirectAccess tunnel using the UAG DirectAccess server.

3. Close the command prompt window.

E. Test Internet Access from CLIENT1 when Connected to HomenetPerform the following steps to test Internet access from CLIENT1 to the Internet:

1. Move CLIENT1 from the Corpnet subnet to the Homenet subnet. Open an elevated command prompt. In the command prompt window enter ipconfig /all. You should see an entry for Tunnel adapter iphttpsinterface and an IPv6 address associated with that interface. CLIENT1 does not use Teredo because Force Tunneling requires the DirectAccess client to use IP-HTTPS.

2. In the command prompt window, enter netsh interface httpstunnel show interfaces and press ENTER. You should see that the Interface Status is IPHTTPS interface active.

3. In the command prompt window, enter ping app1 and press ENTER. You should see four responses from APP1.

4. In the command prompt window, enter net view \\APP1 and press ENTER. You should see a list of shares. This indicates that User1 was able to authenticate with the UAG DirectAccess server and user Kerberos authentication because connections to APP1 must be made through the intranet tunnel.

20

5. In the command prompt window, enter ping www.microsoft.com and press ENTER. You will see that the UAG DirectAccess server resolves the name for the client by generating a false IPv6 address, but the ping attempts fail because www.microsoft.com servers do not allow ping requests. In the command prompt window, enter ping www.facebook.com and press ENTER. You should see four responses from an IPv6 address. Note that this is not the actual IPv6 address of the site; it is the IPv6 address generated by the NAT64 service on the UAG DirectAccess server. Close the command prompt window.

6. Open Internet Explorer. In the address bar, enter www.microsoft.com and press ENTER. You should see the home page on the www.microsoft.com web site. Click several links on the page. Try to visit other web sites you are interested in. You should be able to connect to all web sites. Close Internet Explorer.

F. View CLIENT1 Internet Activity in UAG TMG Log FilesPerform the following steps to view the TMG log file on the UAG1 machine:

1. *Move to the UAG1 computer or virtual machine. Click Start and click All Programs. Click Microsoft Forefront TMG and click Forefront TMG Management. In the User Account Control dialog box, click Yes.

2. In the Forefront TMG console, in the left pane, click the Logs & Reports node. In the right pane of the console, click the Tasks tab. Click the Edit Filter link.

3. In the Edit Filter dialog box, click the Log Time entry. In the Condition drop down list, select Last Hour. Click the Update button.

4. From the Filter by drop down list, select Rule. From the Condition drop down list, select Equals. In the Value drop down list, select DirectAccess Allow NATPT. Click Add To List. Click Start Query.

5. In the lower left side of the TMG console, wait until it says (Query is done). After the query is done, scroll through the list of entries. In the Protocol column you’ll see the protocols you used to access the Internet sites. In the Client IP column, you’ll see the IP-HTTPS IPv6 address assigned to the CLIENT1. You will some entries in the Protocol column for BranchCache – Retrieval Protocol. These entries actually represent the HTTP connections CLIENT1 made through the UAG1 NAT64/DNS64 services.

8. Close the Forefront TMG console

STEP 9: Snapshot the ConfigurationThis completes the DirectAccess test lab. To save this configuration so that you can quickly return to a working DirectAccess configuration from which you can test other DirectAccess modular TLGs, TLG extensions, or for your own experimentation and learning, do the following:

21

1. On all physical computers or virtual machines in the test lab, close all windows and then perform a graceful shutdown.

2. If your lab is based on virtual machines, save a snapshot of each virtual machine and name the snapshots TLG UAG DirectAccess SP1RC FT. If your lab uses physical computers, create disk images to save the DirectAccess test lab configuration.

Additional ResourcesFor procedures to configure the Test Lab Guide: Demonstrate UAG SP1 RC DirectAccess on which this document is based, see the Test Lab Guide: Demonstrate UAG SP1 RC DirectAccess.

For the design and configuration of your pilot or production deployment of DirectAccess, see the Forefront UAG DirectAccess design guide and the Forefront UAG DirectAccess deployment guide.

For information about troubleshooting DirectAccess, see the DirectAccess Troubleshooting Guide.

For information about troubleshooting DirectAccess in a Test Lab, see the Test Lab Guide: Troubleshoot UAG DirectAccess.

For a comprehensive list of UAG DirectAccess Test Lab Guides, see the TechNet wiki Test Lab Guide clearinghouse at Test Lab Guides.

For more information about DirectAccess, see the DirectAccess Getting Started Web page and the DirectAccess TechNet Web page.

22