DirectAccess, also known as Unified Remote Access, is a VPN technology that provides intranet connectivity to client computers when they are connected to the Internet. Unlike many traditional

VPN A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The be ...

connections, which must be initiated and terminated by explicit user action, DirectAccess connections are designed to connect automatically as soon as the computer connects to the Internet. DirectAccess was introduced in

Windows Server 2008 R2 Windows Server 2008 R2 is the fifth version of the Windows Server operating system produced by Microsoft and released as part of the Windows NT family of operating systems. It was released to manufacturing on July 22, 2009, and became generally ...

, providing this service to

Windows 7 Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on July 22, 2009, and became generally available on October 22, 2009. It is the successor to Windows Vista, released nearl ...

and

Windows 8 Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was released to manufacturing on August 1, 2012; it was subsequently made available for download via MSDN and TechNet on August 15, 2012, and later to ...

"Enterprise" edition clients. In 2010, Microsoft Forefront Unified Access Gateway (UAG) was released, which simplifies the deployment of DirectAccess for Windows 2008 R2, and includes additional components that make it easier to integrate without the need to deploy

IPv6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communications protocol that provides an identification and location system for computers on networks and routes traffic across the Internet. I ...

on the network, and with a dedicated user interface for the configuration and monitoring. Some requirements and limitations that were part of the design of DirectAccess with Windows Server 2008 R2 and UAG have been changed (see requirements below). While DirectAccess is based on Microsoft technology, third-party solutions exist for accessing internal

UNIX Unix (; trademarked as UNIX) is a family of multitasking, multiuser computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, a ...

and

Linux Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which i ...

servers through DirectAccess. With

Windows Server 2012 Windows Server 2012, codenamed "Windows Server 8", is the sixth version of the Windows Server operating system by Microsoft, as part of the Windows NT family of operating systems. It is the server version of Windows based on Windows 8 and succ ...

, DirectAccess is fully integrated into the operating system, providing a user interface to configure and native IPv6 and IPv4 support.

Technology

DirectAccess establishes

IPsec In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in ...

tunnels from the client to the DirectAccess server, and uses

to reach intranet resources or other DirectAccess clients. This technology encapsulates the IPv6 traffic over

IPv4 Internet Protocol version 4 (IPv4) is the fourth version of the Internet Protocol (IP). It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks. IPv4 was the first version d ...

to be able to reach the intranet over the Internet, which still ( mostly) relies on IPv4 traffic. All traffic to the intranet is encrypted using

and encapsulated in IPv4 packets (if a native IPv6 connection cannot be established), which means that in most cases, no configuration of firewalls or proxies should be required. A DirectAccess client can use one of several tunneling technologies, depending on the configuration of the network the client is connected to. The client can use

6to4 6to4 is an Internet transition mechanism for migrating from Internet Protocol version 4 (IPv4) to version 6 (IPv6) and a system that allows IPv6 packets to be transmitted over an IPv4 network (generally the IPv4 Internet) without the need to c ...

, Teredo tunneling, or IP-HTTPS, provided the server is configured correctly to be able to use them. For example, a client that is connected to the Internet directly will use 6to4, but if it is inside a

NAT Nat or NAT may refer to: Computing * Network address translation (NAT), in computer networking Organizations * National Actors Theatre, New York City, U.S. * National AIDS trust, a British charity * National Archives of Thailand * National ...

ed network, it will use Teredo instead. In addition, Windows Server 2012 provides two backward compatibility services DNS64 and

NAT64 NAT64 is an IPv6 transition mechanism that facilitates communication between IPv6 and IPv4 hosts by using a form of network address translation (NAT). The NAT64 gateway is a translator between IPv4 and IPv6 protocols, for which function it need ...

, which allows DirectAccess clients to communicate with servers inside the corporate network even if those servers are only capable of IPv4 networking. Due to the globally routable nature of IPv6, computers on the corporate network can also initiate a connection to DirectAccess clients, which allows them to remotely manage (Manage Out) these clients at any time.

Benefits

DirectAccess can be deployed for multiple sites. It allows for a secure encrypted VPN. This is controlled through Group Policies which allows the administrator to maintain a secure network.

Requirements

DirectAccess With Windows Server 2008 R2 or UAG requires: * One or more DirectAccess servers running

with two network adapters: one that is connected directly to the Internet, and a second that is connected to the intranet. * On the DirectAccess server, at least two consecutive, public IPv4 addresses assigned to the network adapter that is connected to the Internet. * DirectAccess clients running

"Ultimate" or "Enterprise" editions or

"Enterprise" edition clients * At least one

domain controller A domain controller (DC) is a server computer that responds to security authentication requests within a computer network domain. It is a network server that is responsible for allowing host access to domain resources. It authenticates users, st ...

and

Domain Name System The Domain Name System (DNS) is a hierarchical and distributed naming system for computers, services, and other resources in the Internet or other Internet Protocol (IP) networks. It associates various information with domain names assigned ...

(DNS) server running Windows Server 2008 SP2 or Windows Server 2008 R2. *

Public key infrastructure A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to facil ...

(PKI) to issue computer certificates. DirectAccess With Windows Server 2012 requires: * One or more DirectAccess servers running

with one or more network adapters. * At least one

and

(DNS) server running Windows Server 2008 SP2 or Windows Server 2008 R2. * DirectAccess clients running

"Ultimate" or "Enterprise" editions or

"Enterprise" edition clients * A Public Key Infrastructure is not required for Windows 8 Clients. Smart card certificates, and health certificates for

Network Access Protection Network Access Protection (NAP) is a Microsoft technology for controlling network access of a computer, based on its health. With NAP, system administrators of an organization can define policies for system health requirements. Examples of system h ...

may be used along with PKI.

References

External links

Microsoft's DirectAccess in Windows Server 2012

Microsoft's DirectAccess in Windows Server 2008 R2

MS-IPHTTPS on MSDN
includes PDF with specification.
Blogger's posting on DirectAccess

Richard Hicks' DirectAccess Blog

Differences between UAG and native 2008 R2 DirectAccess
{{DEFAULTSORT:Directaccess Network protocols Virtual private networks IPv6