Direct Access is a technology that allows devices to connect seamlessly to a corporate network over an IPsec VPN connection. It uses IPv6 and IPsec for an always-on VPN and extends the corporate network to remote PCs and users. Key components include Windows Server 2012 R2, Windows 7/8/10 clients, certificates, Network Location Server, DNS64/NAT64, and firewall settings. Deployment requires enabling IPv6 internally, setting up a Network Location Server, configuring client groups and firewall settings, and enrolling certificates to enable the always-on Direct Access connection from remote devices to the corporate network over the public Internet.

1. Microsoft Direct Access
Microsoft Server 2012 R2
HAIRER Martin

2. WHAT IS DIRECT ACCESS?
THE CONCEPT
COMPONENTS
DEPLOYMENT

3. MS Direct Access
Direct Access is the ultimate VPN solution that is
one of the enablers for the New Way of Work
Direct Access is always ON
source: microsoft.com

4. MS Direct Access
Seamless and Transparent Corporate Network
connectivity for Managed Clients
Remote Access
source: microsoft.com

5. differences to VPN
The DirectAccess
client is always
managed.
The DirectAccess
client is always
serviceable.
The DirectAccess
client uses two
separate tunnels
to connect.

6. WHAT IS DIRECT ACCESS?
THE CONCEPT
COMPONENTS
DEPLOYMENT

7. DA Overview
Windows Clients
Corporate Network
Direct AccessVPN
Public Network
osX - Linux Clients
iOS - Android

8. Bi-Directional
Windows 7+
Corporate NetworkPublic Network
Management
Data/Application

9. CONCEPT
DirectAccess extends the network to the
remote computer and user
based on
End to End IPv6
source: microsoft.com

10. WHAT IS DIRECT ACCESS?
THE CONCEPT
COMPONENTS
DEPLOYMENT

11. COMPONENTS
Windows
Server 2012 R2
Windows 7/8/10
(domain joined)
IPv6 and IPsec
Active Directory
and
Group Policy

12. DA COMPONENTS
Certificates
(PKI)
Network Location
Server
DNS64/NAT64
Name Resolution
Policy Table
Windows Firewall
Advanced Security

13. WHAT IS DIRECT ACCESS?
THE CONCEPT
COMPONENTS
DEPLOYMENT

14. DEPLOYMENT
Public Network Corporate Network
IPv4 Network
DNS64
NAT64
6to4 tunnel
Teredo tunnel
IPHTTTPS tunnel
IPv4
ISATAP
Native IPv6

15. DEPLOYMENT
Enable
IPv6
internally
Network
Location
Server
Client
Groups
Firewall
Settings
on Clients
Certificate
Auto
Enrollment
Direct
Access
Server

16. DEMO

17. source: https://directaccessguide.files.wordpress.com/2014/03/setupwizard.jpg

18. source: https://robertpearman.files.wordpress.com/2012/10/da21_thumb.png?w=644&h=464

19. source: http://tr1.cbsistatic.com/hub/i/2015/05/07/afbeaa30-f4aa-11e4-940f-14feb5cc3d2a/fig-e-ram-console.jpg

20. source: https://techontip.files.wordpress.com/2013/03/031013_1145_windows20123.png

21. source: https://msdirectaccess.files.wordpress.com/2015/01/directaccess_ad_sites_subnet_031.png

22. THX