DirectAccess, also known as Unified Remote Access, is a VPN technology that provides

intranet An intranet is a computer network for sharing information, easier communication, collaboration tools, operational systems, and other computing services within an organization, usually to the exclusion of access by outsiders. The term is used in ...

connectivity to client computers when they are connected to the Internet. Unlike many traditional VPN connections, which must be initiated and terminated by explicit user action, DirectAccess connections are designed to connect automatically as soon as the computer connects to the Internet. DirectAccess was introduced in

Windows Server 2008 R2 Windows Server 2008 R2, codenamed "Windows Server 7" or "Windows Server 2008 Release 2", is the eighth major version of the Windows NT operating system produced by Microsoft to be released under the Windows Server brand name. It was release ...

, providing this service to

Windows 7 Windows 7 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on July 22, 2009, and became generally available on October 22, ...

and

Windows 8 Windows 8 is a major release of the Windows NT operating system developed by Microsoft. It was Software release life cycle#Release to manufacturing (RTM), released to manufacturing on August 1, 2012, made available for download via Microsoft ...

"Enterprise" edition clients. In 2010, Microsoft Forefront Unified Access Gateway (UAG) was released, which simplifies the deployment of DirectAccess for Windows 2008 R2, and includes additional components that make it easier to integrate without the need to deploy

IPv6 Internet Protocol version 6 (IPv6) is the most recent version of the Internet Protocol (IP), the communication protocol, communications protocol that provides an identification and location system for computers on networks and routes traffic ...

on the network, and with a dedicated user interface for the configuration and monitoring. Some requirements and limitations that were part of the design of DirectAccess with Windows Server 2008 R2 and UAG have been changed (see requirements below). While DirectAccess is based on Microsoft technology, third-party solutions exist for accessing internal

UNIX Unix (, ; trademarked as UNIX) is a family of multitasking, multi-user computer operating systems that derive from the original AT&T Unix, whose development started in 1969 at the Bell Labs research center by Ken Thompson, Dennis Ritchie, a ...

and

Linux Linux ( ) is a family of open source Unix-like operating systems based on the Linux kernel, an kernel (operating system), operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically package manager, pac ...

servers through DirectAccess. With

Windows Server 2012 Windows Server 2012, codenamed "Windows Server 8", is the ninth major version of the Windows NT operating system produced by Microsoft to be released under the Windows Server brand name. It is the server version of Windows based on Windows ...

, DirectAccess is fully integrated into the operating system, providing a user interface to configure and native IPv6 and IPv4 support.

Technology

DirectAccess establishes IPsec tunnels from the client to the DirectAccess server, and uses

to reach intranet resources or other DirectAccess clients. This technology encapsulates the IPv6 traffic over

IPv4 Internet Protocol version 4 (IPv4) is the first version of the Internet Protocol (IP) as a standalone specification. It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks. ...

to be able to reach the intranet over the Internet, which still ( mostly) relies on IPv4 traffic. All traffic to the intranet is encrypted using IPsec and encapsulated in IPv4 packets (if a native IPv6 connection cannot be established), which means that in most cases, no configuration of firewalls or proxies should be required. A DirectAccess client can use one of several tunneling technologies, depending on the configuration of the network the client is connected to. The client can use 6to4, Teredo tunneling, or IP-HTTPS, provided the server is configured correctly to be able to use them. For example, a client that is connected to the Internet directly will use 6to4, but if it is inside a NATed network, it will use Teredo instead. In addition, Windows Server 2012 provides two backward compatibility services DNS64 and NAT64, which allows DirectAccess clients to communicate with servers inside the corporate network even if those servers are only capable of IPv4 networking. Due to the globally routable nature of IPv6, computers on the corporate network can also initiate a connection to DirectAccess clients, which allows them to remotely manage (Manage Out) these clients at any time.

Benefits

DirectAccess can be deployed for multiple sites. It allows for a secure encrypted VPN. This is controlled through Group Policies which allows the administrator to maintain a secure network.

Requirements

DirectAccess With Windows Server 2008 R2 or UAG requires: * One or more DirectAccess servers running

with two network adapters: one that is connected directly to the Internet, and a second that is connected to the intranet. * On the DirectAccess server, at least two consecutive, public IPv4 addresses assigned to the network adapter that is connected to the Internet. * DirectAccess clients running

"Ultimate" or "Enterprise" editions or

"Enterprise" edition clients * At least one

domain controller A domain controller (DC) is a Server (computing), server that responds to security authentication requests within a computer network domain. It is a Network (computing), network server that is responsible for allowing Host (network), host access to ...

and

Domain Name System The Domain Name System (DNS) is a hierarchical and distributed name service that provides a naming system for computers, services, and other resources on the Internet or other Internet Protocol (IP) networks. It associates various information ...

(DNS) server running Windows Server 2008 SP2 or Windows Server 2008 R2. *

Public key infrastructure A public key infrastructure (PKI) is a set of roles, policies, hardware, software and procedures needed to create, manage, distribute, use, store and revoke digital certificates and manage public-key encryption. The purpose of a PKI is to fac ...

(PKI) to issue computer certificates. DirectAccess With Windows Server 2012 requires: * One or more DirectAccess servers running

with one or more network adapters. * At least one

and

(DNS) server running Windows Server 2008 SP2 or Windows Server 2008 R2. * DirectAccess clients running

"Ultimate" or "Enterprise" editions or

"Enterprise" edition clients * A Public Key Infrastructure is not required for Windows 8 Clients. Smart card certificates, and health certificates for

Network Access Protection Network Access Protection (NAP) is a Microsoft technology for controlling network access of a computer, based on its health. It was first included in Windows Vista and Windows Server 2008 and backported to Windows XP Service Pack 3. With NAP, sy ...

may be used along with PKI.

References

External links

Microsoft's DirectAccess in Windows Server 2012

Microsoft's DirectAccess in Windows Server 2008 R2

MS-IPHTTPS on MSDN
includes PDF with specification.
Blogger's posting on DirectAccess

Richard Hicks' DirectAccess Blog

Differences between UAG and native 2008 R2 DirectAccess
{{DEFAULTSORT:Directaccess Network protocols Virtual private networks IPv6