Microsoft DirectAccess is a very cool technology when it comes to connecting to your corporate network from anywhere over the Internet in a very secure manner.

Introduction

DirectAccess was available since Server 2008R2 with very limited capabilities. Next on it came as Microsoft Unified Access Gateway (UAG).  This was an amazing technology at that time that allowed DirectAccess protected by Microsoft ISA server (Good old days).

The UAG offered core features like the DNS64 and NAT64 (Please note that DirectAccess works over IPV6). These features were important because up till now we can rarely find any corporate running all its internal network on IPV6. Later on Windows 2012R2 server as well as Windows 2016 server came with the DirectAccess role offering most of the features in UAG. As well as new ones that simplify the deployment especially for Windows 8 and Windows 10 clients.

Why do I love DirectAccess ?

1. Seamless and Always on connection. No client is needed like regular VPN deployments. All you need is corporate configured Laptop/Computer/Server (Yes DirectAccess can be implemented on your remote site servers) and Internet connection (Any public Internet). Once you are logged you are connected securely.
2. Transparent bi-directional. The DirectAccess client is connected to the corporate network as if its inside the network. It can connect to resources in the corporate and users from the corporate. For example help desk team can connect to the DirectAccess client for any troubleshooting. Also any management software like SCCM, Active Directory, WSUS……etc can still access and apply all policies on these remote DirectAccess clients.

Requirements and Server Preparation.

1. Installation and Implementation is done on Server 2016 (Latest version and updates as of July 2018). One server deployment (Single Server Site deployment)
2. Recommended deployment is to have one server with two Network cards. The first network (Internal) is connected to the internal corporate network and the second network card (External) is connected to the DMZ which is behind your corporate firewall. This is the recommended deployment which I will go through these blog series. However you can have the DirectAccess server with one NIC or on your network edge facing the Internet directly but each of these deployments has its drawbacks and its not fully secured. Again it depends whether production or lab but I highly recommend going with 2 NIC model behind the firewall.
3. Since we are behind the Firewall then we need to create a Destination NAT rule to forward DirectAccess traffic (Inbound 443) to the DirectAccess External NIC. As we are behind the Firewall we will be using IP-HTTPS Not Teredo or direct IPv4  (IPV6 transition technologies to IPV4)
4. Active Directory should be running DFSR
5. Create an OU in your Active Directory and give it a convenient name. All DirectAccess computers will be under this OU.
6. Create a Security Group for Microsoft DirectAccess clients and give it any convenient name.
7. DirectAccess can run with self signed certificate if you are running Windows 8 and 10 clients only (which is our case). However for more secure deployment you will need internal PKI to generate client certificates and you need public SSL certificate for your DirectAccess server. You can create one and name it “Directaccess.domain.com”. In your external DNS make sure to assign a public IP to this name, this IP will be used to create the Destination NAT from it to the server External NIC (DMZ) as we mentioned above. Some Key factors for the internal certificates that will be assigned to your clients are shown below.
8. Internal PKI DirectAccess Client template, make sure to have the certificate recipient Windows 8.1 or higher to support Windows 8 and 10. If you need to support Windows 7 then the Authority should be Windows 2008 R2 and Recipient Windows 7
   

    

9. Minimum Key size should be at least 2048
   

    

10. Make sure Subjectname is built from Active Directory – DNS. The Certificate will have the DNS name of the computer.
    

     

11. The most important step while creating the DirectAccess client certificate template is to ensure the DirectAccess Security group created in Active directory. Check step 6 (In my case i named it DirectAccess_Clients) has the enroll and Autoenroll check box. You will need to have an Autoenroll Group policy to allow these clients to pick and renew the certificates automatically.
    

     

Server Deployment/Installation.