Feeds

Can DirectAccess take over the world?

Significant Server 2012 overhaul, but some niggles to iron out

High performance access to file storage

Review Microsoft believes that DirectAccess is such a critical feature of Windows that we will soon wonder how we lived without this fundamental part of network infrastructure.

Having played with it I think Microsoft is very close to being right, but there are some bugs to work out and misconceptions to dispel.

Internet Protocol version 6 (IPv6) promises rainbows and kittens because every device with an IPv6 address can communicate directly with any other. That is a happy world for application developers.

Many who preach the gospel of end-to-end connectivity have assured me that the world will collapse unless we drastically lower the knowledge required to develop an internet-connected application.

Direct answer

But network and systems administrators are somewhat less keen on having their network attack surface transformed from a single externally addressable system into every system plugged into the network.

For reasons of "you do not pay me enough for this", administrators prefer defending one device instead of thousands.

Sadly, application developers won the war: instead of a shared security requirement, the burden of securing the future rests on network administrators. And that is why DirectAccess was created.

In its original incarnation DirectAccess mediated communication between a client's public IPv6 and a company's IPv6-enabled server fleet. DirectAccess verified that the computer attempting access was domain-joined, patched, authorised for access and so forth. It provided a single point of defence, even in an IPv6 world.

In a future where the right of anyone with a computer to directly address every device on your network (from your internet-connected light bulb to a hospital's medical equipment) is enshrined in nerd law, DirectAccess gives Microsoft-using administrators a fighting chance.

If you can master DirectAccess, then you can take advantage of the benefits end-to-end connectivity can offer while mitigating the risks.

Most of the confusion surrounding DirectAccess stems from the fact that it is no more a single technology than Microsoft Exchange is. What we think of as Exchange is a large collection of highly interdependent applications. These in turn are dependent upon applications that we usually think of as entirely separate, such as Internet Information Services (IIS) and certificate management.

Firewall extension

DirectAccess is no different. The second misconception we need to deal with is that, despite layers of confusing marketing, DirectAccess access is not a virtual private network (VPN). VPN-like technologies are almost always involved in a DirectAccess configuration, but they are to DirectAccess as IIS is to Exchange (or DNS to Active Directory).

DirectAccess is a first attempt at making an IPv6 firewall that mere mortals can (supposedly) comprehend. In essence, the core executable is a connection broker. You connect to it, it verifies you are who you say you are and then lets you access company resources.

Indeed, DirectAccess will not work if you disable Windows Firewall. If you think of DirectAccess as an extension of Windows Firewall (rather than a VPN technology) the rest of this overview will make a lot more sense.

In the real world, almost no one has IPv6 for all internal servers, for all the servers hosted by their ISP and for all possible locations that you might want to have a client connect to your network. It will be decades before this becomes a reality.

This means that any practical DirectAccess deployment relies upon some other technologies. At a minimum it uses Isatap to ensure IPv6 connectivity between all intranet sites and connected clients.

The Network Location Server (NLS), the Name Resolution Policy Table (NRPT) and Active Directory via its Group Policy Object (GPO) feature are also requirements.

DirectAccess also uses the NAT64 and DNS64 protocol translators to ensure that clients can access IPv4 systems on your network. The Server 2008 R2 version did not include these elements as part of the core offering; Server 2012 does.

In addition to being made up of several sub technologies, DirectAccess has been merged into the larger Remote Access role within Server 2012. It is no longer seen as a novel technology and has become merely one more sub-component of RemoteAccess.

Here it sits alongside traditional VPN, dial-up access, IP routing and site-to-site connectivity as part of Windows's ever-expanding bit-flinging capabilities.

High performance access to file storage

Next page: IPv6 for the masses

More from The Register

next story
European Court of Justice rips up Data Retention Directive
Rules 'interfering' measure to be 'invalid'
Dropbox defends fantastically badly timed Condoleezza Rice appointment
'Nothing is going to change with Dr. Rice's appointment,' file sharer promises
Cisco reps flog Whiptail's Invicta arrays against EMC and Pure
Storage reseller report reveals who's selling what
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Bored with trading oil and gold? Why not flog some CLOUD servers?
Chicago Mercantile Exchange plans cloud spot exchange
Just what could be inside Dropbox's new 'Home For Life'?
Biz apps, messaging, photos, email, more storage – sorry, did you think there would be cake?
IT bods: How long does it take YOU to train up on new tech?
I'll leave my arrays to do the hard work, if you don't mind
prev story

Whitepapers

Securing web applications made simple and scalable
In this whitepaper learn how automated security testing can provide a simple and scalable way to protect your web applications.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
HP ArcSight ESM solution helps Finansbank
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.