Besides simplified deployment and unified management, DirectAccess
has been enhanced in other ways in Windows Server 2012. For example:
To see unified remote access at work, let’s walk through the initial
steps of deploying a DirectAccess solution. Although we’ve used the UI
for performing the steps described below, you can also use Windows
PowerShell. You can also deploy the Remote Access role on a Windows
Server Core installation of Windows Server 2012.
After making sure that all the requirements have been met for
deploying a DirectAccess solution (for example, by making sure your
server is domain-joined and has at least one network adapter), you can
start the Add Roles And Features Wizard from Server Manager. Then, on the Select Installation Type page, begin by selecting the Role-based Or Feature-based Installation option, as shown here:
After choosing the server(s) you want to install remote access functionality on, select the Remote Access role on the Select Server Roles page:
On the Select Role Services page, select the DirectAccess And VPN (RAS) option, as shown here:
Continue through the wizard to install the Remote
Access server role. Once this is finished, click the Open The Getting
Started Wizard link on the Installation Progress page shown here to
begin configuring remote access:
Windows Server 2012 presents you with three options for configuring remote access:
-
Deploying both DirectAccess and VPN server functionality so that DirectAccess
can be used for clients running Windows 7 or later while the VPN server
can be used so that clients that don’t support DirectAccess can connect
to your corporate network via VPN
-
Deploying only DirectAccess, which you might choose if all your clients are running Windows 7 or later
-
Deploying only a VPN server, which you might use if you’ve invested
heavily in third-party VPN client software and you want to continue
using these investments
Let’s choose the recommended option by selecting the Deploy Both DirectAccess And VPN option:
On the Remote Access Server Setup page of the Configure Remote Access wizard, you now choose the network topology that best describes where your DirectAccess server is located. The three options available are:
-
Edge, which
requires that the server have two network interfaces, one connected to
the public Internet and one to the internal network
-
Behind An Edge
Device (With Two Network Adapters), which again requires that a server
has two network interfaces with the DirectAccess server being located
behind a NAT device
-
Behind An Edge Device (Single Network Adapter), which only requires
the server (located behind a NAT device) to have one network interface
connected to the internal network
Because the server used in this walkthrough has only one network
adapter and is located behind a NAT inside, we’ll choose the third
option listed here. We’ll also specify Corpnet.contoso.com as the
Domain Name System (DNS) name to which the DirectAccess clients will connect:
Note that if the server has two network interfaces, with one connected to the Internet, the Configure Remote Access wizard will detect this and configure the two interfaces as needed.
When you are ready to finish running the Configure Remote Access
wizard, you will be presented with a web-based report of the
configuration changes that the wizard will make before you apply them
to your environment. For example, performing the steps previously
described in this walkthrough will result in the following changes:
-
A new GPO called DirectAccess Server Settings will be created for your DirectAccess server.
-
A new GPO called DirectAccess Client Settings will be created for your DirectAccess clients.
-
DirectAccess settings will be applied to all mobile computers in the CONTOSO\Domain Computers security group.
-
A default web probe will be created to verify internal network connectivity.
-
A connection name called Workplace Connection will be created on DirectAccess clients.
-
The remote access server has DirectAccess configured to use
Corpnet.contoso.com as the public name to which remote clients connect.
-
The network adapter connected to the Internet (via the NAT device) will be identified by name.
-
Configuration settings for your VPN server will also be summarized;
for example, how VPN client address assignment will occur (via DHCP
server) and how VPN clients will be authenticated (using Windows
authentication).
-
The certificate used to authenticate the network location server deployed on the Remote Access server, which in the above walkthrough was CN=DirectAccess-NLS.contoso.com, is identified.
