Table Of ContentWindows Server 2012 Unified
Remote Access Planning and
Deployment
Discover how to seamlessly plan and deploy remote
access with Windows Server 2012's successor to
DirectAccess
Erez Ben-Ari
Bala Natarajan
professional expertise distilled
P U B L I S H I N G
BIRMINGHAM - MUMBAI
Windows Server 2012 Unified Remote Access Planning
and Deployment
Copyright © 2012 Packt Publishing
All rights reserved. No part of this book may be reproduced, stored in a retrieval
system, or transmitted in any form or by any means, without the prior written
permission of the publisher, except in the case of brief quotations embedded in
critical articles or reviews.
Every effort has been made in the preparation of this book to ensure the accuracy
of the information presented. However, the information contained in this book is
sold without warranty, either express or implied. Neither the authors, nor Packt
Publishing, and its dealers and distributors will be held liable for any damages
caused or alleged to be caused directly or indirectly by this book.
Packt Publishing has endeavored to provide trademark information about all of the
companies and products mentioned in this book by the appropriate use of capitals.
However, Packt Publishing cannot guarantee the accuracy of this information.
First published: December 2012
Production Reference: 1141212
Published by Packt Publishing Ltd.
Livery Place
35 Livery Street
Birmingham B3 2PB, UK.
ISBN 978-1-84968-828-4
www.packtpub.com
Cover Image by Artie Ng (artherng@yahoo.com.au)
Credits
Authors Project Coordinator
Erez Ben-Ari Abhishek Kori
Bala Natarajan
Proofreaders
Mario Cecere
Reviewers
Jordan Krause Bob Phillips
Jochen Nickel Stephen Swaney
John Redding
Indexer
Tejal Soni
Acquisition Editor
Robin de Jongh
Graphics
Aditi Gajjar
Lead Technical Editor
Unnati Shah
Production Coordinator
Arvindkumar Gupta
Technical Editors
Jalasha D'costa
Kirti Pujari Cover Work
Arvindkumar Gupta
Prasad Dalvi
About the Authors
Erez Ben-Ari is an experienced Technologist and Journalist, and has worked in the
Information Technology industry since 1991. During his career, Erez has provided
security consulting and analysis services for some of the leading companies and
organizations in the world, including Intel, IBM, Amdocs, CA, HP, NDS, Sun
Microsystems, Oracle, and many others. His work has gained national fame in
Israel, and he has featured in the press regularly. Having joined Microsoft in 2000,
Erez has worked for many years in Microsoft's Development Center in Israel, where
Microsoft's ISA Server was developed. Being a part of the release of ISA 2000, ISA
2004, and ISA 2006, Erez held several roles in different departments, including
Operation engineering, Software testing, Web-based software design, and testing
automation designs. Now living in the United States, Erez still works for Microsoft,
currently as a Senior Support Escalation Engineer for Forefront Edge technologies,
which include Forefront UAG and TMG.
As a writer, Erez has been a journalist since 1995, and has written for some of
the leading publications in Israel and in the United States. He has been a member
of the Israeli National Press Office since 2001, and his personal blogs are read
by thousands of visitors every month. Erez has also written, produced, and
edited content for TV and radio, working for Israel's TV Channel 2, Ana-Ney
Communications, Radio Haifa, and other venues.
Erez has also authored four other titles, including Microsoft Forefront UAG 2010
Administrator's Handbook, Packt Publishing and Mastering Microsoft Forefront UAG
2010 Customization, Packt Publishing. His publications have been critically acclaimed,
earning 5-star reviews from all readers and have been a monumental success. They
have paved the way for many customers to deploy these solutions in some of the
largest organizations in the world.
To my dear colleagues Mohit Saxena, Billy Price, and Tarun
Sachdeva, and to my co-author Bala, for supporting me and helping
me in my quest to master this technology and bring it to light.
Bala Natarajan has an engineering degree in Electronics & Instrumentation from
India. He graduated in 1987 and started his career as a System Support Engineer for
Unix, Novell NetWare, and MSDOS. From 1994 onwards, he specialized in Computer
Networking to provide large enterprises in India with design and support for LAN
and WAN networking using Cisco and Nortel networking gears.
He moved to the US and worked in a large telecom company as a dedicated
Support Engineer to connect over 300 school districts in the state of Washington.
He joined Microsoft in 1998 as a Support Engineer in the Platforms Networking
team and the Enterprise Security team. He worked as a pre-release product
Support Engineer for TMG 2010, UAGDA.
In 2011, he moved to the Windows Core networking team as a Program Manager
for DirectAccess.
About the Reviewers
Jordan Krause is a Microsoft MVP for the Forefront network security technologies,
and specializes in DirectAccess, which is a part of Forefront Unified Access Gateway
(UAG) 2010 and the new Unified Remote Access (URA) in Windows Server 2012. As
a Senior Engineer and Security Specialist for IVO Networks, he spends the majority
of each workday planning, designing, and implementing DirectAccess using IVO's
DirectAccess Concentrator security appliances for companies of all shapes and sizes.
Committed to continuous learning, Jordan holds Microsoft certifications as an MCP,
MCTS, MCSA, and MCITP Enterprise Administrator. He regularly writes tech notes
and articles about some of the fun and exciting ways that DirectAccess can be used,
here: http://www.ivonetworks.com/news/.
Thank you to Ben and Bala for putting together this great resource.
Bala, I appreciate your time answering my questions the last
time I was in Redmond. Ben, what can I say? Thank you for your
friendship. I would also like to thank the crew at IVO, without
whom I would have missed out on many amazing opportunities.
Jochen Nickel is an Identity and Access Management Consultant working for
Inovit GmbH in Switzerland, and tries everyday to understand new business needs
of his customers, to provide a better, more comfortable, and flexible workstyle
through Microsoft Remote Access technologies.
He has been working in a lot of projects, proofs of concepts, and workshops with
Direct Access and Forefront Unified Access Gateway since they were added to the
Microsoft Remote Access technologies.
Jochen is very focused on DirectAccess, Forefront Unified Access Gateway, Active
Directory Federation Services, and Forefront Identity Manager.
Newly added to his interests is Dynamic Access Control in Windows Server 2012.
Furthermore, he developed and wrote a lot of workshops and articles about
these topics.
His greatest passion is to spend as much time as possible with his family to get back
the energy to handle such nice and interesting technologies.
He regularly blogs at www.inovit.ch/blog.idam.ch.
I would like to thank Ben for giving me the chance and the
opportunity to be a small helper in this project by serving
as a technical reviewer.
John Redding has worked as a Technical Support Engineer on various Internet
server products such as the first generation Netscape SuiteSpot and the second
generation iPlanet server suite since the mid 90s. In 2003, John joined Whale
Communications, where he worked as a Senior Support Engineer for the e-Gap
and IAG SSL VPN products, which ultimately led to product support for UAG.
John Redding is currently a Senior Consultant in the Identity and Access
Management group at Certified Security Solutions, where he regularly does
DirectAccess deployments.
www.PacktPub.com
Support files, eBooks, discount offers and more
You might want to visit www.PacktPub.com for support files and downloads related to
your book.
Did you know that Packt offers eBook versions of every book published, with PDF and ePub
files available? You can upgrade to the eBook version at www.PacktPub.com and as a print
book customer, you are entitled to a discount on the eBook copy. Get in touch with us at
service@packtpub.com for more details.
At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a
range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.
http://PacktLib.PacktPub.com
Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book
library. Here, you can access, read and search across Packt's entire library of books.
Why Subscribe?
• Fully searchable across every book published by Packt
• Copy and paste, print and bookmark content
• On demand and accessible via web browser
Free Access for Packt account holders
If you have an account with Packt at www.PacktPub.com, you can use this to access
PacktLib today and view nine entirely free books. Simply use your login credentials for
immediate access.
Instant Updates on New Packt Books
Get notified! Find out when new books are published by following @PacktEnterprise on
Twitter, or the Packt Enterprise Facebook page.
Table of Contents
Preface 1
Chapter 1: Understanding IPv6 and IPv4-IPv6 Interoperability 17
My network's fine, so if it ain't broken, why fix it? 18
The IPv6 addressing schemes 19
IPv6 address assignment 22
IPv6 and name resolution 24
A little more about DNS 25
Multiple stacks 26
Operating system compatibility 27
Protocol transition technologies 28
ISATAP 28
DNS64 and NAT64 30
6to4 31
Teredo 32
IP-HTTPS 34
Practical considerations for IPv6 and IPv4 36
Unified Remote Access and Group Policy 37
Public Key Infrastructure (PKI) 38
Summary 39
Chapter 2: Planning a Unified Remote Access Deployment 41
Server requirements and placement 42
Capacity planning for URA 43
Low-end server 45
High-end server 45
Server requirements – considerations 46
Basic scenarios 46
Network Location Server 47
URA certificates 48
Basic scenario considerations 49
