Deploying DirectAccess in Microsoft Azure

Introduction

DirectAccess Now a Supported Workload in Microsoft AzureMany organizations are preparing to implement DirectAccess on Microsoft’s public cloud infrastructure. Deploying DirectAccess in Azure is fundamentally no different than implementing it on premises, with a few important exceptions (see below). This article provides essential guidance for administrators to configure this unique workload in Azure.

Important Note: There has been much confusion regarding the supportability of DirectAccess in Azure. Historically it has not been supported. Recently, it appeared briefly that Microsoft reversed their earlier decision and was in fact going to support it. However, the Microsoft Server Software Suport for Microsoft Azure Virtual Machines document has once again been revised to indicate that DirectAccess is indeed no longer formally supported on Azure. More details can be found here.

Azure Configuration

The following is guidance for configuring network interfaces, IP address assignments, public DNS, and network security groups for deploying DirectAccess in Azure.

Virtual Machine

Deploy a virtual machine in Azure with sufficient resources to meet expected demand. A minimum of two CPU cores should be provisioned. A VM with 4 cores is recommended. Premium storage on SSD is optional, as DirectAccess is not a disk intensive workload.

Network Interfaces

It is recommended that an Azure VM with a single network interface be provisioned for the DirectAccess role. This differs from on-premises deployments where two network interfaces are preferred because deploying VMs in Azure with two NICs is prohibitively difficult. At the time of this writing, Azure VMs with multiple network interfaces can only be provisioned using PowerShell, Azure CLI, or resource manager templates. In addition, Azure VMs with multiple NICs cannot belong to the same resource group as other VMs. Finally, and perhaps most importantly, not all Azure VMs support multiple NICs.

Internal IP Address

Static IP address assignment is recommended for the DirectAccess VM in Azure. By default, Azure VMs are initially provisioned using dynamic IP addresses, so this change must be made after the VM has been provisioned. To assign a static internal IP address to an Azure VM, open the Azure management portal and perform the following steps:

  1. Click Virtual machines.
  2. Select the DirectAccess server VM.
  3. Click Network Interfaces.
  4. Click on the network interface assigned to the VM.
  5. Under Settings click IP configurations.
  6. Click Ipconfig1.
  7. In the Private IP address settings section choose Static for the assignment method.
  8. Enter an IP address for the VM.
  9. Click Save.

Deploying DirectAccess in Microsoft Azure

Public IP Address

The DirectAccess VM in Azure must have a public IP address assigned to it to allow remote client connectivity. To assign a public IP address to an Azure VM, open the Azure management portal and perform the following steps:

  1. Click Virtual machines.
  2. Select the DirectAccess server VM.
  3. Click Network Interfaces.
  4. Click on the network interface assigned to the VM.
  5. Under Settings click IP configurations.
  6. Click Ipconfig1.
  7. In the Public IP address settings section click Enabled.
  8. Click Configure required settings.
  9. Click Create New and provide a descriptive name for the public IP address.
  10. Choose an address assignment method.
  11. Click Ok and Save.

Deploying DirectAccess in Microsoft Azure

Deploying DirectAccess in Microsoft Azure

Public DNS

If the static IP address assignment method was chosen for the public IP address, create an A resource record in public DNS that resolves to this address. If the dynamic IP address assignment method was chosen, create a CNAME record in public DNS that maps to the public hostname for the DirectAccess server. To assign a public hostname to the VM in Azure, open the Azure management portal and perform the following steps:

  1. Click Virtual machines.
  2. Select the DirectAccess server VM.
  3. Click Overview.
  4. Click Public IP address/DNS name label.Deploying DirectAccess in Microsoft Azure
  5. Under Settings click Configuration.
  6. Choose an assignment method (static or dynamic).
  7. Enter a DNS name label.
  8. Click Save.

Deploying DirectAccess in Microsoft Azure

Note: The subject of the SSL certificate used for the DirectAccess IP-HTTPS listener must match the name of the public DNS record (A or CNAME) entered previously. The SSL certificate does not need to match the Azure DNS name label entered here.

Network Security Group

A network security group must be configured to allow IP-HTTPS traffic inbound to the DirectAccess server on the public IP address. To make the required changes to the network security group, open the Azure management portal and perform the following steps:

  1. Click Virtual machines.
  2. Select the DirectAccess server VM.
  3. Click Network interfaces.
  4. Click on the network interface assigned to the VM.
  5. Under Settings click Network security group.
  6. Click the network security group assigned to the network interface.
  7. Click Inbound security rules.
  8. Click Add and provide a descriptive name for the new rule.
  9. Click Any for Source.
  10. From the Service drop-down list choose HTTPS.
  11. Click Allow for Action.
  12. Click Ok.

Deploying DirectAccess in Microsoft Azure

Note: It is recommended that the default-allow-rdp rule be removed if it is not needed. At a minimum, scope the rule to allow RDP only from trusted hosts and/or networks.

DirectAccess Configuration

When performing the initial configuration of DirectAccess using the Remote Access Management console, the administrator will encounter the following warning message.

“One or more network adapters should be configured with a static IP address. Obtain a static address and assign it to the adapter.”

Deploying DirectAccess in Microsoft Azure

This message can safely be ignored because Azure infrastructure handles all IP address assignment for hosted VMs.

The public name of the DirectAccess server entered in the Remote Access Management console must resolve to the public IP address assigned to the Azure VM, as described previously.

Deploying DirectAccess in Microsoft Azure

Additional Considerations

When deploying DirectAccess in Azure, the following limitations should be considered.

Load Balancing

It is not possible to enable load balancing using Windows Network Load Balancing (NLB) or an external load balancer. Enabling load balancing for DirectAccess requires changing static IP address assignments in the Windows operating system directly, which is not supported in Azure. This is because IP addresses are assigned dynamically in Azure, even when the option to use static IP address assignment is chosen in the Azure management portal. Static IP address assignment for Azure virtual machines are functionally similar to using DHCP reservations on premises.

Deploying DirectAccess in Microsoft Azure

Note: Technically speaking, the DirectAccess server in Azure could be placed behind a third-party external load balancer for the purposes of performing SSL offload or IP-HTTPS preauthentication, as outlined here and here. However, load balancing cannot be enabled in the Remote Access Management console and only a single DirectAccess server per entry point can be deployed.

Manage Out

DirectAccess manage out using native IPv6 or ISATAP is not supported in Azure. At the time of this writing, Azure does not support IPv6 addressing for Azure VMs. In addition, ISATAP does not work due to limitations imposed by the underlying Azure network infrastructure.

Summary

For organizations moving infrastructure to Microsoft’s public cloud, formal support for the DirectAccess workload in Azure is welcome news. Implementing DirectAccess in Azure is similar to on-premises with a few crucial limitations. By following the guidelines outlined in this article, administrators can configure DirectAccess in Azure to meet their secure remote access needs with a minimum of trouble.

Additional Resources

Implementing DirectAccess in Windows Server 2016
Fundamentals of Microsoft Azure 2nd Edition
Microsoft Azure Security Infrastructure
DirectAccess Multisite with Azure Traffic Manager
DirectAccess Consulting Services

Leave a comment

21 Comments

  1. What’s this rumour that MS are not continuing to develop DA moving forward?

    Reply
    • Not a rumor, it’s a fact. There have been no new features or functionality added to DirectAccess since Windows Server 2012. This continues with DirectAccess in Windows Server 2016. It is still available and fully supported, and will be for the foreseeable future. However, they don’t appear to be investing anything more in the technology other than providing bug fixes and stability enhancements.

      Reply
  2. As I know Microsoft is not applying any SLA for a single VM on Azure. If NLB is not an option for DirectAccess do we have any other option to achieve any redundancy and SLA for the Direct Access service? If there isn’t, how can it be officially supported?

    Reply
    • Your only supportable option for redundancy for DirectAccess in Azure is to use a multisite deployment model. There you’ll place DirectAccess servers in other Azure regions to achieve desired high availability.

      Reply
  3. Would you please explain the topic “DNS names and addresses” a bit more in detail? Based on the article I’m not sure what to choose for DA address, public DNS entry (CNAME) and what should be listed in the certificate. An example would be great. Thank you!

    Reply
    • Sure! Let’s say you assign a public IPv4 address to the Azure VM and choose the static address assignment option. You can simply create an A host record in DNS that resolves this name to the Azure IP address. For example, da.yourcompany.com would resolve to the Azure public IPv4 address. If you chose the dynamic IP address assignment method, you would also assign a public hostname in Azure, for example azure-da.uswest.cloudapp.net. You would then create a CNAME record in DNS that points your FQDN, da.yourcompany.com, to azure-da.uswest.cloudapp.net. The subject name of your SSL certificate must match whatever you enter in DNS, in eitehr case it would be da.yourcompany.com.

      Let me know if that helps!

      Reply
  4. Dan Catinella

     /  September 26, 2016

    Richard, my understanding is in order to use a Multisite deployment model of DirectAccess you need to use native IPv6 address space, which to my knowledge is not supported in Azure?

    Thoughts?

    thanks

    Reply
    • That is incorrect. Native IPv6 addressing is not required to implement DirectAccess multisite. You should be able to deploy multisite DirectAccess without issue in Azure. 🙂

      Reply
  5. NAM

     /  October 5, 2016

    Richard – https://support.microsoft.com/en-us/kb/2721672 was update on Oct 3. There is now a caveat that Direct Access is ‘now’ not a supported Remote Access Role Feature in Azure.

    Ahhh …

    Reply
  6. Bob The IT Guy

     /  October 10, 2016

    I assume a site-to-site VPN between Azure and on-prem is required for full network access through DirectAccess in Azure.. Will the configuration differ at all from your guidelines when using S2S VPN?

    Reply
    • That’s correct. If DirectAccess clients connecting in Azure require on-premises network access, some form of cross-premises connectivity will be required (site-to-site or Express route). Nothing changes with regard to the DirectAccess configuration, however.

      Reply
  7. Robert Rubio

     /  October 12, 2016

    Richard, does an entry point hosted on Azure support manage-out? Haven’t seen anything that Azure IaaS allows for ISATAP – Thanks

    Reply
    • No. I was unable to get manage out working with DirectAccess in Azure. This is no doubt due to limitations imposed by the Azure networking infrastructure.

      Reply
  8. Frank Lesniak

     /  November 17, 2016

    Richard, have you revisited DA manage-out since IPv6 support was announced for Azure VMs? https://azure.microsoft.com/en-us/updates/ipv6-for-azure-vms/

    Reply
  9. Direct access is still not supported in Azure as per
    https://support.microsoft.com/en-us/kb/2721672

    Reply
  1. DirectAccess Now a Supported Workload in Microsoft Azure | Richard Hicks' DirectAccess Blog
  2. DirectAccess No Longer Supported in Microsoft Azure | Richard Hicks' DirectAccess Blog

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: