Join me this Thursday, April 9 at 10:00AM EDT for a Remote Access Q&A session hosted by Kemp Technologies. During this free live webinar, I’ll be answering all your questions as they relate to enterprise mobility, remote access, scalability and performance, security, and much more. Topics are not limited to Kemp products at all, so feel free to join and ask me anything you like! Register now and submit your questions!
Awards
Pluralsight
Consulting
Newsletter
- 6to4
- AADJ
- Absolute
- Absolute Secure Access
- Absolute Software
- Active Directory
- Active Directory Certificate Services
- AD CS
- ADC
- ADCS
- Admin Center
- administration
- Always On VPN
- Always On VPN Book
- Always On VPN DPC
- AMA
- Amazon EC2
- Amazon Web Services
- AOVPN
- AOVPN Book
- AovpnDPC
- application delivery controller
- Application Filter
- authentication
- AWS
- Azure
- Azure Active Directory
- Azure AD
- Azure AD Join
- Azure App Proxy
- Azure Application Gateway
- Azure Application Proxy
- Azure Conditional Access
- Azure Load Balancer
- Azure MF
- Azure MFA
- Azure Traffic Manager
- Azure Virtual WAN
- Azure VPN
- Azure VPN Gateway
- BIG-IP
- Certificate Authentication
- Certificate Authority
- Certificate Connector for Intune
- Certificate Services
- certificates
- Cisco
- Cisco Umbrella
- Cisco Umbrella Roaming Client
- Citrix ADC
- cloud
- Cloud PKI
- Cloud Service
- Cloudflare
- Compliance
- Conditional Access
- Consulting Services
- Cryptography
- CVE
- Deployment
- Device Management
- device tunnel
- DirectAccess
- DirectAccess Book
- DirectAccess Deprecated
- DirectAccess End of Life
- DirectAccess EOL
- DNS
- DNS Policies
- DPC
- Dynamic Profile Configurator
- EAP
- EC2
- ECC
- education
- Elliptic Curve Cryptography
- encapsulation
- Encryption
- end of life
- Endpoint Manager
- Enterprise
- enterprise mobility
- Entra
- Entra Global Secure Access
- Entra ID
- Entra Internet Access
- Entra Private Access
- Entra Private Network Connector
- EOL
- extensible authentication protocol
- F5
- force tunnel
- force tunneling
- Forefront TMG 2010
- Forefront UAG 2010
- General
- Geographic Redundnacy
- GitHub
- global server load balancer
- Group Policy
- GSA
- GSLB
- HAADJ
- High Availability
- Hotfix
- Hybrid Azure AD Join
- Hybrid Entra ID Join
- Hybrid Entra Join
- IKEv2
- iManage
- Important Links
- Infrastructure
- InTune
- Intune Certificate Connector
- Intune PFX Connector
- IP-HTTPS
- IPv6
- IPv6 Transition
- ISATAP
- Kemp
- learning
- Load Balancing
- LoadMaster
- local traffic manager
- LTM
- Manage Out
- MDM
- MEM
- MEMCM
- MFA
- Microsoft
- Microsoft Endpoint Manager
- Microsoft Entra
- Microsoft Entra Global Secure Access
- Microsoft Entra ID
- Microsoft Entra Internet Access
- Microsoft Entra Private Access
- Microsoft Intune
- Mobile Device Management
- Mobility
- Multifactor Authentiction
- multisite
- MVP
- NAC
- Name Resolution
- name resolution policy table
- NAP
- NCA
- NCSI
- NDES
- NetMotion
- NetMotion Mobility
- NetMotion Software
- Netscaler
- Network Access Control
- network connectivity assistant
- network connectivity status indicator
- Network Device Enrollment Service
- Network Device Enrollment Services
- network policy server
- nmap
- NPS
- NRPT
- Offline Domain Join
- OMA-DM
- OMA-URI
- OpenDNS
- OpenSSL
- OpenVPN
- Operational Support
- OTP
- PEAP
- PFX Connector
- PKCS
- PKI
- Pluralsight
- PointSharp
- PowerShell
- Private Network Connector
- Professional Services
- ProfileXML
- Protected EAP
- Proxy
- Proxy Server
- public cloud
- public key infrastructure
- Quad9
- RasMan
- Recommended Reading
- Remote Access
- Remote Administration
- reporting
- routing
- routing and remote access service
- RRAS
- RSAT
- SASE
- SCCM
- SCEP
- Secure Access Service Edge
- Secure Service Edge
- Secure Socket Tunneling Protocol
- Secure Web Gateway
- Security
- Security Service Edge
- Security Update
- Server Core
- Simple Certificate Enrollment Protocol
- Split DNS
- split tunnel
- split tunneling
- SSE
- SSL
- SSL and TLS
- SSTP
- Surface Pro
- Surface Pro 4
- SWG
- System Center 2012
- System Center Configuration Manager
- systems management
- Teredo
- TLS
- TLS 1.3
- TND
- TPM
- Traffic Filter
- Training
- transition technology
- Transport Layer Security
- troubleshooting
- Trusted Network Detection
- Trusted Platform Module
- Uncategorized
- Update
- user tunnel
- video
- Visual Studio
- Visual Studio Code
- VPN
- VPN Proxy
- VS Code
- Vulnerability
- Web Application Proxy
- Web Proxy
- Web Proxy Server
- webinar
- Windows 10
- Windows 11
- Windows 7
- Windows 8
- Windows 8.1
- Windows Admin Center
- Windows Server 2008 R2
- Windows Server 2012
- Windows Server 2012 R2
- Windows Server 2016
- Windows Server 2019
- Windows Server 2022
- Windows Server 2025
- Workshop
- WorkSite
- XML
- Zero Trust
- Zero Trust Network Access
- Zscaler
- ZTNA
All posts tagged QA
Remote Access Questions and Answers Webinar Hosted by Kemp
Posted by Richard M. Hicks on April 7, 2020
https://directaccess.richardhicks.com/2020/04/07/remote-access-qa-webinar-hosted-by-kemp/
Configuring Multiple Windows Server 2012 R2 DirectAccess Instances
DirectAccess in Windows Server 2012 R2 supports many different deployment configurations. It can be deployed with a single server, multiple servers in a single location, multiple servers in multiple locations, edge facing, in a perimeter or DMZ network, etc.
Global Settings
There are a number of important DirectAccess settings that are global in scope and apply to all DirectAccess clients, such as certificate authentication, force tunneling, one-time password, and many more. For example, if you configure DirectAccess to use Kerberos Proxy instead of certificates for authentication, Windows 7 clients are not supported. In this scenario it is advantageous to have a second parallel DirectAccess deployment configured specifically for Windows 7 clients. This allows Windows 8 clients to take advantage of the performance gains afforded by Kerberos Proxy, while at the same time providing an avenue of support for Windows 7 clients.
Parallel Deployments
To the surprise of many, it is indeed possible to deploy DirectAccess more than once in an organization. I’ve been helping customers deploy DirectAccess for nearly five years now, and I’ve done this on more than a few occasions. In fact, there are some additional important uses cases that having more than one DirectAccess deployment can address.
Common Use Cases
QA and Testing – Having a separate DirectAccess deployment to perform testing and quality assurance can be quite helpful. Here you can validate configuration changes and verify updates without potential negative impact on the production deployment.
Delegated Administration – DirectAccess provides support for geographic redundancy, allowing administrators to create DirectAccess entry points in many different locations. DirectAccess in Windows Server 2012 R2 lacks support for delegated administration though, and in some cases it may make more sense to have multiple separate deployments as opposed to a single, multisite deployment. For example, many organizations are divided in to different business units internally and may operate autonomously. They may also have different configuration requirements, which can be better addressed using individual DirectAccess implementations.
Migration – If you have currently deployed DirectAccess using Windows Server 2008 R2 with or without Forefront UAG 2010, migrating to Windows Server 2012 R2 can be challenging because a direct, in-place upgrade is not supported. You can, however, deploy DirectAccess using Windows Server 2012 R2 in parallel to your existing deployment and simply migrate users to the new solution by moving the DirectAccess client computer accounts to a new security group assigned to the new deployment.
Major Configuration Changes – This strategy is also useful for scenarios where implementing changes to the DirectAccess configuration would be disruptive for remote users. For example, changing from a single site to a multisite configuration would typically require that all DirectAccess clients be on the LAN or connect remotely out-of-band to receive group policy settings changes after multisite is first configured. In addition, parallel deployments can significantly ease the pain of transitioning to a new root CA if required.
Unique Client Requirements – Having a separate deployment may be required to take advantage of the unique capabilities of each client operating system. For example, Windows 10 clients do not support Microsoft Network Access Protection (NAP) integration. NAP is a global setting in DirectAccess and applies to all clients. If you still require NAP integration and endpoint validation using NAP for Windows 7 and Windows 8.x, another DirectAccess deployment will be required to support Windows 10 clients.
Requirements
To support multiple Windows Server 2012 R2 DirectAccess deployments in the same organization, the following is required:
Unique IP Addresses – It probably goes without saying, but each DirectAccess deployment must have unique internal and external IPv4 addresses.
Distinct Public Hostname – The public hostname used for each deployment must also be unique. Multi-SAN certificates have limited support for DirectAccess IP-HTTPS (public hostname must be the first entry in the list), so consider using a wildcard certificate or obtain certificates individually for each deployment.
Group Policy Objects – You must use unique Active Directory Group Policy Objects (GPOs) to support multiple DirectAccess deployments in a single organization. You have the option to specify a unique GPO when you configure DirectAccess for the first time by clicking the Change link next to GPO Settings on the Remote Access Review screen.
Enter a distinct name for both the client and server GPOs. Click Ok and then click Apply to apply the DirectAccess settings for this deployment.
Windows 7 DirectAccess Connectivity Assistant (DCA) GPOs – If the DirectAccess Connectivity Assistant (DCA) v2.0 has been deployed for Windows 7 clients, separate GPOs containing the DCA client settings for each individual deployment will have to be configured. Each DirectAccess deployment will have unique Dynamic Tunnel Endpoint (DTE) IPv6 addresses which are used by the DCA to confirm corporate network connectivity. The rest of the DCA settings can be the same, if desired.
Supporting Infrastructure
The rest of the supporting infrastructure (AD DS, PKI, NLS, etc.) can be shared between the individual DirectAccess deployments without issue. Once you’ve deployed multiple DirectAccess deployments, make sure that DirectAccess clients DO NOT belong to more than one DirectAccess client security group to prevent connectivity issues.
Migration Process
Moving DirectAccess client computers from the old security group to the new one is all that’s required to migrate clients from one DirectAccess deployment to another. Client machines will need to be restarted to pick up the new security group membership, at which time they will also get the DirectAccess client settings for the new deployment. This works seamlessly when clients are on the internal network. It works well for clients that are outside the network too, for the most part. Because clients must be restarted to get the new settings, it can take some time before all clients finally moved over. To speed up this process it is recommended that DirectAccess client settings GPOs be targeted at a specific OUs created for the migration process. A staging OU is created for clients in the old deployment and a production OU is created for clients to be assigned to the new deployment. DirectAccess client settings GPOs are then targeted at those OUs accordingly. Migrating then only requires moving a DirectAccess client from the old OU to the new one. Since OU assignment does not require a reboot, clients can be migrated much more quickly using this method.
Summary
DirectAccess with Windows Server 2012 R2 supports many different deployment models. For a given DirectAccess deployment model, some settings are global in scope and may not provide the flexibility required by some organizations. To address these challenges, consider a parallel deployment of DirectAccess. This will enable you to take advantage of the unique capabilities of each client operating system, or allow you to meet the often disparate configuration requirements that a single deployment cannot support.
Posted by Richard M. Hicks on August 10, 2015
https://directaccess.richardhicks.com/2015/08/10/configuring-multiple-windows-server-2012-r2-directaccess-instances/
Always On VPN Book
DirectAccess Book
Always On VPN DPC
-
Recent Posts
Resources
- About Me
- Absolute Secure Access
- Absolute Secure Access Enterprise VPN
- Absolute Secure Access Purpose-Built Enterprise VPN Advanced Features In Depth
- Absolute Secure Access Zero Trust Network Access
- Absolute Secure Access ZTNA
- Always On VPN
- Always On VPN and Multifactor Authentication
- Always On VPN Book
- Always On VPN DPC
- Always On VPN DPC
- Always On VPN DPC Advanced Features
- Always On VPN DPC with Intune
- Always On VPN Training
- Choosing an Enterprise VPN
- Citrix NetScaler ADC Load Balancing
- Consulting
- Consulting Services
- Contact
- Digital Certificates and TPM
- DirectAccess
- DirectAccess Consulting and Troubleshooting Services
- DirectAccess Consulting Services
- DirectAccess End of Life (EOL)
- DirectAccess is now Always On VPN
- DirectAccess Training
- Drawbacks of Multifactor Authentication
- Enterprise Mobility
- Enterprise PKI
- Enterprise VPN
- Entra Global Secure Access
- Entra Private Access
- F5-BIG-IP Load Balancing
- How Do VPNs Protect You From Cyber Threats?
- Implementing Always On VPN
- Implementing DirectAccess with Windows Server 2016
- IPv6
- Kemp LoadMaster Load Balancing
- Microsoft Entra Global Secure Access
- Multifactor Authentication (MFA)
- NetMotion Mobility
- NetMotion Mobility Enterprise VPN
- NetMotion Mobility Purpose-Built Enterprise VPN
- NetMotion Mobility Purpose-Built Enterprise VPN Advanced Features In Depth
- Network Security and Virtual Private Networks (VPNs)
- Newsletter
- PKI
- PowerON Platforms
- Richard M. Hicks Consulting Named in Enterprise Networking Magazine’s Top 10 VPN Consulting Services for 2020
- Secure Access Service Edge (SASE)
- Secure Service Edge (SSE)
- Secure Web Gateway
- Security Service Edge (SSE)
- SSE vs. SASE
- Training
- Virtual Private Network (VPN)
- Virtual Private Networking (VPN) and the Cloud
- What Is a Secure Web Gateway?
- What is a VPN?
- What Is Always On VPN
- What's The Difference Between SSE and SASE?
- Zero Trust
- Zero Trust Network Access (ZTNA)
- ZTNA
Always On VPN Resources
DirectAccess Resources
Active Directory ADC Always On VPN AOVPN application delivery controller authentication Azure bug CA certificate certificates Certification Authority cloud configuration device tunnel DirectAccess DNS EAP education encryption endpoint manager enterprise mobility error F5 firewall Forefront Forefront UAG GPO group policy high availability hotfix IKEv2 Important Links InTune IP-HTTPS IPsec IPv6 IPv6 transition technology Kemp learning load balancer load balancing LoadMaster management Manage Out MDM MEM Microsoft Microsoft Endpoint Manager Microsoft Intune Mobility multisite NetMotion NetMotion Mobility Networking network location server network policy server NLB NLS NPS NRPT PEAP performance PKI PowerShell ProfileXML public cloud RADIUS RAS RasClient redundancy Remote Access routing routing and remote access service RRAS SCCM security SSL SSTP System Center Configuration Manager TLS training troubleshooting UAG update user tunnel VPN vulnerability Windows Windows 7 Windows 8 Windows 10 Windows 11 Windows Server Windows Server 2012 Windows Server 2012 R2 Windows Server 2016 Windows Server 2019 Windows Server 2022 XML