Wow! This is it – the last quiz in Contest 1. That’s right – this is quiz 4 of the second round.
To celebrate this occasion and to make things more interesting, we’re going to have FIVE questions. This will give those who are behind a better chance of catching up and put some pressure on the leaders.
Let the game begin!
There you go! Five questions with five answers ready for you to send to me.
Send me your answer with the following email link:
tomsh@microsoft.com
by 11AM Central Standard Time (-0600 UTC) on Monday January 31.
Thanks!
Tom
Tom Shinder tomsh@microsoft.com Principal Knowledge Engineer, Microsoft DAIP iX/Identity Management Anywhere Access Group (AAG) The “Edge Man” blog : http://blogs.technet.com/tomshinder/default.aspx Follow me on Twitter: http://twitter.com/tshinder Facebook: http://www.facebook.com/tshinder
Visit the TechNet forums to discuss all your UAG DirectAccess issues http://social.technet.microsoft.com/Forums/en-US/forefrontedgeiag/threads
Stay up-to-date with “just in time” UAG DirectAccess information on the TechNet wiki http://social.technet.microsoft.com/wiki/tags/DirectAccess/default.aspx
UAG 2010 (UAG) supports two types of network level SSL VPN:
Network Connector is aimed at legacy clients and SSTP for Windows 7 clients.
Network Connector supports both split and non-split tunneling configurations while SSTP, when accessed through the UAG portal, supports only non-split tunneled connections.
This can be a problematic for firms that want to enable a split tunneled configuration to reduce the bandwidth drain that VPN clients can extract when split tunneling isn’t supported. And with current network security opinions moving away from disabling split tunneling as a security solution (see my articles on split tunneling for more information at http://blogs.technet.com/b/tomshinder/archive/2010/03/02/why-split-tunneling-is-not-a-security-issue-with-directaccess.aspx), it makes sense that admins would want to enable split tunneling for their UAG SSTP clients.
Faisal Hussain provides a solution on his blog and you can find it at:
http://blogs.technet.com/b/fsl/archive/2011/01/26/uag-sstp-split-tunnel.aspx
WARNING: This is an unsupported solution and has not been tested or validated by CSS.
HTH,
A couple of good questions were asked on a recent blog post and I figured it was worthwhile to answer them in more detail in a separate post.
====================================
“Can you clarify a couple points related to Certificate Authorities and CRLs? I plan on getting a commercial certificate for the IP-HTTPS listener as you recommended, but how does that affect all of the other certificate related configurations in the test lab guide? The CA created on the domain server is completely separate from this commercial certificate, right?…”
The IP-HTTPS listener needs a web site certificate (intended use is server authentication) so that DirectAccess clients can establish an IP-HTTPS connection to the UAG DirectAccess server before establishing the DirectAccess IPsec tunnels. This requires mutual client and server authentication, something that is the default setting for UAG DirectAccess (the default for Windows DirectAccess is server authentication only).
The primary advantage of using a commercial certificate for the IP-HTTPS listener is that the commercial certificate provider maintains the Certificate Revocation List (CRL) and Distribution Points for you. Not only do they maintain that list for you, they also make sure that the CRL is highly available. While you could use your private PKI for the IP-HTTPS listener, you would then be responsible for maintaining the CRL and making sure that it it highly available.
Now how does this relate to what we did in the Test Lab Guide: Demonstrate UAG SP1 RC DirectAccess Test Lab Guide (http://www.microsoft.com/downloads/en/details.aspx?FamilyID=71be4b7b-e0e9-4204-b2b5-ac7f3c23b16d)?
In the Test Lab we actually created a certificate template that removed CRL related information so that the DirectAccess client would not fail its IP-HTTPS connection when the CRL wasn’t published. This simplified the TLG environment because we didn’t need to go through the steps of publishing the CRL. In your production environment, you do want to make sure that the CRL is available for your private PKI; so you wouldn’t use the special configuration we did for the web site certificate template we used in the TLG. However, you don’t need to publish your private CRL because the commercial provider is handling the IP-HTTPS certificate’s CRL Distribution Points.
You still want to use your private PKI to distribute computer certificates to the DirectAccess clients and the UAG DirectAccess server. You also want to distribute computer certificates to any machines that you want end-to-end IPsec transport mode protection. And you want to make sure that the CRL is available so that you can revoke certificates (however, revoking certificates for DirectAccess clients is not an effective way to prevent them from connecting to the DirectAccess server – other methods should be used, such as disabling the computer account for the suspect DirectAccess client and changing the password of the user who lost the DirectAccess enabled computer). And you want to be able to use autoenrollment to make is easy to distribute the certificates.
The commercial certificate and the private certificates have no relationship to each other and don’t need any. The commercial certificate provider should be included in the Enterprise Root Certificate Authorities store on all your DirectAccess enabled machines.
========================================================
“And you mentioned that you wouldn't want to host the CRL on the DirectAccess server in a production environment. Is this only because of performance reasons or because of something else? And is this CRL not related to the IP-HTTPS listener? So, just to make sure I'm getting it, there is one CA and a corresponding CRL for the active directory domain, and then another CA/CRL (in this case commercial) for the DirectAccess connections. Is that right?…”
There are a number of reasons why you wouldn’t want to host the CRL Distribution Point web site on the UAG DirectAccess server, but probably the main one is that every time you reconfigure the DirectAccess settings using the UAG DirectAccess wizard, it will end up resetting your CRL Distribution Point web site. There are also traffic related reasons – since the CRL check requires anonymous access to the CRL Distribution Point web site, you increase both the amount of traffic and the attack surface on the UAG DirectAccess server.
You are correct that there are two CRLs in use in the DirectAccess scenario discussed here:
It’s important to note here that only a “soft” CRL check is done when the DirectAccess client connects to the UAG DirectAccess server. If the DirectAccess client fails the CRL check, it will still be allowed to connect. So whether or not the CRL is available doesn’t determine connectivity for your DirectAccess clients.
Tom Shinder tomsh@microsoft.com Principal Knowledge Engineer, Microsoft DAIP iX/Forefront iX UAG Direct Access/Anywhere Access Group (AAG) The “Edge Man” blog (DA all the time): http://blogs.technet.com/tomshinder/default.aspx Follow me on Twitter: http://twitter.com/tshinder Facebook: http://www.facebook.com/tshinder
Now for the moment you’ve all been waiting for – the answers to UAG SP1 DirectAccess Contest 1–Round 2/Quiz 2 and Contest 2 Round 1/Quiz 2!
Last week’s quiz was a bit different with some practical problem solving scenarios based on screenshots. Let’s see how you did:
===========================================
Question 1: Review the information in figure 1. (UAG1 is the UAG DirectAccess server and DC1 is on the intranet)
Figure 1
From the information provided to you in Figure 1, which of the following answers is most likely? (choose 1 answer) A. The Teredo server was moved off the UAG DirectAccess server B. The 6to4 relay router was moved off the UAG DirectAccess server C. The NAT64/DNS64 service was moved off the UAG DirectAccess server D. The ISATAP Router was moved off the UAG DirectAccess server
The answer to question 1 is D.
To be better understand the scenario, the figure below shows the network diagram for the test environment from which this screenshot was taken.
If you look at the screenshot we have three pieces of information we can use to determine the answer.
The first piece of information is the ping uag1 result. This returns a native IPv6 address assigned to the UAG DirectAccess server. In typical scenarios, when you ping the UAG server you will either see an ISATAP address returned, of if you’re using an IPv4 only network with the help of NAT64/DNS64, then you would see an IPv4 address. This indicates that the UAG DirectAccess server has a native IPv6 address assigned to its internal interface and is not using ISATAP to communicate with the internal network.
The second piece of information from from ping dc1. The ICMP Echo Reply is returned from an ISATAP address, indicating that ISATAP is being used on the internal network.
The third piece of information we have comes from tracert –d dc1. You’ll notice that the second hop returns an address on the same network ID as the IP address returned from the ping uag1. The last hop is to DC1, which is on an ISATAP subnet.
When you put these three pieces of information together, the best conclusion that you can draw is that there is a network device between the UAG DirectAccess server that is routing native IPv6 packets to an ISATAP enabled subnet. This device is an ISATAP router, which you can see in the network diagram as ISATAP1. Normally, the UAG DirectAccess server hosts the ISATAP server role – but in this scenario, the ISATAP router was moved to a separate machine.
Note that this network diagram is part of a larger network diagram that describes how to configure a multi-site UAG DirectAccess solution using ISATAP routers and a single ISATAP cloud for the intranet. I hope to be able to complete the documentation on that scenario soon and will post it here.
Question 2: Review the information in figure 2. (UAG1 is the UAG DirectAccess server and DC1 is on the intranet) (choose 1 answer)
Figure 2
From the information provided to you in Figure 2, what is the most likely roll for the machine with the IP address 2002:836b:4:8000:0:5efe:10.0.0.20 ? A. ISATAP router B. Windows Server 2008 R2 IPv6 RRAS router C. IP-HTTPS relay D. Teredo relay
The answer to question 2 is A.
Again, we have three pieces of information that we can work with to solve the problem.
The first piece of information comes from the ipconfig output. Here we can see the IPv4 and IPv6 addressing assigned to this computer – which is DC1 because we recognize the ISATAP address from the previous question. We also see a default gateway assigned to the ISATAP adapter, which is a link-local ISATAP address assigned to the machine with the IPv4 address 10.0.0.20. This indicates that 10.0.0.20 must be an ISATAP gateway (router).
The second piece of information comes ping uag1. Like in the first question, we see that UAG1 resolves to a native IPv6 address, which is consistent with the UAG DirectAccess server being assigned a native IPv6 on its internal interface and not using ISATAP itself.
The third piece of information comes from a tracert –d client1. The first hop address is the ISATAP assigned address to the machine that is assigned as the default gateway for the ISATAP adapter on DC1. The second hop comes from the native IPv6 addresses assigned to the internal interface of the UAG DirectAccess server. The third hop comes from a machine that is assigned an Teredo address, which you might not know since you don’t know the IP addressing on the external interface of the UAG DirectAccess server, but you do recognize that it is a native IPv6 address that is on a different network ID as the internal interface of the UAG DirectAccess server.
When we put these three pieces of information together it becomes clear that in order for DC1 to ping CLIENT1, it must travel over an ISATAP subnet, to an ISATAP router, which forwards the IPv6 packet over the native IPv6 subnet to the internal interface of the UAG DirectAccess server, which then routes the connection to the IP-HTTPS enabled DirectAccess client on the Internet.
================================================
Question 3:
Review the information in figure 3. Figure 3
Why is the first “quartet” for CLIENT1 different than the other IPv6 addresses on the network? (choose one answer) A. CLIENT1 is on a different ISATAP subnet B. CLIENT1 is on the Internet and has registered its IP-HTTPS address C. CLIENT1 is located behind a web proxy and has registered its 6to4 address D. CLIENT1 is located behind a NAT device and has registered its Teredo address
The answer to question 3 is D.
Answer A is incorrect because CLIENT1 is not assigned an ISATAP address. For more information on ISATAP addressing, see http://technet.microsoft.com/en-us/library/bb727021.aspx
Answer B is incorrect because CLIENT1 is “on the Internet” which implies that the machine is assigned a public IP address. When the machine is assigned a public IP address, it will register its 6to4 address. In addition, IP-HTTPS clients’ IPv6 address always start with 2002:
Answer C is incorrect because CLIENT1 is located behind a web proxy – which means that only IP-HTTPS is available to client and not 6to4.
Answer D is correct because CLIENT1 is located behind a NAT device and Teredo is used preferentially when the DirectAccess client is located behind a NAT device.
Wow! That was a good one – everyone did great and it shows that our DirectAccess contestants are pretty sharp when it come to IPv6. That’s a good thing, because I think that 2011 is going to be the Year of IPv6 given that we’ll run out of IPv4 allocations very soon.
Next Thursday I’ll post the last quiz in Content 1 and announce the winner! To make it even more interesting – I’m going to include FIVE questions. That will make it possible for anyone to get in the last jump to take home a winner for this round.
So set yourself up a reminder to check for the quiz on Friday January 28, 2011.
See you then!
It’s time for your weekly UAG DirectAccess quiz! We’re getting close to the end of contest 1, so make sure you don’t miss a step for the next two weeks.
Last week’s quiz was definitely tricky and introduced some obscure or difficult to find information. This week I’m going to try something a little different.
Remember to send your entries before 11AM Central Standard Time (-0600 UTC) on Monday January 24th.
To the questions!
Let’s see if this more “practical” approach to the questions is a bit less tricky than the quiz we had last week. This quiz is a nice test of your basic IPv6 knowledge – so good luck and have fun!
Send me your answers at:
by 11AM Central Standard Time (-0600 UTC) on Monday January 24th.
This question comes up frequently when introducing admins to UAG DirectAccess. It makes sense, since public IPv4 addresses are getting more difficult to come by and in fact it’s predicted that there will be an exhaustion of the entire IPv4 address space by next month. So, why do you need two public IP addresses on the external interface of the UAG DirectAccess server?
There’s a short answer and a long answer. Let’s begin with the short answer (hat tip to Ben Ben Ari, Senior Support Engineer at Microsoft):
“When the Teredo adapter is active on the DirectAccess client, it will check the Teredo server’s public IPv4 addresses to determine what type of NAT device the client is located behind. The assessment is performed to determine which on of the follow four types of NAT are in use: One-to-one NAT, also known as Full-cone NAT Address restricted cone NAT Port-restricted cone NAT Symmetric NAT The detection process starts with the Teredo client sending a Router Solicitation (RS) message to the Teredo server’s IP first address (the first of the two consecutive IPv4 addresses on the external interface on the UAG server used by DirectAccess). UAG then replies from the 2nd IP address. If the Teredo client receives the reply, it deduces that the NAT type is “Cone” (option 1 or 2 above). If the client does not receive this reply, then it issues a second RS message, but this time, UAG will reply from its first IP, instead of the second. If the client gets this reply, it now knows that the NAT type is either Port-restricted cone (type 3) or Symmetric (type 4) NAT. Next, the client sends a request to the UAG server’s second IP address (which also acts as a Teredo server), and waits for another answer. When the answer comes, if it is from the same IP as the first, this signals to the client that the NAT type is Port-restricted cone (type 3). If they are different, this means that NAT is mapping the same internal address and port number to different external addresses and port numbers, which means that this is a Symmetric NAT (type 4).”
“When the Teredo adapter is active on the DirectAccess client, it will check the Teredo server’s public IPv4 addresses to determine what type of NAT device the client is located behind. The assessment is performed to determine which on of the follow four types of NAT are in use:
The detection process starts with the Teredo client sending a Router Solicitation (RS) message to the Teredo server’s IP first address (the first of the two consecutive IPv4 addresses on the external interface on the UAG server used by DirectAccess). UAG then replies from the 2nd IP address. If the Teredo client receives the reply, it deduces that the NAT type is “Cone” (option 1 or 2 above). If the client does not receive this reply, then it issues a second RS message, but this time, UAG will reply from its first IP, instead of the second. If the client gets this reply, it now knows that the NAT type is either Port-restricted cone (type 3) or Symmetric (type 4) NAT.
Next, the client sends a request to the UAG server’s second IP address (which also acts as a Teredo server), and waits for another answer. When the answer comes, if it is from the same IP as the first, this signals to the client that the NAT type is Port-restricted cone (type 3). If they are different, this means that NAT is mapping the same internal address and port number to different external addresses and port numbers, which means that this is a Symmetric NAT (type 4).”
If you want even more detail, this may help check out the Teredo Overview:
http://technet.microsoft.com/en-us/network/cc917486.aspx
DirectAccess is about being “always-on”. When I start my laptop in the morning, I’m ready to get to work. Even though I don’t work on the Microsoft campus, I’m able to connect to anything I want (that I have permissions to connect to) on the Microsoft intranet without thinking about connecting to an SSL VPN portal, some web application gateway, or a traditional network layer VPN connection. I just start the laptop and BAM! I’m connected. And IT is always connected to me too, so my laptop is always up to date and managed by Microsoft IT.
DirectAccess connections consist of two IPsec tunnels that fire up when the Private or Public Windows Firewall with Advanced Profiles are assigned to the machine configured as a DirectAccess client. When the Public or Private Profile is active, the machine configured to be a DirectAccess client will attempt to establish two IPsec tunnels with the DirectAccess server:
The infrastructure tunnel is established after computer certificate authentication and computer account NTLMv2 authentication. The infrastructure tunnel allows the DirectAccess client to connect to key resources on the intranet, such as domain controllers and management servers (WSUS, SCCM, SCOM, etc.). Intranet tunnel connectivity enables you to always manage the DirectAccess client, even if the user isn’t logged on to the computer. In addition, the intranet tunnel provides the connectivity required for the user to log on and establish the intranet tunnel.
The intranet tunnel is established after both computer certificate and user account Kerberos authentication is successful. In order to complete the user account authentication (Kerberos), the user needs access to a domain controller. That’s why you need the infrastructure tunnel to come up before the second tunnel can be established. The intranet tunnel cannot be established by using cached credentials on the client.
So what does this all to do with 3G connectivity? Mobile computers with 3G adapters are becoming increasingly popular. These 3G adapters are tremendously convenient, as you no longer need to depend on being able to connect to whatever local network where you might be physically located . All of us have gone through “the drill” of trying to connect to a customer’s network, a hotel network, or some public Wi-Fi network. Sometimes it’s easy, but more often than not there are some bumps that eat into your productivity. The 3G adapter allows you to get around those time-eating complications.
The problem is that not all 3G adapters and their supporting software are the same. The following describes an interesting issue that came up when a customer was using a particular 3G adapter:
“This morning I tested the “always-on” 3G connection scenario with my Rogers 3G adapter (http://www.rogers.com/web/content/wireless_network) and the built-in 3G GOBI (built-in mobile broadband technology - http://www.gobianywhere.com/) adapter in my HP Tablet and found that when using the Rogers USB 3G adapter an “always-on” connection is not possible, but when using an integrated 3G GOBI module it is possible (it really comes down to the software that is provided). The details of my test methodology and results are below… Rogers Rocket™ Stick – The Rogers Communication Manager software runs in User Mode only (does not run as a Service), so the connection is invoked when a user is logged on and disconnected when the user logs off. There is an “Auto-Connect” checkbox, but it only makes the connection when a user logs on to the device. Therefore the current software provided by Rogers does not support an “always-on” scenario. I verified this by looking at the activity light on the USB stick itself – Red is device is not ready, solid Blue is network detected, blinking Blue is network connected and active. For the duration of the test the activity light remained sold Blue, indicating that a connection to the 3G network was never established. It only began blinking after I logged in to the computer. HP Built-In 3G GOBI Adapter – The HP software is installed as a Service that can be configured to automatically start at boot (in the Services console), and there is also an option to “Auto-Connect” to the 3G broadband. Since the HP Tablet does not have external lights to indicate network activity I had to find another method to determine if the 3G connection was active prior to logon, so I did the following: Disabled the wireless adapter, so that the HP Tablet could only connect using the 3G broadband Installed the Windows Live Mesh software on the HP Tablet, added the HP Tablet to my managed device list and configured it to allow remote connections I completely shut down the HP Tablet, then turned it on (cold boot) and left it alone (did not log on) At my other computer (Lenovo laptop), I logged on to http://mesh.live.com and was able to successfully Remote Desktop to my HP Tablet via the website To verify that only the 3G broadband connection was active, from the Remote Desktop session I checked the active network connections on the HP Tablet, then double-checked by logging on to the HP Tablet locally – and yes, throughout the entire time the only active connection was the 3G broadband. Therefore the HP built-in 3G adapter (with a Rogers SIM), appropriately configured, will allow for an “always-on” 3G connection that could be used for device management prior to user logon. A similar test would have to be run for the any other 3G adapter you will be using to verify if the 3G adapter’s software provides the same capability.”
“This morning I tested the “always-on” 3G connection scenario with my Rogers 3G adapter (http://www.rogers.com/web/content/wireless_network) and the built-in 3G GOBI (built-in mobile broadband technology - http://www.gobianywhere.com/) adapter in my HP Tablet and found that when using the Rogers USB 3G adapter an “always-on” connection is not possible, but when using an integrated 3G GOBI module it is possible (it really comes down to the software that is provided). The details of my test methodology and results are below…
Rogers Rocket™ Stick – The Rogers Communication Manager software runs in User Mode only (does not run as a Service), so the connection is invoked when a user is logged on and disconnected when the user logs off. There is an “Auto-Connect” checkbox, but it only makes the connection when a user logs on to the device. Therefore the current software provided by Rogers does not support an “always-on” scenario. I verified this by looking at the activity light on the USB stick itself – Red is device is not ready, solid Blue is network detected, blinking Blue is network connected and active. For the duration of the test the activity light remained sold Blue, indicating that a connection to the 3G network was never established. It only began blinking after I logged in to the computer.
HP Built-In 3G GOBI Adapter – The HP software is installed as a Service that can be configured to automatically start at boot (in the Services console), and there is also an option to “Auto-Connect” to the 3G broadband. Since the HP Tablet does not have external lights to indicate network activity I had to find another method to determine if the 3G connection was active prior to logon, so I did the following:
Therefore the HP built-in 3G adapter (with a Rogers SIM), appropriately configured, will allow for an “always-on” 3G connection that could be used for device management prior to user logon. A similar test would have to be run for the any other 3G adapter you will be using to verify if the 3G adapter’s software provides the same capability.”
Later another interesting finding was that with the HP GOBI 3G adapter, if the user logged off the computer the 3G adapter shut down and does not start again until the user logs on again or until the machine is restarted.
When considering a 3G solution to work with your DirectAccess capable mobile computer, make sure to check on the adapter software’s connectivity behavior. The adapter should be able to initialize and connect to the 3G network before the user logs on to the DirectAccess client computer. You can use the methods described in this article to determine if the adapter is capable of this behavior.
(Hat tip to Pat Telford for informing me of this issue.)
Here you go:
Question 1:
ISATAP is an IPv6 transition technology that enables computers to tunnel IPv6 packets inside an IPv4 header. Which of the following scenarios are enabled when ISATAP is enabled on your network (select all correct answers):
A. ISATAP hosts on an IPv4 only network can communicate with hosts on an IPv6 only network B. ISATAP hosts on an IPv4 only network can initiate connections to DirectAccess clients C. DirectAccess clients can only communicate with ISATAP hosts on the intranet D. ISATAP is required for all DirectAccess deployments
The answer to question 1 is A and B.
An ISATAP router can be placed on an intranet and enable routing from an IPv4 network to an IPv6 network. The ISATAP hosts on the IPv4 network can tunnel their IPv6 communications inside an IPv4 header and send the IPv4 encapsulated packets to the ISATAP router. When they reach the ISATAP router, the IPv4 header is removed and the IPv6 packet is forwarded to its destination on the IPv6 portion of the intranet. DirectAccess clients “live” in an IPv6 only network, since all communications sent and received by DirectAccess clients are IPv6. When an ISATAP host on the intranet initiates a connection to a DirectAccess client, it tunnels an IPv6 packet in an IPv4 header and forwards it to an ISATAP router (typically installed on the UAG DirectAccess server itself). Then the IPv4 header is removed and the IPv6 packet is forwarded to the DirectAccess client.
DirectAccess clients can communicate with non-ISATAP (and non-IPv6 capable) hosts on the intranet because UAG DirectAccess includes the NAT64/DNS64 service that performs IPv6/IPv4 protocol translation. For this reason, ISATAP is not required for all IPv6 deployments. However, only ISATAP hosts and machines that have native IPv6 addressing can initiate connections to DirectAccess clients.
Question 2: The number of concurrent Teredo clients per UAG DirectAccess server is determined by the Neighbor cache limit. What is the default number of Teredo clients per server support for UAG DirectAccess? A. 64 B. 128 C. 256 D. 512
The answer to question 2 is C.
If you check the TechNet article at http://technet.microsoft.com/en-us/library/ee382271(WS.10).aspx you would have been led to believe that the answer is 128. However, if you go to your UAG server and run the command netsh interface ipv6 show global, you will see the following:
We then need to ask “is the 256 value specific for UAG DirectAccess”? I can’t tell you for sure as I don’t have any Windows DirectAccess labs up to check the default value. But the question was specific regarding “UAG DirectAccess server” and the default value for a UAG DirectAccess server is 256.
OK – it was a tricky question, but sometimes you have to check these things out on a live server
IP-HTTPS is a IPv6 transition technology that enables a DirectAccess clients to connect to the UAG DirectAccess server even when the clients are located behind web proxy or port restricted firewalls. Which of the following statements are true regarding IP-HTTPS? A. IP-HTTPS has higher protocol overhead than Teredo and 6to4 B. IP-HTTPS has higher processing overhead than Teredo and 6to4 C. IP-HTTPS is required when Force Tunneling is enabled D. IP-HTTPS requires client certificate authentication to establish the SSL session
The answer to question 3 is A, B, C and D.
IP-HTTPS has higher protocol overhead because it puts an HTTP header on top of the IPv4 header that’s used by all three IPv6 transition technology. IP-HTTPS has higher processing overhead because in addition to the IPsec processing required by all DirectAccess connections, it adds SSL processing on top of that. IP-HTTPS is required when you want to do Force Tunneling, which is one of the reasons why you want to avoid Force Tunneling if you can.
The answer that tripped most of you was D. While not obvious, you can find information on this behavior at http://social.technet.microsoft.com/wiki/contents/articles/troubleshooting-the-no-usable-certificate-s-ip-https-client-error.aspx and http://technet.microsoft.com/en-us/library/ee731901(WS.10).aspx
This quiz was pretty tough – and the game is really close because of it!
I’m pretty sure I got all of the entries this time (I missed a couple of you in the last quiz). If you sent in an entry and don’t see your score recorded, please let me know so that I can score your entry and get it into the leaderboard.
Make sure to check late Thursday or Friday this week for the next quiz. I’m hoping to get a “video question” up so that you’ll need to watch a short video to solve the problem.
(If you didn’t participate in Quiz 1 – you can read the rules of the game over at http://blogs.technet.com/b/tomshinder/archive/2010/12/02/uag-sp1-directaccess-contest-quiz-one-round-one.aspx)
It’s time for Contest 1-Round 2/Quiz 2 and Contest 2-Round 1/Quiz 2
Send your entries until 11AM Central Standard Time (-0600 UTC) on Monday January 17th.
The scores are really close and at this point, anyone can end up winning this round!
Now for the questions!
Now send your answers to me at (make sure to use this link since it contains the subject line I need):
This week was a big “catch up” week after the holidays so I didn’t get to put as much on the Edge Man blog this week. Next week I should have some nice “goodies” for you – so you’ll have something to look forward to.
Take a look at the figures below and see if you can guess what device is in the request/response path that you don’t typically see a UAG DirectAccess deployment.
First, the ipconfig output on a DirectAccess client located behind a NAT device:
Now let’s ping DC1:
Now let’s do a tracert from CLIENT1 and DC1:
Figure 3
With this information you should be able to figure out what the “novel” device is in the path between CLIENT1 and DC1. If you know, then consider yourself pretty well-versed with IPv6 addressing. If you don’t know, then here’s a great opportunity to learn something new!
Now take a look at figures 4 and 5 and determine what device was removed from the path:
Figure 4
Figure 5
Think about the solutions and put your answer in the comments section. Give your reasoning. I’ll post the answer and a network diagram of the solution tomorrow.
Have fun!
Now for the moment you’ve all been waiting for – the answers to UAG SP1 DirectAccess Contest 1–Round 2/Quiz 1 and Contest 2 Round 1/Quiz 1!
==========================================================
Answer to Question 1: When the DirectAccess client connects to the UAG DirectAccess server, it establishes two IPsec tunnels – the infrastructure tunnel and the intranet tunnel. All traffic destined to the intranet travels through these two IPsec tunnels with the exception of what type of traffic?
A. ICMPv6 B. ICMPv4 C. DCOM D. SIP (Session Initiation Protocol)
The answer to Question 1 is A.
From http://social.technet.microsoft.com/wiki/contents/articles/directaccess-forcing-encryption-for-icmpv6-traffic.aspx (DirectAccess: Forcing Encryption for ICMPv6 Traffic on the TechNet wiki):
“…By default, the DirectAccess Setup Wizard creates Group Policy objects for DirectAccess clients and servers for settings that allow the following behaviors: Internet Control Message Protocol (ICMP) traffic, for both Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6), is exempted from Internet Protocol security (IPsec) protection Teredo discovery traffic does not travel within the IPsec tunnels between DirectAccess clients and servers on the intranet…”
“…By default, the DirectAccess Setup Wizard creates Group Policy objects for DirectAccess clients and servers for settings that allow the following behaviors:
The trick here is in the question: “All traffic destined to the intranet travels….” The DirectAccess client only understands IPv6 and therefore does not send any ICMPv4 traffic to the intranet – only ICMPv6 traffic can be sent from the DirectAccess client to the intranet. Therefore, B cannot be true because ICMPv4 is never destined for the intranet. DCOM and SIP traffic are treated like any other non-ICMP traffic and both protocols are always sent through an IPsec tunnel when destined for the intranet.
Question 2: A DirectAccess client is connecting from behind a home NAT device to a UAG DirectAccess server. The user calls the Help Desk and says that he isn’t able to connect to anything on the intranet. You tell the user to open a command prompt and ping the name of a domain controller and the ping succeeds. Then you tell the user to ping the name of a file server and that ping succeeds. Next, you tell the user to ping the name of a web server and that ping succeeds. Then you tell the user to use the net use command to connect to a share on the file server and that fails. Next you tell the user to connect to a share on the domain controller and that attempt is successful. Finally, you tell the user to connect to the web server and that connection attempt fails.
What is the most likely reason for this user’s failure to connect to the resources he needs?
A. The Internet Service Provider is blocking IP Protocol 41 B. Kerberos authentication is failing C. NTLMv2 authentication is failing D. The DirectAccess client doesn’t trust the UAG server’s computer certificate
The answer to Question 2 is B.
Let’s look at what’s happening here:
When we look at this analysis, it becomes clear that the answer is B – that Kerberos authentication is failing. A is not correct because IP Protocol 41 is used by 6to4 – if the client were using 6to4, then even the pings would fail as the IPv6 transition technology would have failed; in addition, the client is connecting from behind a home NAT device, so 6to4 would not be used – IP-HTTPS or Teredo would be used in a NAT scenario. We know that NTLMv2 is not failing, because the infrastructure tunnel is working. And we know that the DirectAccess client trusts the UAG server’s computer certificate, since the client was able to establish the infrastructure tunnel.
========================================================== Question 3: Which of the following are new features included with UAG DirectAccess Service Pack 1?
A. Wizard based configuration of the DirectAccess Connectivity Assistant (DCA) B. Wizard based configuration of “manage only” DirectAccess client connectivity C. Support for Smart Card Authentication D. Support for One Time Password (OTP) Authentication
The answer to question 3 is A, B and D.
Support for Smart Card authentication was available in pre-SP1 UAG DirectAccess.
For more information on what’s new and improved with DirectAccess in UAG SP1, check out UAG 2010 SP1: The New and Improved DirectAccess Features http://blogs.technet.com/b/edgeaccessblog/archive/2010/10/27/uag-sp1-da-overview.aspx
This quiz was a pretty tough one that required you to have a pretty good understanding of the IPv6 transition technologies and authentication for DirectAccess IPsec tunnels. In the next quiz we’ll go more into IPv6 related questions to test some of your IPv6 chops.
The next quiz will be posted late in the day on Thursday, January 13, 2011.
Visit the TechNet forums to discuss all your UAG DirectAccess issues http://social.technet.microsoft.com/Forums/en-US/forefrontedgeiag/threads Stay up-to-date with “just in time” UAG DirectAccess information on the TechNet wiki http://social.technet.microsoft.com/wiki/tags/DirectAccess/default.aspx
It that time again! The UAG DirectAccess Contest. If you’ve been participating in Contest 1 Round 1, you know the drill.
If you’re new – don’t worry about Contest 1 – you’ll be automatically entered into Contest 2 and you’ll be participating in Round 1. And if you participated in Round 1 of Contest 1 but didn’t do so well, there’s still a chance to improve in Contest 2 – so make sure you send your entries.
You can find the rules of the game over at
http://blogs.technet.com/b/tomshinder/archive/2010/12/02/uag-sp1-directaccess-contest-quiz-one-round-one.aspx
There you go!
Send your entries until 9AM Central Standard Time (-0600 UTC) on Monday January 9th.
Good luck!
Just a quick note about the UAG DirectAccess contest. We didn’t have a quiz last week because of the entire world was on vacation
We’ll continue the contest this week with the next quiz being tomorrow, January 6, 2011.
The first round of the first contest is complete. The second round of the first contest starts with tomorrow’s quiz, which will be Quiz 1, Round 2.
Tomorrow quiz will also represent the first round in Contest 2. So even if you didn’t do well in Round 1 of Contest 1, you can get back in the game for Contest 2!
Quiz Dates for Contest 1/Round 2 and Contest 2/Round1 are:
The standings for Contest 1/Round 1:
For a review of the scoring methods, check out the first quiz at http://blogs.technet.com/b/tomshinder/archive/2010/12/02/uag-sp1-directaccess-contest-quiz-one-round-one.aspx
For Contest 1 Round 2/Contest 2 Round1 – I’m thinking of doing some more interesting things with the questions, like screenshots of something gone wrong and then looking for the answer to the most likely reason for the finding or what should you do next to determine the problem.
I’m looking forward to seeing your entries this week!
While I spend most (all) of my time working with the UAG DirectAccess solution, UAG DirectAccess is functionality essentially represents a superset of Windows DirectAccess functionality. Therefore, I thought it might be interesting to share with you all some questions I received from a fellow who is interested in deploying Windows DirectAccess. Maybe the questions and answers contained here will help you with your own planning for deploying DirectAccess in your SMB environment.
==============================
Question/issue 1: I’m in the process of putting together a DirectAccess solution for a small client of mine that needs the features of DirectAccess but can’t lay down the cash for multiple physical servers or UAG. They don’t need the additional complexities of access to IPv4 only resources as this is basically going to be a new network starting from scratch.
I know this may not be ideal from a performance perspective because of the many shared roles and limited scalability, but this is not going to be a network with many users; rather it will be a network of a dozen or so kiosks that will always be remotely connected. I’m starting to experiment some but haven’t found many resources for the absolute simplest implementation of DirectAccess.
I will certainly be going through the test lab documentation and other papers from Microsoft regarding the set up, but I thought I’d ask just in case anyone knows of some resources I haven't found yet (or just has some good tidbits of info themselves).
My concept is this:
What I’d ultimately really love is a "test lab" document similar to the one already out there from Microsoft but designed to interface with the real internet instead of a fake internet. The document makes several references to "problems" trying to adapt that test environment into a real world scenario, but it doesn’t give a whole lot of information about what "problems" they are referring to.
ANSWER: First off, these are great questions and thanks for sending them my way. Examples of planning for real-world deployments help everyone on their trek to DirectAccess goodness.
Since your customer can’t afford UAG at this time (maybe he will in the future as the company grows), the place to start is with the Windows DirectAccess solution. You are right that you will not have support for IPv4-only resources on the intranet, and your high availability options are somewhat limited. But you recognize these conditions and we can work within these parameters.
We generally recommend that you don’t put the Network Location Server on the domain controller, especially in pure IPv6 scenarios for some reasons regarding interface timings. While I don’t have the details in front of me, I have received information from a DirectAccess PM who strongly recommends that the Network Location Server not be placed on a DC – so if you could create a VM for the NLS, that would be a good way to go.
You can put the DirectAccess server in a virtual machine. However, there are performance implications and therefore we generally recommend that you put the DirectAccess servers on physical machines. With that said, you mention that this is going to be a relatively lightly used configuration, and therefore you might be able to get acceptable performance. You’ll need to monitoring your deployment and see if you are running into processor bottlenecks.
It is good that you’re planning on dedicated NICs for the virtual and physical interfaces. DirectAccess will perform better this way.
It’s also good you recognize that the firewall in front of the DirectAccess server will perform only firewall functionality and not NAT, because DirectAccess is not supported from behind a NAT device (although it can be done with the help of a few routing tricks, but that configuration is not supported by the product group).
Windows 7 Enterprise or Ultimate is required – so you’re good with the OS on your clients. Keep in mind that these must be domain members.
Regarding the problems that we suggest with the Test Lab Guides here are a few things that I can think of:
With those things in mind, you can create a “live” pilot deployment. I’d recommend that you obtain a commercial certificate for the IP-HTTPS listener, and not use the CRL checking disablement steps I deployed in the UAG DirectAccess Test Lab Guides.
-----------------------------------------
Question 2: What are the advantages/disadvantages of using a native IPv6 infrastructure (with a tunnel broker like Hurricane Electric) vs just using ISATAP? Are there any compelling reasons to go ahead and go native (especially if the network is going to be new with no legacy devices)?
ANSWER:
ISATAP is useful if your network infrastructure isn’t IPv6 aware, since you can tunnel your IPv6 traffic over IPv4 and use your current IPv4 routing infrastructure. However, if your routing, DNS and DHCP infrastructure is all IPv6 capable, there’s no need to deploy ISATAP and I’d recommend that you go native IPv6. You will need to configure your routers (and maybe the hosts) on your network so that they know the route back to the DirectAccess clients.
In most cases that will require that you make the DirectAccess server the IPv6 route of last resort since this is the only way to get the messages back to the 6to4 DirectAccess clients – or better, you can disable 6to4 on your DirectAccess clients and they will use Teredo instead – then your routing tables will be a bit “cleaner” and you want need to make the DirectAccess server the IPv6 route of last resort.
Question 3: What are the security implications with opening up inbound IPv6 traffic into your network? Since DirectAccess requires Protocol 41 traffic to be let through the firewall directly to the external NIC on the DirectAccess server, doesn't this open up some potential security issues without an IPv6 firewall in place? Maybe I am missing something, but since Protocol 41 is encapsulating ALL IPv6 traffic in IPv4 packets isn't letting Protocol 41 traffic through essentially the same thing as having a computer directly connected to the IPv6 internet with no firewall at all?
IP Protocol 41 is used to indicate that there is direct encapsulation of IPv6 packets within an IPv4 header to support 6to4. So, we’re not really allowing all IPv6 traffic through the firewall, just 6to4 traffic. Also, keep in mind that both of infrastructure tunnel and the intranet tunnel require authentication – for the infrastructure tunnel, both computer certificate and NTLMv2 authentication is required, and for the intranet tunnel, both computer certificate and Kerberos v5 authentication is required.
While all IPv6 traffic is allowed through the IPv4 tunnel – traffic to the DirectAccess server is allowed only after the client authenticates and establishes a valid IPv6 IPsec connection . We also have some Denial of Service Protection technology built into to take care of malicious users who try to take advantage of this situation, though. However, if you don’t think this is enough – you can take my earlier recommendation and disable 6to4 on the DirectAccess clients and let them use only Teredo or IP-HTTPS. Keep in mind that this is the same situation – the Teredo and IP-HTTPS clients are also encapsulating all IPv6 traffic. But the same protections still apply regarding IPsec and DoSP.
I hope you find these answers helpful and would be happy to carry on the conversation in the comments section.