Enabling Secure Always-On Connectivity Gustav Kaleta Partner Technology Advisor Microsoft Corporation

MOBILE & DISTRIBUTED WORKFORCE CENTRAL OFFICE BRANCH OFFICES REMOTE WORK

“I+4A” Trusted Hardware SecureFoundation Core Security Components Identity Claims Authentication Authorization Access Control Mechanisms Audit Trusted People TrustedStack Trusted Data Trusted Software Integrated Protection SDLSDL Defense in Depth ThreatMitigationThreatMitigation

Supporting IT Professionals Addressing User Needs Secure & Flexible Infrastructure DirectAccess VPN Reconnect & Mobile Broadband Reduce Costs BranchCache™ & SMB Enhancements URL based QoS Support for Green IT Work Anywhere Infrastructure DirectAccess VPN Reconnect Mobile Broadband Fast Access BranchCache™ SMB Enhancements

Comprehensive anywhere access solution available in Windows 7 and Windows Server 2008 R2 Provides seamless, always-on, secure connectivity to on-premise and remote users alike Eliminates the need to connect explicitly to corpnet while remote Facilitates secure, end-to-end communication and collaboration Leverages a policy-based network access approach Enables IT to easily service/secure/update/provision mobile machines whether they are inside or outside the network

RODC Secure Boundary Dedicated Resources Compliant Client Healthy Resources NPS/NAP Servers VPN Gateway Always-on connectivity across different networks X Lab, Client ISA FW, TSG 802.1x Non-compliant Client Device Internet Corporate Network A focus on driving access decisions based on “policy and a trusted identity,” rather than the limitations of network topology. Always on Always healthy Always secure Compliant Windows 7 Client Business Partner Downlevel or Mobile Client Cust FW Customer Site Compliant Windows 7 Client Requires users to connect (lost productivity) Client must be made healthy prior to network access (Lost productivity plus IT time and expense) Non-compliant Client Device

DirectAccess Server Compliant Client IPsec/IPv6 Data Center and Business Critical Resources NAP / NPS Servers Internet Intranet User Enterprise Network Intranet User IPsec/IPv6 Assume the underlying network is always insecure Redefine CORPNET edge to insulate the datacenter and business critical resources Tunnel over IPv4 UDP, HTTPS, etc. Security policies based on identity, not location

DirectAccess Server DirectAccess Client Native IPv6 6to46to4 TeredoTeredo IP-HTTPSIP-HTTPS Tunnel over IPv4 UDP, HTTPS, etc. Internet

Enterprise Network DirectAccess Server Line of Business Applications No IPsec IPsec Integrity Only (Auth) IPsec Integrity + Encryption

Always-on access to corpnet while roaming No explicit user action required – it just works Same user experience on premise and off Simplified remote management of mobile resources as if they were on the LAN Lower total cost of ownership (TCO) with an “always managed” infrastructure Unified secure access across all scenarios and networks Integrated administration of all connectivity mechanisms Healthy, trustable host regardless of network Fine grain per app/server policy control Richer policy control near assets Ability to extend regulatory compliance to roaming assets Incremental deployment path toward IPv6

Microsoft Windows 7 clients Windows Server 2008 R2 DC DNS servers Public Key Infrastrukture (PKI) computer certificates for authentication health certificates when using NAP Active Directory

Trusted, compliant, healthy machine Windows 7 client Corporate Network Applications & Data DC & DNS (Win 2008) Internet Optional NATPT DirectAc cess Server (Win7) IPsec ESP tunnel using machine cert (DC/DNS access) IPsec ESP tunnel using machine cert and user credentials (App server access)

Client tries to access.corpnet.com Looks in provisioned list for DNS server(s) associated with.corpnet Connects with DNS server (using IPsec. IPv6 is thru DAS What Happens At Client Client tries to connect to target IPv6 route again thru DAS. IPsec is required. What happens at DAS/DNS DAS lets thru AuthIP packets from client to DNS After negotiation, DAS lets ESP packets thru between client and DNS. DNS returns target address information to client. DNS registers clients current address information

Receives configuration while directly connected to corpnet (provisioning) via Group Policy NAP used to check configuration and health when remotely connected DirectAccess wizard to set up DirectAccess Server(s) Policies controlled via Group Policy Client Server

Facing Corpnet Gateway for native IPv6 IPv6 over IPv4 Service for Enterprise SATAP Relay IPsec Gateway (Tunnel Mode Endpoint) Forwarding Gateway for native IPv6 IPv6 over IPv4 services 6to4 relay Teredo Relay (optionally also Teredo Server) Facing Internet Firewall/Proxy Travel IP-TLS relay Internal IPsec Dos Protection

Be ready to monitor IPv6 traffic Choose an Access Model: Full Intranet Access vs. Selected Server Access? Assess deployment scale

Configure DirectAccess Server Requires Windows Server 2008 R2 Use DirectAccess server MMC Author DirectAccess policies for clients, application servers, DC/DNS and IPsec gateway Windows 7 Enterprise & Ultimate SKU Client Machines Done using DirectAccess configuration wizard Customize policies as needed

Trusted, compliant, healthy machine Windows 7 client Corporate Network Applications & Data DC & DNS (Win 2008) NAP (includes Server & Domain Isolation [SDI]) Forefront Endpoint protectio n Windows Firewall BitLocker + Trusted Platform Module (TPM) UAG

Evolution, not revolution Upgrade your network to an IPv6 end state Requires Windows 7 on the client Transition to Windows Server 2008 simplifies the solution Little or no change to applications – upgrade the server platform 30 Microsoft LOB applications today on Windows Server 2008 running end-to-end IPsec/IPv6 Additional 40 planned to upgrade in next two months Allows you to take concrete steps toward satisfying any IPv6 mandate Seamless integration with your current access and security solutions Seamless transition to DirectAccess over time Integrates with Forefront solutions

© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.