DirectAccessStepByStep.docx
- 文档编号:30727359
- 上传时间:2023-08-19
- 格式:DOCX
- 页数:56
- 大小:160.06KB
DirectAccessStepByStep.docx
《DirectAccessStepByStep.docx》由会员分享,可在线阅读,更多相关《DirectAccessStepByStep.docx(56页珍藏版)》请在冰豆网上搜索。
DirectAccessStepByStep
StepByStepGuide:
DemonstrateDirectAccessinaTestLab
MicrosoftCorporation
Published:
May2009
Updated:
October2009
Abstract
DirectAccessisanewfeatureintheWindows®7andWindowsServer®2008R2operatingsystemsthatenablesremoteuserstosecurelyaccessintranetsharedfolders,Websites,andapplicationswithoutconnectingtoavirtualprivatenetwork(VPN).ThispapercontainsanintroductiontoDirectAccessandinstructionsforsettingupatestlabtodemonstrateDirectAccesswithasimulatedInternet,intranet,andhomenetworkbyusingtheReleasetoManufacturing(RTM)orReleaseCandidate(RC)versionsofWindows7andWindowsServer2008R2.
CopyrightInformation
Thisdocumentsupportsapreliminaryreleaseofasoftwareproductthatmaybechangedsubstantiallypriortofinalcommercialrelease,andistheconfidentialandproprietaryinformationofMicrosoftCorporation.
ThisdocumentisprovidedforinformationalpurposesonlyandMicrosoftmakesnowarranties,eitherexpressorimplied,inthisdocument.Informationinthisdocument,includingURLandotherInternetWebsitereferences,issubjecttochangewithoutnotice.Theentireriskoftheuseortheresultsfromtheuseofthisdocumentremainswiththeuser.Unlessotherwisenoted,theexamplecompanies,organizations,products,domainnames,e-mailaddresses,logos,people,places,andeventsdepictedhereinarefictitious,andnoassociationwithanyrealcompany,organization,product,domainname,e-mailaddress,logo,person,place,oreventisintendedorshouldbeinferred.Complyingwithallapplicablecopyrightlawsistheresponsibilityoftheuser.Withoutlimitingtherightsundercopyright,nopartofthisdocumentmaybereproduced,storedinorintroducedintoaretrievalsystem,ortransmittedinanyformorbyanymeans(electronic,mechanical,photocopying,recording,orotherwise),orforanypurpose,withouttheexpresswrittenpermissionofMicrosoftCorporation.
Microsoftmayhavepatents,patentapplications,trademarks,copyrights,orotherintellectualpropertyrightscoveringsubjectmatterinthisdocument.ExceptasexpresslyprovidedinanywrittenlicenseagreementfromMicrosoft,thefurnishingofthisdocumentdoesnotgiveyouanylicensetothesepatents,trademarks,copyrights,orotherintellectualproperty.
©2009MicrosoftCorporation.Allrightsreserved.
Microsoft,Windows,ActiveDirectory,InternetExplorer,andWindows ServerareeitherregisteredtrademarksortrademarksofMicrosoft CorporationintheUnited Statesand/orothercountries.
Allothertrademarksarepropertyoftheirrespectiveowners.
Contents
Introduction7
Inthisguide8
Scenariooverview9
Hardwareandsoftwarerequirements10
Stepsforconfiguringthetestlab10
ConfigureDC112
InstalltheoperatingsystemonDC113
ConfigureTCP/IPonDC113
ConfigureDC1asadomaincontrollerandDNSserver14
InstallandconfigureDHCP15
CreateDNSArecords15
InstallanenterpriserootCAonDC116
CreateauseraccountinActiveDirectory17
CreateasecuritygroupforDirectAccessclientcomputers18
Createandenableacustomcertificatetemplate18
CreateandenablefirewallrulesforICMPv4andICMPv6traffic19
RemoveISATAPfromtheDNSglobalblocklist22
ConfigureCRLdistributionsettings22
Enablecomputercertificateauto-enrollment23
ConfigureDA124
InstalltheoperatingsystemonDA124
ConfigureTCP/IPproperties24
JoinDA1totheCORPdomain26
InstalltheWebServer(IIS)role27
CreateaWeb-basedCRLdistributionpoint27
ConfigurepermissionsontheCRLdistributionpointfileshare28
PublishtheCRLonDA129
ObtainanadditionalcertificateonDA129
ConfigureAPP130
InstalltheoperatingsystemonAPP131
ConfigureTCP/IPpropertiesonAPP131
JoinAPP1totheCORPdomain32
ObtainanadditionalcertificateonAPP132
InstalltheWebServer(IIS)role33
ConfiguretheHTTPSsecuritybinding33
Createasharedfolder34
ConfigureINET135
InstalltheoperatingsystemonINET135
ConfigureTCP/IPproperties35
Renamethecomputer36
InstalltheWebServer(IIS)andDNSserverroles37
CreateDNSArecords38
InstallandconfigureDHCP39
ConfigureNAT139
InstalltheoperatingsystemonNAT140
ConfigureNetworkConnectionsproperties40
ConfigureInternetConnectionSharing41
ConfigureCLIENT141
InstalltheoperatingsystemonCLIENT142
UserAccountControl42
JoinCLIENT1totheCORPdomain42
AddCLIENT1totheDA_Clientssecuritygroup43
VerifythecomputercertificateonCLIENT143
Testaccesstointranetresources44
Testaccesstothenetworklocationserver44
TestaccesstointranetresourcesfromtheInternetsubnet45
ConfiguringDirectAccess45
InstalltheDirectAccessfeatureonDA146
RuntheDirectAccessSetupwizardonDA146
UpdateIPv6settingsonAPP147
UpdateIPv6settingsonDC148
UpdateGroupPolicyandIPv6settingsonCLIENT148
VerifyISATAP-basedconnectivity48
VerifyingDirectAccessfunctionalityforCLIENT1whenconnectedtotheInternetsubnet49
ConnectCLIENT1totheInternetsubnet49
VerifyconnectivitytoInternetresources50
VerifyintranetaccesstoWebandsharedfolderresourcesonAPP150
ExaminetheCLIENT1IPv6configuration51
VerifyingDirectAccessfunctionalityforCLIENT1whenconnectedtotheHomenetsubnet51
ConnectCLIENT1totheHomenetsubnet52
VerifyconnectivitytoInternetresources52
VerifyintranetaccesstoWebandsharedfolderresourcesonAPP152
ExaminetheCLIENT1IPv6configuration53
DisableTeredoconnectivityonCLIENT153
VerifyintranetaccesstoWebandfileshareresourcesonAPP154
EnableTeredoconnectivityonCLIENT154
ConnectCLIENT1totheCorpnetsubnet55
DirectAccessMonitoringDNSErrorinWindowsServer2008R2RC55
AdditionalResources56
Appendix56
SetUACbehavioroftheelevationpromptforadministrators56
Introduction
DirectAccessisanewfeatureintheWindows®7andWindowsServer®2008R2operatingsystemsthatgivesuserstheexperienceofbeingseamlesslyconnectedtotheirintranetanytimetheyhaveInternetaccess.WithDirectAccessenabled,requestsforintranetresources(suchase-mailservers,sharedfolders,orintranetWebsites)aresecurelydirectedtotheintranet,withoutrequiringuserstoconnecttoaVPN.DirectAccessprovidesincreasedproductivityforamobileworkforcebyofferingthesameconnectivityexperiencebothinsideandoutsidetheoffice.
ITprofessionalscanbenefitfromDirectAccessinmanyways:
∙ImprovedManageabilityofRemoteUsers.WithoutDirectAccess,ITprofessionalscanonlymanagemobilecomputerswhenusersconnecttoaVPNorphysicallyentertheoffice.WithDirectAccess,ITprofessionalscanmanagemobilecomputersbyupdatingGroupPolicysettingsanddistributingsoftwareupdatesanytimethemobilecomputerhasInternetconnectivity,eveniftheuserisnotloggedon.ThisflexibilityallowsITprofessionalstomanageremotecomputersonaregularbasisandensuresthatmobileusersstayup-to-datewithsecurityandsystemhealthpolicies.
∙SecureandFlexibleNetworkInfrastructure.TakingadvantageoftechnologiessuchasInternetProtocolversion6(IPv6)andInternetProtocolsecurity(IPsec),DirectAccessprovidessecureandflexiblenetworkinfrastructureforenterprises.BelowisalistofDirectAccesssecurityandperformancecapabilities:
∙Authentication.DirectAccessauthenticatesthecomputer,enablingthecomputertoconnecttotheintranetbeforetheuserlogson.DirectAccesscanalsoauthenticatetheuserandsupportstwo-factorauthenticationusingsmartcards.
∙Encryption.DirectAccessusesIPsectoprovideencryptionforcommunicationsacrosstheInternet.
∙AccessControl.ITprofessionalscanconfigurewhichintranetresourcesdifferentuserscanaccessusingDirectAccess,grantingDirectAccessusersunlimitedaccesstotheintranetoronlyallowingthemtousespecificapplicationsandaccessspecificserversorsubnets.
∙ITSimplificationandCostReduction.Bydefault,DirectAccessseparatesintranetfromInternettraffic,whichreducesunnecessarytrafficontheintranetbysendingonlytrafficdestinedfortheintranetthroughtheDirectAccessserver.Optionally,ITcanconfigureDirectAccessclientstosendalltrafficthroughtheDirectAccessserver.
ThefollowingfigureshowsaDirectAccessclientontheInternet.
Inthisguide
ThispapercontainsinstructionsforsettingupatestlabanddeployingDirectAccessusingfourservercomputers,twoclientcomputers,WindowsServer2008R2RTMorRC,andWindows7RTMorRC.Thetestlabsimulatesanintranet,theInternet,andahomenetworkanddemonstratesDirectAccessindifferentInternetconnectionscenarios.
Important
Thefollowinginstructionsareforconfiguringatestlabusingtheminimumnumberofcomputers.Individualcomputersareneededtoseparatetheservicesprovidedonthenetworkandtoclearlyshowthedesiredfunctionality.Thisconfigurationisneitherdesignedtoreflectbestpracticesnordoesitreflectadesiredorrecommendedconfigurationforaproductionnetwork.Theconfiguration,includingIPaddressesandallotherconfigurationparameters,isdesignedonlytoworkonaseparatetestlabnetwork.
Attemptingtoadaptthistestlabconfigurationtoapilotorproductiondeploymentcanresultinconfigurationorfunctionalityissues.Forexample,inthistestlabconfiguration,youconfiguretheDirectAccessserverwithstaticIPv4addressesbutnodefaultgateways.Inapilotorproductiondeploymentonyourintranet,youmustconfigureadefaultgatewayonlyontheInternetinterfaceandstaticroutesontheintranetinterface.Toensureproperconfigurationandoperationforyour
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- DirectAccessStepByStep
![提示](https://static.bdocx.com/images/bang_tan.gif)