Server 2012 - DirectAccess - Still 2 tunnels from client to DirectAccess server?
Question
-
Does DirectAccess client in 2012 still create two tunnels to the DirectAccess server? One IPsec Encapsulating Security Payload (ESP) tunnel with IP-TLS (Transport Layer Security) encryption using the machine certificate and one IPsec ESP tunnel with IP-TLS encryption using both the machine certificate and user credentials. I have been reading this artcile (http://blogs.technet.com/b/meamcs/archive/2012/05/03/windows-server-2012-direct-access-part-1-what-s-new.aspx) and from the way I read it, that is how it worked in Windows 2008 R2 however but it doesn't mention if there are any changes to the way this works in 2012.
Can anyone point me to a diagram or explanation from Microsoft on this in 2012?
This is what I have gathered from the above mentioned article but it is referring to Windows Server 2008 R2:
Direct Access clients create two tunnels to the Direct Access server. The first tunnel, the infrastructure tunnel, provides access to intranet Domain Name System (DNS) servers, Active Directory Domain Services (AD DS) domain controllers, and other infrastructure and management servers. The second tunnel, the intranet tunnel, provides access to intranet resources such as Web sites, file shares, and other application servers.
Notice that the Direct Access client establishes two IPsec tunnels:
IPsec Encapsulating Security Payload (ESP) tunnel with IP-TLS (Transport Layer Security) encryption using the machine certificate. This tunnel provides access to the DNS server and domain controller, allowing the computer to download Group Policy objects and to request authentication on the user’s behalf.
IPsec ESP tunnel with IP-TLS encryption using both the machine certificate and user credentials. This tunnel authenticates the user and provides access to internal resources and application servers. For example, this tunnel would need to be established before Microsoft Outlook could download e-mail from the internal Microsoft Exchange Server.My Microsoft Core Infrastructure & Systems Management blog - blog.danovich.com.au
