Enabling Secure Always-On Connectivity [Name] Microsoft Corporation

Microsoft Confidential MOBILE & DISTRIBUTED WORKFORCE CENTRAL OFFICE BRANCH OFFICES REMOTE WORK

Microsoft Confidential “I+4A” Trusted Hardware SecureFoundation Core Security Components Identity Claims Authentication Authorization Access Control Mechanisms Audit Trusted People TrustedStack Trusted Data Trusted Software Integrated Protection SDL and SD3 SD3 SDL and SD3 SD3 Defense in Depth ThreatMitigationThreatMitigation

Microsoft Confidential Supporting IT Professionals Addressing User Needs Secure & Flexible Infrastructure DirectAccess VPN Reconnect & Mobile Broadband Reduce Costs BranchCache™ & SMB Enhancements URL based QoS Support for Green IT Work Anywhere Infrastructure DirectAccess VPN Reconnect Mobile Broadband Fast Access BranchCache™ SMB Enhancements

Microsoft Confidential Comprehensive anywhere access solution available in Windows 7 and Windows Server 2008 R2 Provides seamless, always-on, secure connectivity to on-premise and remote users alike Eliminates the need to connect explicitly to corpnet while remote Facilitates secure, end-to-end communication and collaboration Leverages a policy-based network access approach Enables IT to easily service/secure/update/provision mobile machines whether they are inside or outside the network

Microsoft Confidential RODC Secure Boundary Dedicated Resources Compliant Client Healthy Resources NPS/NAP Servers VPN Gateway Always-on connectivity across different networks X Lab, Client ISA FW, TSG 802.1x Non-compliant Client Device Internet Corporate Network A focus on driving access decisions based on “policy and a trusted identity,” rather than the limitations of network topology. Always on Always healthy Always secure Compliant Windows 7 Client Business Partner Downlevel or Mobile Client Cust FW Customer Site Compliant Windows 7 Client Requires users to connect (lost productivity) Client must be made healthy prior to network access (Lost productivity plus IT time and expense) Non-compliant Client Device

Microsoft Confidential DirectAccess Server Compliant Client IPsec/IPv6 Data Center and Business Critical Resources NAP / NPS Servers Internet Intranet User Enterprise Network Intranet User IPsec/IPv6 Assume the underlying network is always insecure Redefine CORPNET edge to insulate the datacenter and business critical resources Tunnel over IPv4 UDP, HTTPS, etc. Security policies based on identity, not location

DirectAccess Server DirectAccess Client Native IPv6 6to46to4 TeredoTeredo IP-HTTPSIP-HTTPS Tunnel over IPv4 UDP, HTTPS, etc. Internet

Enterprise Network DirectAccess Server Line of Business Applications No IPsec IPsec Integrity Only (Auth) IPsec Integrity + Encryption

Microsoft Confidential Always-on access to corpnet while roaming No explicit user action required – it just works Same user experience on premise and off Simplified remote management of mobile resources as if they were on the LAN Lower total cost of ownership (TCO) with an “always managed” infrastructure Unified secure access across all scenarios and networks Integrated administration of all connectivity mechanisms Healthy, trustable host regardless of network Fine grain per app/server policy control Richer policy control near assets Ability to extend regulatory compliance to roaming assets Incremental deployment path toward IPv6

Microsoft Confidential Microsoft Windows 7 clients Microsoft Windows 7 DirectAccess Server Application servers Windows Server 2008 (for native IPv6 support) Exception: When Windows Firewall Authentication policy is used, application servers must be Windows Server 2008 R2 DC/DNS servers Windows Server 2008 Exception: When two-factor authentication is required for end-to-end authentication a Windows 7 DC-based Active Directory NAT-PT server if IPv4 access is desired

Microsoft Confidential Trusted, compliant, healthy machine Windows 7 client Corporate Network Applications & Data DC & DNS (Win 2008) Internet Optional NATPT DirectAc cess Server (Win7) IPsec ESP tunnel using machine cert (DC/DNS access) IPsec ESP tunnel using machine cert and user credentials (App server access)

Microsoft Confidential Client tries to access.corpnet.com Looks in provisioned list for DNS server(s) associated with.corpnet Connects with DNS server (using IPsec. IPv6 is thru DAS What Happens At Client Client tries to connect to target IPv6 route again thru DAS. IPsec is required. What happens at DAS/DNS DAS lets thru AuthIP packets from client to DNS After negotiation, DAS lets ESP packets thru between client and DNS. DNS returns target address information to client. DNS registers clients current address information

Microsoft Confidential Client Server Receives configuration while directly connected to corpnet (provisioning) via Group Policy NAP used to check configuration and health when remotely connected DirectAccess wizard to set up DirectAccess Server(s) Policies controlled via Group Policy

Microsoft Confidential Facing Corpnet Gateway for native IPv6 IPv6 over IPv4 Service for Enterprise SATAP Relay IPsec Gateway (Tunnel Mode Endpoint) Forwarding Gateway for native IPv6 IPv6 over IPv4 services 6to4 relay Teredo Relay (optionally also Teredo Server) Facing Internet Firewall/Proxy Travel IP-TLS relay Internal IPsec Dos Protection

Microsoft Confidential Be ready to monitor IPv6 traffic Choose an Access Model: Full Intranet Access vs. Selected Server Access? Assess deployment scale

Microsoft Confidential Configure DirectAccess Server Requires Windows Server 2008 R2 Use DirectAccess server MMC Author DirectAccess policies for clients, application servers, DC/DNS and IPsec gateway Windows 7 Enterprise & Ultimate SKU Client Machines Done using DirectAccess configuration wizard Customize policies as needed

Microsoft Confidential Trusted, compliant, healthy machine Windows 7 client Corporate Network Applications & Data DC & DNS (Win 2008) NAP (includes Server & Domain Isolation [SDI]) Forefront Client Security Windows Firewall BitLocker + Trusted Platform Module (TPM) IAG SP2

Microsoft Confidential Evolution, not revolution Upgrade your network to an IPv6 end state Requires Windows 7 on the client Transition to Windows Server 2008 simplifies the solution Little or no change to applications – upgrade the server platform 30 Microsoft LOB applications today on Windows Server 2008 running end-to-end IPsec/IPv6 Additional 40 planned to upgrade in next two months Allows you to take concrete steps toward satisfying any IPv6 mandate Seamless integration with your current access and security solutions Seamless transition to DirectAccess over time Integrates with Forefront solutions

© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.