1. Getting to know UAG Tom Decaluwé
Blog:

2. Goal of today Help you understand what UAG is.
Help you get started with UAG Lingo
Help you get started with configuring UAG
What i prepped Certs + getting started wizard

3. Todays Agenda Some general thoughts on extranet / external access
What is UAG & compare with TMG
UAG architecture and internals
Using UAG to make you apps available
File access
Webserver publishing
Client / Server app publishing
TS publishing
SSTP network connectivity
Directaccess => 28/04 Sessions done by John Craddock
ADFS usage => 26/04 Sessions done by John Craddock
Q&A

4. General thoughs on extranet

5. The killer sentence
The ability to access any corporate application from anywhere in a secure manner, reliable and fast manner using any device if the business decides to do so.

6. Why do I need UAG in a world that is going cloud?
The chance of the future being a hybrid setup cloud + on prem is very big.
You will still need to give your clients access to internal apps
You will need a bridge between your corpnet and the could-nets. (think of ADFS publishing)

7. What is UAG & compare with TMG

8. What is UAG => an SSL VPN Secure Gateway with Direct Access wizard
Exchange
CRM
SharePoint
IIS based
IBM, SAP, Oracle
Mobile
Home / Friend / Kiosk
HTTPS / HTTP
Layer3 VPN
Terminal / Remote Desktop Services
HTTP(S)
( )
Internet
DirectAccess
Non web
Business Partners /
Sub-Contractors
Strong authentication
Endpoint health detection:
NAP and down-level
Authorization:
Based on health status
Who + where
Information leakage prevention
Attachment/Cache wiper
AD, ADFS,
RADIUS, LDAP….
NPS, ILM
Employees Managed
Machines

9. What is UAG & Compare the Edge
Unified platform for all enterprise remote access needs
Integrated and comprehensive protection from Internet-based threats

10. TMG vs UAG (at the publishing level)
De-emphesised on publishing
Limited to HTTP(s) publishing
Limited to auth as security
Client unaware
All in one box
UAG
The future of publishing
Portal approach
HTTP(s) + Client / server app + VPN (inclueding DA)
Health check and cleanup
Very flexibel authentication
Loads of pre-built templates
Very detailed reporting

11. Why do you see so little UAG being used?
Historical pricing => UAG used to bee expensive when it was still under the Whale communications flag and when first adopted by MS.
TMG is widely adopted and works really well as it’s a combo box.
Commission war => Integrates will make more money selling you and appliance than they will if you deploy UAG on your standard Dell/HP hardware and licenses bought through your VL agreements.
Lack of skilled UAG deployers & training 
Complex ?! to get to know and sometimes to use as it requires understanding of the internal app’s you are publishing.
Weak on creating equal look and feel internal  external

12. UAG architecture and internals

13. UAG Internal Architecture
Admin
Core
UAG Internal Architecture
Management UI
SCOM MP
Tracing & Logging
Session Manager
User Manager
Config. / Array Manager
Direct Access
Web Application Publishing
IP VPN
DirectAccess Server
Internal Site
Portal
TSG / RDG
RRAS
DTE / DoSP
SSL Tunnel
UAG Filter
Native IPv6
6to4
Teredo
IP-HTTPS
ISATAP
DNS-ALG
NAT-PT
SSTP
Layer 3
IIS
TMG
Windows NLB
UAG Logic
Windows Server

14. UAG in the core ISAPI extends the on the core functionality of IIS
InternalSite Vdirectory
New Vdirectories per portal

15. UAG buildup Group HTTP/HTTPS Trunk Application IP Port Logical unit
1 HTTP and 1 HTTPS trunk per IP
You can only bind to port 80 and 443
Colllection of settings and rules

16. Two Keywords in UAG lingo
Trunk
Application
Two types of trunks (*UAG can not publish on any other ports)
HTTP (TCP 80)
HTTPS (TCP 443)
Is like an IIS website or a TMG listener => ip + port
A redirect Trunk can redirect http to https not the other way.
Can be linked to the portal or direct to application
Two options
Portal trunk => homepage of UAG
ADFS trunk => SSO over the border of forests
+/- 40 tempaltes / 5 top-level apps
Build-in services (automatically added to trunk)
File access => ntfs shares
Web-Monitor => remote UAG mgt
Web (applications)
Sharepoint
Exchange
...
Other => create your own setup
Client/server and legacy
Apps that run outside of the browser
SSL vpn for specific apps
When launching an app the UAG client components loads
Remote Network Access => full network ssl vpn
Browser-embedded
Starts in browser en shifts to binary
Citrix
XenApp
Terminal services and remote desktop
5 templates

17. Create an application trunk and redirect trunk

18. Top Level policy Endpoint Policies One of UAG’s core features
Policies are a set of conditions that have to be met by the client inorde to gain access.
End result for blocked apps
set to gray out
hidden
Seem complex because they are 4 situations with each time 4 platforms and two ways to create them.
Creation
GUI driven
Scripted mode
Top Level policy
Access policy - Upload policy - Download policy - Restricted zone policy
Windows
MAC
Linux
Other

19. Require domain membership for
ADFS
KCD
File-Access
DirectAccess
UAG Arry

20. Using UAG to make you apps available
File system publishing
Webserver publishing
Client / Server App publishing
TS publishing
SSTP publishing
Directaccess => 28/04 Sessions done by John Craddock

21. Why use it
Not every filesystem has been migrated to sharepoint yet and not all filesystems will migrate to sharepoint.
People want access to the corp files any time and where.
It ensures mobile users can upload there important files to backup protected servers instead of their mobile clients.
Windows XP
Windows 7
Full transparent file access
Web based file access
Client experiance
Server Experiance

22. Configure File Access
You will need credentials of a user that can brows the network
Add the built-in service application > File access

23. Show File Access

24. Things to remember (File access)
The computer browser must be started and requires a chagne in the

25. Using UAG to make you apps available
File system publishing
Webserver publishing
Client / Server App publishing
TS publishing
SSTP publishing
Directaccess => 28/04 Sessions done by John Craddock

26. Application specific hostname vs portal hostname application
Non-AAM application
If the application can only be access using the portal trunk’s public name
HAT required for URL rewriting
Eg.
Trunk name =
App name=
Dynamics CRM, sharepoint 2003, exchange 2003
Application specific hostname application
AAM-like application
If an application can be configured using its own specific public hostname, which usually differs from the trunk pbulic name
Now requirement of HAT
Requires:
DNS to point both url’s to same UAG ip
Cert for both url’s
DNS suffix must match as session coockie is shared
Eg.
Trunk name =
App name= finance.extranet.com
OCS 2007, Forefront identiy manager, Sharepoint 2010, MS exchange 2010,...

27. What is URL signing Also known as Host Address Translation (HAT)
URL signing allows UAG to publish mulitple servers on a single ip (HostHeaders)
Add’s a url suffix to the TL domain
Incorporates link translation technology
UAG creates unique URL’s for each clickable link on the page by buffering the page and adding a uniqua SRA string ensuring you are always accessing the target UAG.
Supports
HTML
ASP
Java-script
Eg. uniquesig0/p.asp

28. Publish a web application

29. Using UAG to make you apps available
File system publishing
Webserver publishing
Client / Server App publishing
TS publishing
SSTP publishing
Directaccess => 28/04 Sessions done by John Craddock

30. What it does
Provides access to applicaions that where not designed for classic web and web publishing.
SSL tunneling
A client app listners for connectins tunnels and delivers to UAG
UAG client components has two parts
Health checking appications
SSL applications Tunneling
Socket forwarding component
Almost completely transparant to the end user

31. SSL Application Tunneling component
UAG
Back end server
SSL Tunneling component
:4785
SSL VPN

32. 2. Client/Server applications
A lot of templates (most used are below)
Generic
Generic client application
Uses Single SSL tunnel
Generic client application (multiple server)
With multiple server we mean multiple ports to the same or other back-end servers
Uses UAG’s Socket forwarding component
Generic silent client application
No client prompt
Enhanced => to tunnel the UAG client manipulates the client and changes (eg. Registry, config files, hosts file)
Hosts required => edit host file if fail to edit file => end
Hostes options => edit host file if fail to edit file => try to launch application
Hosts disabled => don’t edit host file
All launch an SSL-VPN & launch a srcipt to run the application on the client

33. Auto connect
%localip%

34. 2. Client/Server applications
A lot of templates (most used are below)
Enhanced HAT
Address translation beyond the scope of normal URL rewriting. Eg. A PDF file with a link => a click on that link, UAG sees the unavailable server requests and sens an HTTP 302 redirect to the client with the UAG public trunck as link, from now on the client will redirect all this traffic tot he public trunck name.
Generic http proxy enabled client application
Allow http proxying
Generic socks enabled client application
Allow socks 4/5 porxying
Citrix program neighbourhood (direct)
Replaced rpc over https for clients that don’t support it,...

35. Thing to remember
Apps use the local loopback x and a port locally
If SSL tunneling does not work 3 alternatives
Network Connector (NC) => tunnels all traffic to the internal network by creating a virtual NIC with ip address (SSL-VPN)
Secure Socket Tunnelling Protocol (SSTP) => uses built in windows components, with auto client configuration (win7 and vista sp1 only)
DirectAccess (DA) => ipsec tunneling

36. Publish telnet

37. Using UAG to make you apps available
File system publishing
Webserver publishing
Client / Server App publishing
TS publishing
SSTP publishing
Directaccess => 28/04 Sessions done by John Craddock

39. Things to know
How to create the tspub file

40. Using UAG to make you apps available
File system publishing
Webserver publishing
Client / Server App publishing
TS publishing
SSTP publishing
Directaccess => 28/04 Sessions done by John Craddock

41. Remote SSL VPN NC SSTP For down level clients Creates a virutal NIC
Win7 and above
Uses OS-built in SSTP

42. The hidden application
The app will dynamically detec
If you are win7 or downlevel client
And activate SSTP or NC accordingly

43. Publish VPN

44. Thing to rembmer Cert chain must be ok also for computer container
Root cert trusted
CRL available
Your internal servers must know how to route to those addresses

45. OK OK OK Goal of today Help you understand what UAG is.
Help you get started with UAG Lingo
Help you get started with configuring UAG OK OK

46. Q&A

47. More info http://blogs.technet.com/b/edgeaccessblog/

48. Speaker info: please do not delete the slides in this section
Show these slides at the end of your session before going to Thank you page.

49. Stay up to date with TechNet Belux
Register for our newsletters and stay up to date:
Technical updates
Event announcements and registration
Top downloads
Join us on Facebook
LinkedIn:
Download MSDN/TechNet Desktop Gadget
Please keep this slide

50. TechDays On-Demand
Watch this session on-demand via TechNet Edge
Download to your favorite MP3 or video player
Get access to slides and recommended resources by the speakers

51. If you have any more questions on anything, come and visit me at the ask the experts booth.
THANK YOU
Tom Decaluwé
Blog: