1 / 19

Forefront UAG 2010 DirectAccess and RDG

Forefront UAG 2010 DirectAccess and RDG. Idan Plotnik Security Engineer Forefront MVP. Help us to help you to help others …. A word on wording. In Windows 7 / Windows Server 2008 R2, Terminal Service (TS) was renamed to Remote Desktop Services (RDS) Other terminology changes:

arva
Download Presentation

Forefront UAG 2010 DirectAccess and RDG

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Forefront UAG 2010DirectAccess and RDG Idan Plotnik Security Engineer Forefront MVP

  2. Help us to help you to help others …

  3. A word on wording • In Windows 7 / Windows Server 2008 R2, Terminal Service (TS) was renamed to Remote Desktop Services (RDS) • Other terminology changes: • Terminal Services Gateway (TSG)  Remote Desktop Gateway (RDG) • Terminal Services Server  Remote Desktop Session Host • TS Broker  RD Connection Broker

  4. How SSLVPN works … RD/TS is published by tunneling its traffic without IAG or any other SSLVPN being able to control the traffic. RDP HTTPS Tunnel IAG RD/TS Client (MSTSC) RD Session Host (TS Server)

  5. What’s new in UAG In UAG RD/TS client traffic goes over HTTPS. The HTTPS tunnel is terminated at UAG, therefore, we can inspect the traffic. The traffic is then passed to the backend RD Session Host using the RDP protocol. UAG + RDG RDP RDP over HTTPS RD/TS Client (MSTSC) RD Session Host (TS Server)

  6. New functionality • UAG seamlessly integrates Terminal Services / Remote Desktop Gateway (TSG/RDG) to provide application level gateway for RDS applications. • Enables employees to securely access applications that are hosted on Terminal Server or their internal workstation • Benefits: • Enhanced security • Granular policies based on client health: • no anti-virus  no driver sharing • TS RemoteApps are integrated into UAG portal side-by-side with Web applications • Single sign-on experience

  7. DirectAccess • Providing seamless, secure access to enterprise resources from anywhere

  8. Always On • Always connected • No user action required • Adapts to changing networks

  9. Secure • Encrypted by default • 2 Factor AuthN • Strong Authentication! • Computer AuthN • User AuthN • Granular access control • Coexists with existing edge, health, and access policies

  10. Manageable • Reach out to previously untouchable machines • Allows remote clients to process Group Policies • Ongoing updates (AV/WSUS etc …) from the internal infrastructure • NAP integration for health compliance • Consolidate Edge Infrastructure

  11. VPN vs. DirectAccess - Value

  12. Internet DirectAccess Client (Windows 7) Forefront UAG DirectAccess Tunnel over IPv4 UDP, HTTPS, etc. Encrypted IPsec+ESP Native IPv6 6to4 Teredo IP-HTTPS

  13. Enterprise Network Forefront UAG DirectAccess Line of Business Applications No IPsec IPsec Integrity Only (Auth) Windows Server 2003 Windows Server 2008 Non-Windows Server IPsec Integrity + Encryption

  14. 3 Deployment Models

  15. End-to-Edgeencryption Corporate Network Trusted, compliant, healthy machine No overhead of encryption on application servers Edge enforces machine/user authentication and data encryption Least change from existing edge deployments Forefront UAG DirectAccess DC & DNS(Server 2008 SP2/R2) Windows 7 client Applications & Data (non-IPsec enabled) IPsec ESP tunnel encryption using machine cert (DC/DNS access) Internet IPsec ESP tunnel encryption using UserKerb/Health Cert/Smartcard for broad network access Clear Text traffic from client flows through encrypted tunnel to Corporate network resources

  16. End-to-EdgeEncryption + End to End IPsec Corporate Network No overhead of encryption on application servers (just authentication) DirectAccess Edge Encryption combined with End to End IPsec Server and Domain Isolation Trusted, compliant, healthy machine Forefront UAG DirectAccess DC & DNS(Server 2008 SP2/R2) Windows 7 client Applications & Data IPsec-enabled Internet IPsec ESP tunnel encryption using machine cert (DC/DNS access) IPsec ESP tunnel encryption using UserKerb/Health Cert/Smartcard for broad network access IPsec ESP-Null AuthIP Transport Traffic flows through encrypted tunnel to Corporate network resources

  17. End-To-End IPsec Transport Encryption Thin edge solution using IPsec Denial of Service Protection (DoSP) Service only allows IPSec & ICMP traffic Full End to End IPsec Encryption IP-HTTPS tunnel used for proxy scenarios only Corporate Network Forefront UAG DirectAccess Trusted, compliant, healthy machine DC & DNS(Server 2008 SP2/R2) Internet Windows 7 client Applications & Data IPsec-enabled IPsec ESP-encrypted transport to access Corporate network resources

  18. Extends access to LOB servers with IPv4 support Access for down level and non Windows clients Enhances scalability and management Simplifies deployment and administration Hardened Edge Solution MANAGED IPv6 Windows7 IPv6 Always On DirectAccess Windows7 UNMANAGED IPv4 VistaXP Extend support to IPv4 servers SSL VPN Forefront UAG DirectAccess IPv4 Non Windows PDA IPv4 UAG provides access for down level and non Windows clients UAG enhances scale and management with integrated LB and array capabilities. UAG improves adoption and extends access to existing infrastructure UAG uses wizards and tools to simplify deployments and ongoing management. UAG is a hardened edge appliance available in HW and virtual options

  19. DEMO

More Related