Deploying Forefront UAG DirectAccess in 8 Easy Steps!

Based upon recently spending some time creating customer build guides, I thought it might be useful to provide a high-level list of steps for deploying Forefront UAG DirectAccess. This is not a exhaustive step-by-step walkthrough, but should cover the key high-level tasks involved. More detail can be found in the Forefront UAG DirectAccess TechNet documentation or by looking at Tom’s excellent Test Lab Guides (TLGs).

These steps are based upon deploying Forefront UAG DirectAccess using a single server topology combined with ISATAP to support IPv6 intranet connectivity and NAT64 to support IPv4 intranet resources. This is a likely scenario for deployments with a relatively small number of users and an existing IPv4 based intranet. 

Please Note: This deployment scenario does not include NAP or Smartcard authentication.

Step 1: Configure Supporting Infrastructure

• Create ISATAP, NLS and IP-HTTPS DNS records
• Create DirectAccess client and server security groups
• Create DirectAccess certificate templates

Step 2: Configure Network Location Server

• Create website and enrol/bind NLS certificate

Step 3: Prepare and Install UAG Server

• Install OS, activate, run Windows Update, join AD domain
• Configure network interfaces and amend bind order – see here
• Configure static routes – see here
• Enrol IP-HTTPS and IPsec certificates
• Install UAG + UAG Update 1 + UAG Update 2 + TMG SP1 + TMG SP1U1

Step 4: Configure UAG DirectAccess

• Enable NAT64/DNS64
• Define appropriate NRPT entries

Step 5: Configure DirectAccess Clients

• Enrol IPsec certificates
• Add clients to DirectAccess security group and reboot
• Install DCA client

Step 6: Configure Active Directory and DNS

• Add IPv6 prefixes and assign to AD sites
• Add DNS reverse lookup zones for IPv6 prefixes

Step 7: Test DirectAccess

• Test internal ISATAP
• Test external Teredo, 6to4 and IP-HTTPS

Step 8: Complete Post-Installation Tasks

• Define custom TMG rules for systems management (SCOM, SCCM, Cert Enrolment etc.)
• Apply UAG SCW hardening template
• Install and run UAG BPA

Hopefully this provides some structure to the recommended deployment process and should allow you to define a high-level checklist of the key tasks for a single server deployment.

Happy DA deployment!