topic Re: MS Direct Access in General Topics

MS Direct Access

almay — Wed, 20 Mar 2013 04:37:05 GMT

Any one setup MS Direct Access?

I have a MS consultant stating that all that is needed is to set up a NAT and add a security policy to allow TCP 443 and IP Protocol 41.

Here is the dumb question...

How do you allow IP Protocol 41?

Re: MS Direct Access

_slv_ — Wed, 20 Mar 2013 07:45:17 GMT

I tryed to find "UAG" or Direct acces on Application Research Center

But it seems that this apllication doesnt has a their own signature.

In my opinion you have to make a port redirection (NAT rule) and security rule that will allow _all_ application, and it you will have estabilised session take a look into Monitor > Traffic - you will see how this traffic is categorised by PAN.

Regards

SLawek

Re: MS Direct Access

mikand — Wed, 20 Mar 2013 07:49:41 GMT

According to Application Research Center the appid should be "ipv6":

Description

The technique of encapsulating IPv6 packets within IPv4 so that they can be carried across IPv4 routing infrastructures. While the IPv6 infrastructure is being deployed, the existing IPv4 routing infrastructure can remain functional and can be used to carry IPv6 traffic. Examples of IPv6 tunneling mechanisms are 6in4, 6to4.

The 6in4 stuff is the "protocol 41" according to 6in4 - Wikipedia, the free encyclopedia

Generally speaking if you have setup a "deny + log" rule in the end of your security policy set you should be able to see in the traffic log how the blocked traffic is being identified as.