{"id":9233,"date":"2008-11-03T16:56:00","date_gmt":"1999-11-29T20:00:00","guid":{"rendered":"https:\/\/aidanfinn.com\/?p=9233"},"modified":"2008-11-03T16:56:00","modified_gmt":"1999-11-29T20:00:00","slug":"day-1-windows-networking-from-windows-vista-to-windows-7","status":"publish","type":"post","link":"https:\/\/aidanfinn.com\/?p=9233","title":{"rendered":"Day 1: Windows Networking &#8211; From Windows Vista to Windows 7"},"content":{"rendered":"<p>My battery is running flat (lesson: switch to &quot;power saver mode&quot; when running on batter you idiot!) so I&#8217;ll probably finish this one tomorrow &#8211; some of us Irish folks are meeting up tonight for a couple of drinks\/dinner.<\/p>\n<p>As you should know, the next generation TCP stack in Vista was a big change for the better.\u00a0 It offers solutions to serious productivity issues when teamed with Windows 2008.\u00a0 Reminder: the Tolley Group Study.<\/p>\n<p>Personal story: I&#8217;ve tried this with Vista accessing an SSL W2008 SharePoint server this week from Barcelona.\u00a0 The server is on the net in Dublin and I was on a crowded WiFi LAN.\u00a0 It was like being on the same LAN as the SharePoint server.\u00a0 I know that XP could not have had the same performance over this (very) latent link.<\/p>\n<p>The presenter is a woman from MS Turkey.\u00a0 Needs for now: IT Pros need flexibility, mobility and performance.\u00a0 Users want seamless networking.\u00a0 They don&#8217;t care about wifi, broadband, LAN, VPN, etc.\u00a0 Windows 7 offers:<\/p>\n<ul>\n<li>DirectAccess to services on W2008 R2  <\/li>\n<li>VPN Reconnect and Mobile Broadband  <\/li>\n<li>DNS Security  <\/li>\n<li>BranchCache  <\/li>\n<li>More SMB enhancements  <\/li>\n<li>URL based QoS &#8211; handy for dense web servers.  <\/li>\n<li>Support for Green IT &#8211; power savings I guess?<\/li>\n<\/ul>\n<p>Mobile Access: Had to patch them now.\u00a0 Hard to manage.\u00a0 We have some functionality with native installs of SCCM 2007.\u00a0 Difficult for users to access internal resource remotely.\u00a0 Windows 7 offers a &quot;corporate network boundary&quot; to include assets no matter where they are.\u00a0 Easier to service remote PC&#8217;s. <\/p>\n<p><strong><u>Direct Access<\/u><\/strong><\/p>\n<p>We now get a demo of the seamless remote access to internal resources.\u00a0 It works as if she was on the LAN in MS.\u00a0 It works over IPv6 &#8230; IPv6 addresses are unique across all machines in the world.\u00a0 A DirectAccess server monitors traffic on the border.\u00a0 The PC has a client.\u00a0 It scans the destination address.\u00a0 If it&#8217;s a corporate internal address the client traffic is directed to the DirectAccess server running on Windows Serve r0208 R2 &#8211; &quot;Split Tunnelling&quot;.\u00a0 You can use a proxy if you don&#8217;t like this process.\u00a0 This entire solution allows tunnelling over IPv4 UDP, TLS, etc.\u00a0 NAP can sit in here to ensure that the client only gains access if it is compliant with corporate policies.\u00a0 W2003 can be remotely accesses using IPv6 addresses &#8211; there&#8217;s a patch.\u00a0 IPSec is used to secure the session between the client and the DirectAccess server.\u00a0 It is not required within the corporate intranet but recommended (as usual &#8211; but rarely done).\u00a0 The solution assumes the client is on an insecure network.\u00a0 NAP assumes the client is non-complaint and must prove itself.<\/p>\n<p>Strategy:<\/p>\n<ul>\n<li>Be ready to deploy\/monitor IPv6  <\/li>\n<li>Full server or selected server access  <\/li>\n<li>How much bandwidth? <\/li>\n<\/ul>\n<p>Windows 7 clients:<\/p>\n<ul>\n<li>Windows 2008 R2 DirectAccess Server  <\/li>\n<li>DC, DNS, AD, PKI, Applciations server, etc &#8230; IPv6. <\/li>\n<\/ul>\n<p>During deployment:<\/p>\n<ul>\n<li>Use DirectAccess config wisard to set up server.<\/li>\n<\/ul>\n<p><strong><u>VPN Reconnect<\/u><\/strong><\/p>\n<p>Mobile broadband is unreliable.\u00a0 Windows 7 will persist network connectivity to automatically reconnect the VPN tunnel when the underlying network is back online.\u00a0 Seamless for the user.\u00a0 The policy defines how long of an outage is tolerated.\u00a0 Default is 30 minutes.<\/p>\n<p><strong><u>Mobile Broadband<\/u><\/strong><\/p>\n<p>Bad experience for user.\u00a0 Requires dodgy 3rd party software.\u00a0 More management.\u00a0 Windows 7 provides PNP for mobile broadband devices.\u00a0 End users just plug and connect.\u00a0 Better for network providers, admins and users.<\/p>\n<p><strong><u>Branch Office<\/u><\/strong><\/p>\n<p>There&#8217;s two optimised networking solutions, one for a deployment with a server and one without:<\/p>\n<ul>\n<li>Distributed Branch Cache: desktops\/laptops use broadcast to ID potential caching hosts on the LAN (only 1 VLAN) that already have downloaded the block ID&#8217;d by the hashing algorithm.  <\/li>\n<li>Host Based Brach Cache: Clients get the ID of the block and check a central cache on the LAN.\u00a0 It&#8217;s a single host over many VLAN&#8217;s (configured by GPO).\u00a0 If it&#8217;s already cached, get it locally, otherwise the client downloads and forwards to the cache.<\/li>\n<\/ul>\n<p>Either way, sessions\/locks are maintained.\u00a0 Read is optimised, a write uploads the entire file \ud83d\ude41\u00a0 GPO manages things.\u00a0 There is no current policy for aging\/retention of cached blocks.\u00a0\u00a0 We want to get rid of servers from the branch office but the best solution is host based (requiring W2008 R2 for cache and server).\u00a0 The services supported are file share (SMB) and web (HTTP\/HTTPS).\u00a0 SSL and signing supported.\u00a0 <\/p>\n<p>Deployment: Distributed &#8211; GPO, Host &#8211; Role installation.<\/p>\n<p><strong><u>SMB Enhancements<\/u><\/strong><\/p>\n<p>Transport Caching: The Win7 client caches open file share files locally.\u00a0 Reads are local.\u00a0 Writes are written to the server.\u00a0 User transparent.\u00a0 Better WAN performance for the user.<\/p>\n<p>Example.\u00a0 Client 1 downloads a file.\u00a0 Client 2 requests a download. Caching (distributed or host BranchCache) makes the blocks available to client 2 from client 1 or a server.\u00a0 Client 2 request a new open &#8211; it&#8217;s loaded from a local cache on client 2.<\/p>\n<p><strong><u>Improved Office Experience<\/u><\/strong><\/p>\n<p>Office is very chatty; constantly reading open file content.\u00a0 New optimisations consolidate this to a single stream of traffic.\u00a0 <\/p>\n<p><strong><u>Offline Files<\/u><\/strong><\/p>\n<p>We now get regularly admin controlled 2 way synchronisation of files &#8211; with windows for busy periods.\u00a0 This allows corporate data synchronisation and user experience optimisation over the WAN.<\/p>\n<p><strong><u>DNS Security<\/u><\/strong><\/p>\n<p>DNSSEC secures DNS against man-in-the-middle attacks.<\/p>\n<p><strong><u>URL QoS<\/u><\/strong><\/p>\n<p>QoS policies can be defined for specific URL&#8217;s.\u00a0 Consider a single web server with many web sites.\u00a0 Should all web sites be tarred with the same brush: some are more important than others.<\/p>\n<p><strong><u>Green IT<\/u><\/strong><\/p>\n<p>Wake on Wireless LAN: Wake up a host, perform maintenance, put it to sleep.<\/p>\n<p>Smart network Power: idle NIC&#8217;s are put to sleep.\u00a0 DON&#8217;T USE FOR &quot;SERVERS&quot;.\u00a0 Consider distributed BranchCache where clients rely on other clients for WAN optimisation.<\/p>\n<p><strong><u>Q&amp;A<\/u><\/strong><\/p>\n<p>BranchCache is based on block level tech. Similar to DFS-R but new code.<\/p>\n<p>Remote management via Direct Access gives seamless access for the IT Pro and user.\u00a0 Consider remote admin for ConfigMgr.\u00a0 It might now be dead.\u00a0 You can even ping a remote machine with this technology.<\/p>\n<p>BrachCache: <em>Any<\/em> write activity sends the entire file over the WAN, not just the changed blocks.\u00a0 BOO! Riverbed and Citrix still have a window, even if you only care about SMB and HTTP(S).<\/p>\n<p>The BranchCache is ACL&#8217;d and encrypted.\u00a0 Pre0-staging is possible but only via scripted download.\u00a0 MS provides a clever API for their or partner later use for direct media pre-staging (ideal solution).\u00a0 <\/p>\n<p>BranchCache generated the most questions and interest from this session.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>My battery is running flat (lesson: switch to &quot;power saver mode&quot; when running on batter you idiot!) so I&#8217;ll probably finish this one tomorrow &#8211; some of us Irish folks are meeting up tonight for a couple of drinks\/dinner. As you should know, the next generation TCP stack in Vista was a big change for &hellip; <a href=\"https:\/\/aidanfinn.com\/?p=9233\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;Day 1: Windows Networking &#8211; From Windows Vista to Windows 7&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[42],"tags":[],"class_list":["post-9233","post","type-post","status-publish","format-standard","hentry","category-teched-emea-it-pro"],"aioseo_notices":[],"jetpack_featured_media_url":"","amp_enabled":true,"_links":{"self":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/9233","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9233"}],"version-history":[{"count":0,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=\/wp\/v2\/posts\/9233\/revisions"}],"wp:attachment":[{"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9233"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9233"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aidanfinn.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9233"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}