Module 1 - Implementing Advanced Network Services

11/17/2014
Module 1: Implementing Advanced Network Services

Contents:
Module Overview
Lesson 1:
Configuring Advanced DHCP Features
Lesson 2:
Configuring Advanced DNS Settings
Lesson 3:
Implementing IPAM
Lesson 4:
Managing IP Address Spaces with IPAM
Lab:
Implementing Advanced Network Services

Module Review and Takeaways
Module Overview
In Windows Server 2012, network services such as Domain Name System (DNS) provide critical
support for name resolution of network and Internet resources. Within DNS, DNS Security
Extensions (DNSSEC) is an advanced feature that provides a means of securing DNS responses to
client queries so that malicious users cannot tamper with them. With Dynamic Host Configuration
Protocol (DHCP), you can manage and distribute IP addresses to client computers. DHCP is essential
for managing IP-based networks. DHCP failover is an advanced feature that can prevent clients from
losing access to the network in case of a DHCP server failure. IP Address Management (IPAM)
provides a unified means of controlling IP addressing.
This module introduces DNS and DHCP improvements, and IP address management, and it provides
details about how to implement these features.
Objectives
After completing this module, you will be able to:
Configure advanced DHCP features.
Configure advanced DNS settings.
Implement IPAM.
Lesson 1 : Configuring Advanced DHCP Features

https://skillpipe.courseware-marketplace.com/reader/en-GB/Book/BookPrintView/f0dbeef0-b272-48dd-8dc9-110f5b924b47?ChapterNumber=3&FontSize=2&
1/66
11/17/2014
DHCP plays an important role in the Windows Server 2012 operating system infrastructure. It is the
primary means of distributing important network configuration information to network clients, and it
provides configuration information to other network-enabled services, including Windows
Deployment Services and Network Access Protection (NAP). To support a Windows Server-based
network infrastructure, it is important that you understand the DHCP server role. Windows Server
2012 improves the functionality of DHCP by providing failover capabilities.
Lesson Objectives
After completing this lesson, you will be able to:
Describe DHCP components.
Explain how to configure DHCP interaction with DNS.
Explain how to configure advanced DHCP scope designs.
Explain how DHCP works with IPv6.
Describe DHCP name protection.
Describe DHCP failover.
Explain how to configure DHCP failover.
DHCP Components Overview
DHCP is a server role that you can install on Windows Server 2012. With the DHCP server role, you
can ensure that all clients have appropriate IP addresses and network configuration information,
which can help eliminate human error during configuration. A DHCP client is any device that takes a
DHCP address, and that can request and retrieve network settings from a DHCP server service.
DHCP clients may be computers, mobile devices, printers, or switches. DHCP may also provide IP
address information to network boot clients.
When key network configuration information changes in the network, (such as the default gateway
2/66
11/17/2014
address), you can update the configuration using the DHCP server role without having to change the
information directly on each computer. DHCP is also a key service for mobile users who change
networks often. You can install the DHCP Server role on a stand-alone server, a domain member
server, or a domain controller.
DHCP consists of the components that are listed in the following table.
Component
Description
DHCP Server
After installing the DHCP Server role, the DHCP server is implemented as a service. This service can distribute
service
IP addresses and other network configuration information to clients who request it.
DHCP scopes
The DHCP administrator configures the range of IP addresses and related information that is allotted to the
server for distribution to requesting clients. Each scope can only be associated with a single IP subnet. A scope
must consist of:
A name and description
A range of addresses that can be distributed
A subnet mask
A scope can also define:
IP addresses that should be excluded from distribution
The duration of the IP address lease
DHCP options
You can configure a single DHCP server with multiple scopes, but the server must be either connected
directly to each subnet that it serves, or have a supporting and configured DHCP relay agent in place.
Scopes also provide the primary way for the server to manage and distribute any related configuration
parameters (DHCP options) to clients on the network.
DHCP options
When you assign the IP address to the client, you can also simultaneously assign many other network
configuration parameters. The most common DHCP options include:
Default Gateway IP address
DNS server IP address
DNS domain suffix
Windows Internet Name Service (WINS) server IP address You can apply the options at different levels.
They can be applied as follows:
Globally to all scopes
Specifically to particular scopes
To specific clients based on a class ID value
To clients that have specific IP address reservations configured
3/66
11/17/2014
Note: Internet Protocol version 6 (IPv6) scopes are slightly different, and will be discussed
later in this lesson.
DHCP database
The DHCP database contains configuration data about the DHCP server, and stores information about the IP
addresses that have been distributed. By default, the DHCP database files are stored in the
%systemroot%\System32\Dhcp folder. The DHCP database is a Microsoft JET database.
DHCP console
The DHCP console is the main administrative tool for managing all aspects of the DHCP server. This
management console is installed automatically on any server that has the DHCP role installed. However, you
also can install it on a remote server or Windows 8 client by using the Remote Server Administration Tools
(RSATs) and by connecting to the DHCP server for remote management.
How Clients Acquire IP Addresses

When you configure a Windows client operating system to use the DHCP service, upon startup the
client will use an ARP broadcast in its subnet to request IP configuration from any DHCP server that
may receive the request. Because DHCP uses broadcasts to initiate communications, DHCP servers
are limited to communication within their IP subnets. This means that there must be either a DHCP
server on each IP subnet, or a router configured to forward BOOTP traffic DHCP relay agent
configured on the remote subnet. The DHCP relay service, or BOOTP forwarding, can relay DHCP
broadcast packets as directed messages into other IP subnets across a router. The relay agent
acquires an IP address configuration on behalf of the requesting client on the remote subnet, and
then forwards that configuration to the client.
DHCP Leases
DHCP allocates IP addresses on a dynamic basis. This is known as a lease. You can configure the
duration of the lease. The default lease time for wired clients is eight days, but mobile or handheld
devices such as tablets should usually have a shorter lease duration. Typically, where there is a
higher turnover of devices or users, the lease time should be shorter; and where there is more
permanency, it should be longer. You can configure the lease settings in the DHCP console, under
the server name and either the IPv4 or IPv6 node, by clicking Scope, and then clicking Properties
dialogue.
When the DHCP lease reaches 50 percent of the lease time, the client attempts to renew the lease.
This automatic process occurs in the background. Computers might have the same IP address for a
long time if they operate continually on a network without being shut down. Client computers also
attempt renewal during the startup process.
DHCP Server Authorization

If the server is a domain member, you must authorize the Windows Server 2012 DHCP server role
in Active Directory Domain Services (AD DS) before it can begin leasing IP addresses. You must
be an Enterprise Administrator to authorize the DHCP server. Stand-alone Microsoft servers verify
whether a DHCP server is on the network, and do not start the DHCP service if this is the case.
4/66
11/17/2014
Windows PowerShell
You can use Windows PowerShell cmdlets to provide command-line support for managing DHCP.
To be able to use the DHCP cmdlets, you must load the DhcpServer module. In addition to providing
command-line support, PowerShell cmdlets are used if you want to script your DHCP management.
The following table includes a subset of the nearly 100 Windows Server 2012 PowerShell cmdlets for
managing DHCP.
cmdlet
Additional information
Add-DhcpServerInDC
You use cmdlet to add the specified computer running the DHCP server
service as an authorized DHCP server in AD DS.
Add-DhcpServerv4Class
You use this cmdlet to add an IPv4 vendor or user class to the DHCP
server service.
Add-DhcpServerv4ExclusionRange
You use this cmdlet to add an IP address exclusion range to an IPv4 scope.
Add-DhcpServerv4Failover
You use this cmdlet to add a new IPv4 failover relationship on the DHCP
server service.
Add-DhcpServerv4FailoverScope
You use this cmdlet to add one or more scopes to an existing failover
relationship.
Add-DhcpServerv4Filter
You use this cmdlet to add a media access control (MAC) address filter of
the DHCP server service, the filter can be used on an allow list or Deny
list.
Add-DhcpServerv4Lease
You use this cmdlet to add a new IPv4 address lease in the DHCP server
service for testing purposes.
Add-DhcpServerv4OptionDefinition
You use this cmdlet to add a new DHCPv4 option definition to the DHCP
server service.
Add-DhcpServerv4Policy
You use this cmdlet to add a new IPv4 policy to a DCHP server or a DHCP
scope.
Add-DhcpServerv4PolicyIPRange
You use this cmdlet to add an IP range to an existing scope policy.
Add-DhcpServerv4Reservation
You use this cmdlet to reserve the specified IPv4 address in the specified
DHCP scope for a specified client.
Add-DhcpServerv4Scope
You use this cmdlet to add an IPv4 scope on the DHCP server service.
For a complete list of the available cmdlets, refer to DHCP Server Cmdlets in Windows PowerShell:
http://go.microsoft.com/fwlink/?LinkID=386639
Windows Server 2012 R2 added or improved the DHCP cmdlets for additional functionality and to
support new features in Windows Server 2012 R2. The following table lists some of the cmdlets that
have been added or improved.
5/66
11/17/2014
Cmdlet
New or
Additional information
Improved
Add-DhcpServerSecurityGroup
New
You use this cmdlet to add security groups to a

DHCP server.
Add-DhcpServerv4MulticastExclusionRange
New
You use this cmdlet to add an IP address exclusion

range to a multicast scope.
Add-DhcpServerv4MulticastScope
New
You use this cmdlet to add a multicast scope on the

DHCP server.
Add-DhcpServerv4Policy
Improved
You use this cmdlet to add a new policy to either a

server or a scope. This cmdlet has been improved
so that it can now be used to specify lease duration
and also add fully qualified domain name (FQDN)based policies.
Get-DhcpServerDnsCredential
New
You use this cmdlet to get the credentials for an

account that the DHCP Server service uses to
register or deregister client records on a DNS
server.
Get-DhcpServerv4DnsSetting
Improved
You can now use this cmdlet to display DNS settings

of DHCP policies.
Get-DhcpServerv4MulticastExclusionRange
New
You use this cmdlet to retrieve the exclusion range

for a specified multicast scope.
Get-DhcpServerv4MulticastLease
New
You use this cmdlet to retrieve multicast leases for

a specified scope name.
Get-DhcpServerv4MulticastScope
New
You use this cmdlet to get information on multicast

scope objects.
Get-DhcpServerv4MulticastScopeStatistics
New
You use this cmdlet to get information on multicast

scope statistics.
For information about the DHCP cmdlets that were added or improved Windows Server 2012, refer
to What's New in DHCP in Windows Server 2012 R2:
Configuring DHCP Interaction with DNS
6/66
11/17/2014
During dynamic IP address allocation, the DHCP server creates resource records automatically for
DHCP clients in the DNS database. However, those records might not be deleted automatically when
the client DHCP lease expires. You can configure DHCP options to allow the DHCP server to own and
fully control the creation and deletion of those DNS resource records.
Configuring Dynamic DNS Updates

You can configure the DHCP service to control the way that resource records are updated in the DNS
database. The default setting for the Enable DNS
dynamic updates, available when you configure DHCP option 081, permits the client to provide its
fully qualified domain name (FQDN) and instructions to the DHCP server about how the server
should process DNS dynamic updates on its behalf. You configure this option on the DNS tab of the
Properties dialog box for the protocol node (IPv4 or IPv6), or per scope in the DHCP console. You
also can configure DHCP to perform updates on behalf of its clients to any DNS servers that support
dynamic updates.
By default, the DHCP server behaves in the following manner:
The DHCP server updates dynamically the DNS address host (A) resource records and pointer
(PTR) resource records only if requested by the DHCP clients. By default, the client requests that
the DHCP server register the DNS pointer (PTR) resource record, while the client registers its own
DNS host (A) resource record.
The DHCP server discards the host (A) and pointer (PTR) resource records when the clients lease
is deleted.
You can change the Enable DNS dynamic updates according to the settings below: option to
Always dynamically update DNS records so that it instructs the DHCP server to always
dynamically update DNS host (A) and pointer (PTR) resource records no matter what the client
requests. In this way, the DHCP server becomes the resource record owner because the DHCP
server performed the registration of the resource records. Once the DHCP server becomes the
7/66
11/17/2014
owner of the client computers host (A) and pointer (PTR) resource records, only that DHCP server
can update the DNS resource records for the client computer based on the duration and renewal of
the DHCP lease.
DNS PTR Registration

By default, the DHCP server updates dynamically both the client computers host (A) and pointer
(PTR) resource records. If you have not configured a DNS reverse lookup zone for the IP address
range being distributed, you can disable DNS registration. Prior to Windows Server 2012 R2, you had
to disable both host (A) and pointer (PTR) resource record registration. Windows Server 2012 R2
introduces the ability to disable just the PTR record registration. You configure the Disable
dynamic updates for DNS PTR records option on the DNS tab of the Properties dialog box for the
protocol node, either IPv4 or Internet Protocol version 6 (IPv6), or per scope in the DHCP console.
Configuring Advanced DHCP Scope Designs
You can configure advanced DHCP scope designs called superscopes. A superscope is a collection of
individual scopes that are grouped together for administrative purposes. This configuration allows
client computers to receive an IP address from multiple logical subnets even when the clients are
located on the same physical subnet. You can create a superscope only if you have created two or
more IP scopes already in DHCP. You can use the New Superscope Wizard to select the scopes that
you wish to combine to create a superscope.
Benefits of Superscopes
A superscope is useful in several situations. For example, if a scope runs out of addresses, and you
cannot add more addresses from the subnet, you can add a new subnet to the DHCP server instead.
This scope will lease addresses to clients in the same physical network, but the clients will be in a
separate network logically. This is known as multinetting. Once you add a new subnet, you must
configure routers to recognize the new subnet so that you ensure local communications in the
physical network.
A superscope is also useful when you need to move clients gradually into a new IP numbering
scheme. When you have both numbering schemes coexist for the original leases duration, you can
8/66
11/17/2014
move clients into the new subnet transparently. When you have renewed all client leases in the new
subnet, you can retire the old subnet.
Multicast Scopes
A multicast scope is a collection of multicast addresses from the Class D IP address range of
224.0.0.0 to 239.255.255.255 (224.0.0.0/3). These addresses are used when applications need to
communicate with numerous clients efficiently and simultaneously. This is accomplished with
multiple hosts that listen to traffic for the same IP address. Multicast addresses are used in addition
to the Network IP address.
A multicast scope is commonly known as a Multicast Address Dynamic Client Allocation Protocol
(MADCAP) scope. Applications that request addresses from these scopes need to support the
MADCAP application programming interface (API). Windows Deployment Services is an example of
an application that supports multicast transmissions.
Multicast scopes allow applications to reserve a multicast IP address for data and content delivery.
DHCP Integration with IPv6
IPv6 can configure itself without DHCP. IPv6-enabled clients have a self-assigned link-local IPv6
address. A link-local address is intended only for communications within the local network. It is
equivalent to the 169.254.0.0 self-assigned addresses IPv4 uses. IPv6-enabled network interfaces
can, and often do, have more than one IPv6 address. For example, addresses might include a selfassigned link-local address and a DHCP-assigned global address. By using DHCP for IPv6 (DHCPv6),
an IPv6 host can obtain subnet prefixes, global addresses, and other IPv6 configuration settings.
Note: You should obtain a block of IPv6 addresses from a Regional Internet Registry. There
are five regional Internet registries in the world. They are:
African Network Information Centre (AfriNIC) for Africa.
Asia-Pacific Network Information Centre (APNIC) for Asia, Australia, New Zealand, and
neighboring countries.
American Registry for Internet Numbers (ARIN) for Canada, many Caribbean and North
9/66
11/17/2014
Atlantic islands, and the United States.

Latin America and Caribbean Network Information Centre (LACNIC) for Latin America and
parts of the Caribbean region.
Rseaux IP Europens Network Coordination Centre (RIPE NCC) for Europe, Russia, the
Middle East, and Central Asia.
Stateful and Stateless Configuration

Whenever you add the DHCP server role to a Windows Server 2012 computer, you also install a
DHCPv6 server automatically. Windows Server 2012 supports both DHCPv6 stateful and stateless
configurations, described as follows:
Stateful configuration. Occurs when the DHCPv6 server assigns the IPv6 address to the client
along with additional DHCP data.
Stateless configuration. Occurs when the subnet router and client agree on an IPv6 automatically,
and the DHCPv6 server only assigns other IPv6 configuration settings. The IPv6 address is built by
using the network portion from the router, and the host portion of the address, which is generated
by the client.
DHCPv6 Scopes for IPv6

DHCPv6 scopes for IPv6 must be created separately from IPv4 scopes. IPv6 scopes have an
enhanced lease mechanism and several different options. When you configure a DHCPv6 scope, you
must define the properties listed in the following table.
Property
Use
Name and description
This property identifies the scope.
Prefix
The IPv6 address prefix is analogous to the IPv4 address range. It defines the network
portion of the IP address.
Preference
This property informs DHCPv6 clients which server to use if you have multiple DHCPv6
servers.
Exclusions
This property defines single addresses or blocks of addresses that fall within the IPv6
prefix but will not be offered for lease.
Valid and Preferred lifetimes
This property defines how long leased addresses are valid.
DHCP options
As with IPv4, there are many available options.
Configuring an IPv6 Scope

You can use the New Scope Wizard to create IPv6 scopes by performing this procedure:
10/66
11/17/2014
1.
In the DHCP console, right-click the IPv6 node, and then click New Scope.
2.
Configure a scope prefix and preferencefor example, fe80:409c:f385:9e55:eb82:: as the

prefix and 1 as the preference.
3.
Define the starting and ending IP addresses, and any exclusions.
4.
Configure the Preferred and Valid lifetime properties.
5.
Activate the scope to enable it.
What Is DHCP Name Protection?
You should protect the names that DHCP registers in DNS on behalf of other computers or systems
from being overwritten by other systems that use the same names. In addition, you should also
protect the names from being overwritten by systems that use static addresses that conflict with
DHCP-assigned addresses when they use unsecure DNS, and when DHCP is not configured for
conflict detections. For example, a UNIX-based system named Client1 potentially could overwrite
the DNS address that was assigned and registered by DHCP on behalf of a Windows-based system
also named Client1. A new feature in Windows Server 2012 called DHCP Name Protection addresses
this issue.
Name squatting is the term that describes the conflict that occurs when one client registers a name
with DNS, but that name is used already by another client. This problem causes the original machine
to become inaccessible, and it typically occurs with systems that have the same names as Windows
operating systems. DHCP Name Protection addresses this by using a resource record known as a
Dynamic Host Configuration Identifier (DHCID) to track which machines originally requested which
names. The DHCP server provides the DHCID record, which is stored in DNS. When the DHCP server
receives a request by a machine with an existing name for an IP address, the DHCP server can refer
to the DHCID in DNS to verify that the machine that is requesting the name is the original machine
that used the name. If it is not the same machine, then the DNS resource record is not updated.
You can implement name protection for both IPv4 and IPv6. In addition, you can configure DHCP
Name Protection at both the server level and the scope level. Implementation at the server level
11/66
11/17/2014
will only apply for newly created scopes.

To enable DHCP Name Protection for an IPv4 or IPv6 node, perform this procedure:
1.
Open the DHCP console.
2.
Right-click the IPv4 or IPv6 node, and then open the Property page.
3.
Click DNS, click Configure, and then select the Enable Name Protection check box.
To enable DHCP Name Protection for a scope, perform this procedure:

1.
Open the DHCP Microsoft Management Console (MMC).
2.
Expand the IPv4 or IPv6 node, right-click the scope, and the open the Property page.
3.
Click DNS, click Configure, and then select the Enable Name Protection check box.
What Is DHCP Failover?
DHCP manages the distribution of IP addresses in TCP/IP networks of all sizes. When this service
fails, clients lose connectivity to the network and all of its resources. A new feature in Windows
Server 2012, DHCP failover, addresses this issue.
DHCP Failover
DHCP clients renew their leases on their IP addresses at regular, configurable intervals. When the
DHCP service fails and the leases time out, the clients no longer have IP addresses. In the past,
DHCP failover was not possible because DHCP servers were independent and unaware of each
other. Therefore, if you configured two separate DHCP servers to distribute the same pool of
addresses, that could lead to duplicate addresses. Additionally, to provide redundant DHCP services,
you had to configure clustering and perform a significant amount of manual configuration and
12/66
11/17/2014
monitoring.
The new DHCP failover feature enables two DHCP servers to provide IP addresses and optional
configurations to the same subnets or scopes. Therefore, you now can configure two DHCP servers
to replicate lease information. If one of the servers fails, the other server services the clients for
the entire subnet.
Note: In Windows Server 2012, you can configure only two DHCP servers for failover, and
only for IPv4 scopes and subnets.
Configuring DHCP Failover

To configure DHCP failover, you need to establish a failover relationship between the two DHCP
servers services. You also must give this relationship a unique name. The failover partners
exchange this name during configuration. This enables a single DHCP server to have multiple
failover relationships with other DHCP servers if all servers have unique names. To configure
failover, use the Configuration Failover Wizard, which you can launch by right-clicking the IP node or
the scope node.
Note: DHCP failover is time sensitive. You must synchronize time between the partners in
the relationship. If the time difference is greater than one minute, the failover process will
halt with a critical error.
You can configure failover in one of the two following modes.
Mode
Characteristics
Hot standby
In this mode, one server is the primary server and the other is the secondary server. The primary server
actively assigns IP configurations for the scope or subnet. The secondary DHCP server assumes this role
only if the primary server becomes unavailable. A DHCP server can simultaneously act as the primary for
one scope or subnet, and the secondary for another. Administrators must configure a percentage of the
scope addresses to be assigned to the standby server. These addresses are supplied during the Maximum
Client Lead Time (MCLT) interval if the primary server is down. The default MCLT value is five percent of
the scope, for example, 5% of the available addresses are reserved for the secondary server. The
secondary server takes control of the entire IP range after the MCLT interval has passed. When the
primary server is down, addresses from the secondary server use a lease time equal to the MCLT, one
hour by default. Hot Standby mode is best suited to deployments in which a disaster recovery site is
located at a different location. That way, the DHCP server will not service clients unless there is a main
server outage.
Load sharing
This is the default mode. In this mode, both servers supply IP configuration to clients simultaneously. The
server that responds to IP configuration requests depends on how the administrator configures the load
distribution ratio. The default ratio is 50:50.
MCLT
The administrator configures the MCLT parameter to determine the amount of time a DHCP server
13/66
11/17/2014
should wait when a partner is unavailable, before assuming control of the address range. This value
cannot be zero, and the default is one hour.
Auto State Switchover Interval

A communication-interrupted state occurs when a server loses contact with its partner. Because the
server has no way of knowing what is causing the communication loss, it remains in this state until
the administrator manually changes it to a partner-down state. The administrator also can enable
automatic transition to partner-down state by configuring the auto state switchover interval. The
default value for this interval is 10 minutes.
Message Authentication
Windows Server 2012 enables you to authenticate the failover message traffic between the
replication partners. The administrator can establish a shared secretmuch like a passwordin the
Configuration Failover Wizard for DHCP failover. This validates that the failover message comes
from the failover partner.
Firewall Considerations
DHCP uses TCP port 647 to listen for failover traffic. The DHCP installation creates the following
inbound and outbound firewall rules:
Microsoft-Windows-DHCP-Failover-TCP-In
Microsoft-Windows-DHCP-Failover-TCP-Out
Demonstration: Configuring DHCP Failover

In this demonstration, you will see how to configure a DHCP failover relationship.
Demonstration Steps Configure a DHCP failover relationship

1.
Sign in on LON-SVR1 as Adatum\Administrator with the password Pa$$w0rd. Open the

DHCP management console. Note that the server is authorized, but that no scopes are
configured.
2.
Switch to LON-DC1. In Server Manager, click Tools, and then on the drop-down list, click
DHCP.
3.
In the DHCP console, launch the Configure Failover Wizard.
4.
Configure failover replication with the following settings:

Partner server: 172.16.0.21
Relationship Name: Adatum
14/66
11/17/2014
Maximum Client Lead Time: 15 minutes

Mode: Load balance
Load Balance Percentage: 50%
State Switchover Interval: 60 minutes
Message authentication shared secret: Pa$$w0rd
Note: LON-SVR1 has two NICs one on the 131.107.0.0 subnet and one on the
172.16.0.0 subnet. LON-DC1 also resides on the 172.16.0.0 subnet.
5.
Complete the Configure Failover Wizard.
6.
Switch back to LON-SVR1, refresh the IPv4 node, and note that the Adatum scope is configured
and is active.
Lesson 2: Configuring Advanced DNS Settings

In TCP/IP networks of any size, certain services are essential. DNS is one of the most critical
network services for any network, because many other applications and servicesincluding AD DS
rely on DNS to resolve resource names to IP addresses. Without DNS, user authentications fail, and
network-based resources and applications might become inaccessible. For these reasons, you need
to manage and protect DNS.
This lesson discusses management techniques and options for optimizing DNS resolution. Windows
Server 2012 implements DNSSEC to protect DNS responses. Windows Server 2012 also includes
support for global name zones to provide single-label name resolution.
Lesson Objectives
Manage DNS services.
Optimize DNS name resolution.
Describe global name zones.
Describe options for implementing DNS security.
Explain how DNSSEC works.
Describe the new DNSSEC features for Windows Server 2012.
15/66
11/17/2014
Explain how to configure DNSSEC.

Describe global name zones.
Managing DNS Services
As with other important network services, you must manage DNS. DNS management consists of the
following tasks:
Delegating DNS administration.
Configuring logging for DNS.
Aging and scavenging.
Backing up the DNS database.
Delegating Administration of DNS

By default, the Domain Admins group has full permissions to manage all aspects of the DNS server
in its home domain, and the Enterprise Admins group has full permissions to manage all aspects of
all DNS servers in any domain in the forest. If you need to delegate the administration of a DNS
server to a different user or group, you can add that user or global group to the DNS Admins group
for a given domain in the forest. Members of the DNS Admins group can view and modify all DNS
data, settings, and configurations of DNS servers in their home domain.
The DNS Admins group is a domain-local security group, and by default has no members in it.
Configuring DNS Logging

By default, DNS maintains a DNS server log, which you can view in the Event Viewer. This event log
is located in the Applications and Services Logs folder in Event Viewer. It records common events
such as:
16/66
11/17/2014
Starting and stopping the DNS service.

Background loading and zone signing events.
Changes to DNS configuration settings.
Various warnings and error events.
For more verbose logging, you can enable debug logging. Debug logging options are disabled by
default, but they can be selectively enabled. Debug logging options include the following:
Direction of packets.
Contents of packets.
Transport protocol.
Type of request.
Filtering based on IP address.
Specifying the name and location of the log file, which is located in the %windir%\System32\DNS
directory.
Log file maximum size limit.
Debug logging can be resource intensive. It can affect overall server performance and consume disk
space. Therefore, you should enable it only temporarily when you require more detailed information
about server performance. To enable debug logging on the DNS server, do the following:
1.
Open the DNS console.
2.
Right-click the applicable DNS server, and then click Properties.
3.
In the Properties dialog box, click the Debug Logging tab.
4.
Select Log packets for debugging, and then select the events for which you want the DNS
server to record debug logging.
Note: Logging can generate a large number of files, and if it is left on too long, it can
fill a drive. We highly recommend that you turn on logging only while you are actively
troubleshooting; at all other times, logging should be turned off.
Aging and Scavenging

17/66
11/17/2014
DNS dynamic updates add resource records to the zone automatically, but in some cases, those
records are not deleted automatically when they are no longer required. For example, if a computer
registers its own host (A) resource record and is improperly disconnected from the network, the
host (A) resource record might not be deleted. These records, known as stale records, take up space
in the DNS database and may result in an incorrect query response being returned. Windows Server
2012 can search for those stale records and, based on the aging of the record, scavenge them from
the DNS database.
Aging and scavenging is disabled by default. You can enable automatic scavenging and the interval
at which it will take place in the Advanced properties of the DNS server. Each individual zone then is
configured to indicate whether or not the stale records should be scavenged and the aging settings
that determine when records become stale. The aging settings are found in the zones properties
General tab.
Aging is determined by using parameters known as the No-refresh interval and the Refresh interval.
The No-refresh interval is the period of time that the record is not eligible to be refreshed. By
default, this is seven days. The Refresh interval is the date and time that the record is eligible to be
refreshed by the client. The default is seven days. Usually, a client host record cannot be refreshed
in the database for seven days after it is first registered or refreshed. However, it then must be
refreshed within the next seven days after the No-refresh interval, or the record becomes eligible to
be scavenged out of the database. A client will attempt to refresh its DNS record at startup, and
every 24 hours while the system is running.
Note: Records that are added dynamically to the database are time stamped. Static records
that you enter manually have a time stamp value of zero (0); therefore, they will not be
affected by aging and will not be scavenged out of the database.
Backing Up the DNS Database

How you back up the DNS database depends on how DNS was implemented in your organization. If
your DNS zone was implemented as an Active Directory-integrated zone, then your DNS zone is
included in the Active Directory database ntds.dit file. If the DNS zone is a primary zone and is not
stored in AD DS, then the file is stored as a .dns file in the %SystemRoot%\System32\Dns folder.
Backing Up Active Directory-Integrated Zones

Active Directory-integrated zones are stored in AD DS and are backed up as part of a System State
or a full server backup. Additionally, you can back up just the Active Directoryintegrated zone by
using the dnscmd command-line tool.
To back up an Active Directoryintegrated zone, perform the following steps:
1.
Launch an elevated command prompt.
18/66
11/17/2014
2.
Run the following command:

dnscmd /ZoneExport <zone name> <zone file name>
<zone name> is the name of your DNS zone, and <zone file name> is the file that you want to
create to hold the backup information.
The dnscmd tool exports the zone data to the file name that you designate in the command, to the
%windir%\System32\DNS directory.
You can also use Windows PowerShell to perform the same task. In Windows PowerShell, you use
the Export-DnsServerZone cmdlet. For example, if you want to export a zone named
contoso.com, type the following command:
Export-DnsServerZone Name contoso.com Filename contoso
Note: If DNSSEC is configured, the security information will not be exported with these
commands.
Backing Up Primary Zones

To back up a primary zone that is not stored in AD DS, simply copy or back up the individual zone
file, zonename.dns, which is located in the %windir%\System32\DNS directory. For example, if your
DNS primary zone is named Adatum.com, then the DNS zone file will be named Adatum.com.dns.
Optimizing DNS Name Resolution
In a typical DNS query event, a client computer attempts to resolve a FQDN to an IP address. For
example, if a user tries to go to the FQDN www.microsoft.com, the client computer will perform a
19/66
11/17/2014
recursive query to the DNS server that it is configured to discover the IP address associated with
that FQDN. The local DNS server must then respond with an authoritative response.
If the local DNS server has a copy of the DNS zone for which it was queried, it will respond with an
authoritative answer to the client computer. If the local DNS server does not have that information,
it will perform recursion.
Recursion is the process in which the local DNS server itself makes a recursive query to another
DNS server until it finds the authoritative answer, and then returns that answer to the client that
made the original request. By default, this server will be one of the servers on the Internet that is
listed as a root hint. When the local DNS server receives a response, it will return that information
to the original requesting client computer.
There are a number of options available for optimizing DNS name resolution, which include features
such as:
Forwarding
Conditional forwarding
Stub zones
Netmask ordering
Forwarding
A forwarder is a DNS server that you configure to forward DNS queries for host names that it cannot
resolve to other DNS servers for resolution. In a typical environment, the internal DNS server
forwards queries for external DNS host names to DNS servers on the Internet. For example, if the
local network DNS server cannot resolve a query for www.microsoft.com, then the local DNS
server can forward the query to the Internet service providers (ISPs) DNS server for resolution.
Conditional Forwarding
You also can use conditional forwarders to forward queries according to specific domain names. A
conditional forwarder is a setting that you configure on a DNS server that enables forwarding DNS
queries based on the query's DNS domain name. For example, you can configure a DNS server to
forward all queries that it receives for names ending with corp.adatum.com to the IP address of a
specific DNS server, or to the IP addresses of multiple DNS servers. This can be useful when you
have multiple DNS namespaces in a forest, or a partners DNS namespace across firewalls. For
example, suppose Contoso.com and Adatum.com merge. Rather than requiring each domain to host
a complete replica of the other domains DNS database, you could create conditional forwarders so
that they point to each others specific DNS servers for resolution of internal DNS names.
20/66
11/17/2014
Stub Zones
A stub zone is a copy of a zone that contains only those resource records necessary to identify that
zones DNS servers. A stub zone resolves names between separate DNS namespaces, which might
be necessary when you want a DNS server that is hosting a parent zone to remain aware of all the
DNS servers for one of its child zones. A stub zone that is hosted on a parent domain DNS server
will receive a list of all new DNS servers for the child zone, when it requests an update from the
stub zone's master server. By using this method, the DNS server that is hosting the parent zone
maintains a current list of the DNS servers for the child zone as they are added and removed.
A stub zone consists of the following:
The delegated zones start of authority (SOA) resource record, name server (NS) resource
records, and host (A) resource records.
The IP address of one or more master servers that you can use to update the stub zone.
Stub zones have the following characteristics:

You create stub zones using the New Zone Wizard.
You can store stub zones in AD DS.
You can replicate stub zones either in the domain only, or throughout the entire forest or any
other replication scope configured by Active Directory application partitions.
Stub zone master servers are one or more DNS servers that are responsible for the initial copy of
the zone information; the master server is usually the DNS server that is hosting the primary zone
for the delegated domain name.
Conditional Forwarding vs. Stub Zones

Conditional forwarder and stub zones perform similar functions. The distinguishing difference
between conditional forwarders and stub zones are that conditional forwarders work better across
firewalls, while stub zones are more dynamic when DNS-servers are added and removed. If you
have firewalls, you usually configure two DNS servers that can be accessed by a partner behind the
firewall; therefore, you need to configure conditional forwarding. For internal DNS servers, where
you usually do not have firewalls or permit DNS traffic to all DNS servers behind the firewall, you
can use stub zones that automatically learn about new DNS servers.
This is a graphic that shows the difference between a conditional forwarding and a stub zone.
21/66
11/17/2014
Netmask Ordering
There are various reasons to associate multiple IP addresses with a single name, for example, load
balancing a web page. Netmask ordering returns addresses for DNS queries that prioritize resources
on the client computers local subnet and returns those addresses to the client. In other words,
addresses of hosts that are on the same subnet as the requesting client will have a higher priority in
the DNS response to the client computer.
Localization is based on IP addresses. For example, if multiple A records are associated with the
same DNS name, and each A record is located on a different IP subnet, netmask ordering returns an
A record that is on the same IP subnet as the client computer that made the request.
This image shows an example of netmask ordering.
22/66
11/17/2014
What Is the GlobalNames Zone?
The GlobalNames zone was introduced with Windows Server 2008, and support for this zone
continues in Windows Server 2012. The GlobalNames zone contains single-label names that are
unique across an entire forest. This eliminates the need to use the NetBIOS-based Windows Internet
Name Service (WINS) to provide support for single-label names.
GlobalNames zones provide single-label name resolution for large enterprise networks that do not
deploy WINS and that have multiple DNS domain environments. GlobalNames zones are created
manually and do not support dynamic record registration.
When clients try to resolve short names, they append their DNS domain name automatically.
Depending on the configuration, they also try to find the name in upper-level domain name, or work
through their name suffix list. Therefore, short names are resolved primarily in the same domain.
You use a GlobalNames zone to provide a short name to multiple DNS suffixes. For example, if an
organization supports two DNS domains, such as adatum.com and contoso.com, and has a server
called intranet in contoso.com, only contoso domain users would be able to query it using the short
name. Adatum domain users would not be able to use the short name to access the server.
Global names are based on creating alias (CNAME) resource records in a special forward lookup
zone that uses single names to point to FQDNs. For example, GlobalNames zones would enable
clients in both the adatum.com and contoso.com domains to use a single-label name, such as
intranet, to locate a server whose FQDN is intranet.contoso.com, without using the FQDN.
Creating a GlobalNames Zone

To create a GlobalNames zone, perform the following procedure:
1.
Use the dnscmd tool to enable GlobalNames zones support.
2.
Create a new forward lookup zone named GlobalNames (not case sensitive). Do not allow
dynamic updates for this zone.
23/66
11/17/2014
3.
Manually create CNAME records that point to records that already exist in the other zones that
are hosted on your DNS servers.
For example, you could create a CNAME record in the GlobalNames zone named Data that points to
Data.contoso.com. This enables clients from any DNS domain in the organization to find this server
by the single-label name Data.
You also can use the Windows PowerShell cmdlets Get-DnsServerGlobalNameZone and SetDnsServerGlobalNameZone to configure GlobalNames zones.
Options for Implementing DNS Security
Because DNS is a critical network service, you must protect it as much as possible. A number of
options are available for protecting the DNS server, including:
DNS cache locking
DNS socket pool
DNSSEC
DNS Cache Locking

Cache locking is a Windows Server 2012 security feature that allows you to control when information
in the DNS cache can be overwritten.
When a recursive DNS server responds to a query, it caches the results so that it can respond
quickly if it receives another query requesting the same information. The period of time the DNS
server keeps information in its cache is determined by the Time to Live (TTL) value for a resource
record.
Information in the cache can be overwritten before the TTL expires if updated information about that
24/66
11/17/2014
resource record is received. If a malicious user overwrites information in the cache, known as a
cache poisoning attack, the malicious user might be able to redirect your network traffic to a
malicious site. When you enable cache locking, the DNS server prohibits cached records from being
overwritten for the duration of the TTL value or a portion thereof.
You configure cache locking as a percentage value. For example, if the cache locking value is set to
50, then the DNS server will not overwrite a cached entry for half of the duration of the TTL. By
default, the cache locking percentage value is 100. This means that cached entries will not be
overwritten for the entire duration of the TTL. As a best practice, you should set your cache locking
settings to at least 90%.
You can configure cache locking with the dnscmd tool by performing the following procedure:
1.
2.

dnscmd /Config /CacheLockingPercent <percent>
3.
Restart the DNS service to apply the changes.
Alternatively, you can use the Windows PowerShell Set-DnsServerCache LockingPercent cmdlet
to set this value. For example:
Set-DnsServerCache LockingPercent <value>
DNS Socket Pool

The DNS socket pool enables a DNS server to use source port randomization when it issues DNS
queries. When the DNS service starts, the server chooses a source port from a pool of sockets that
are available for issuing queries. Instead of using a predicable source port, the DNS server uses a
random port number that it selects from the DNS socket pool. The DNS socket pool makes cachetampering attacks more difficult because a malicious user must correctly guess both the source port
of a DNS query and a random transaction ID to successfully run the attack. The DNS socket pool is
enabled by default in Windows Server 2012.
The default DNS socket pool size is 2,500. When you configure the DNS socket pool, you can choose
a size value from 0 to 10,000. The larger the value, the greater the protection you will have against
DNS spoofing attacks. DNS Spoofing is another form of the DNS cache poisoning attack, in which a
malicious user uploads incorrect IP addressing information into your DNS system. If the DNS server
is running Windows Server 2008 R2 or newer, you can also configure a DNS socket pool exclusion
25/66
11/17/2014
list. The socket pool exclusion list allows you to specify port ranges that will never be used as a
source port for DNS queries.
You can configure the DNS socket pool size by using the dnscmd tool as follows:
1.
2.

dnscmd /Config /SocketPoolSize <value>
3.
Restart the DNS service to apply the changes
In Windows 2012 the dnscmd command functions have been ported to Windows PowerShell
commands. To configure the DNS socket pool size, open an elevated Windows PowerShell window
and perform the following steps:
1.
Export the current configuration to an XML file.

Get-DnsServer -ComputerName "LON-DC1.Adatum.com" | Export-Clixml -Path
"c:\DnsServerConfig.xml"
2.
Edit the SocketPoolSize setting in the DnsServerConfig.xml as appropriate.
3.
Import the DnsServerConfig.xml as an object.

$x = Import-Clixml "c:\DnsServerConfig.xml"
4.
Configure the DNS service using the imported object.

Set-DnsServer -InputObject $x ComputerName "LON-DC1.Adatum.com"
DNSSEC
DNSSEC enables a DNS zone and all records in the zone to be signed cryptographically so that client
computers can validate the DNS response. DNS is often subject to various attacks, such as spoofing
and cache-tampering. DNSSEC helps protect against these threats and provides a more secure DNS
infrastructure.
26/66
11/17/2014
How DNSSEC Works
Intercepting and tampering with an organizations DNS query response is a common attack method.
If malicious users can alter responses from DNS servers, or send spoofed responses to point client
computers to their own servers, they can gain access to sensitive information. Any service that
relies on DNS for the initial connectionsuch as e-commerce web servers and email serversare
vulnerable. DNSSEC protects clients that are making DNS queries from accepting false DNS
responses.
When a DNS server that hosts a digitally signed zone receives a query, it returns the digital
signatures along with the requested records. A resolver or another server can obtain the public key
of the public/private key pair from a trust anchor, and then validate that the responses are authentic
and have not been tampered with. To do this, you must configure the resolver or server with a trust
anchor for the signed zone or for a parent of the signed zone.
Trust Anchors
A trust anchor is an authoritative entity that is represented by a public key. The TrustAnchors zone
stores preconfigured public keys that are associated with a specific zone. In DNS, the trust anchor is
the DNSKEY or DS resource record. Client computers use these records to build trust chains. You
must configure a trust anchor from the zone on every domain DNS server to validate responses
from that signed zone. If the DNS server is a domain controller, then Active Directory-integrated
zones can distribute the trust anchors.
Name Resolution Policy Table

The Name Resolution Policy Table (NRPT) contains rules that control the DNS client behavior for
sending DNS queries and processing the responses from those queries. For example, a DNSSEC rule
prompts the client computer to check for validation of the response for a particular DNS domain
suffix. As a best practice, you should use Group Policy as the preferred method for configuring the
NRPT. If there is no NRPT present, the client computer accepts responses without validating them.
Deploying DNSSEC
27/66
11/17/2014
To deploy DNSSEC:
1.
Install Windows Server 2012, and assign the DNS role to the server. Typically, a domain
controller also acts as the DNS server. However, this is not a requirement.
2.
Sign the DNS zone by using the DNSSEC Configuration Wizard, which is located in the DNS
console.
3.
Configure trust anchor distribution points.
4.
Configure the NRPT on the client computers.
Assigning the DNS Server Role

To assign the DNS server role, in the Server Manager Dashboard, use the Add Roles and Features
Wizard. You also can add this role when you add the AD DS role. Then configure the primary zones
on the DNS server. After a zone is signed, any new DNS servers in Windows Server 2012
automatically receive the DNSSEC parameters.
Signing the Zone

The following signing options are available:
Configure the zone signing parameters. This option guides you through the steps and enables you
to set all values for the key signing key (KSK) and the zone signing key (ZSK).
Sign the zone with parameters of an existing zone. This option enables you to keep the same
values and options that are set in another signed zone.
Use recommended settings. This option signs the zone by using the default values.
Note: Zones also can be unsigned, by using the DNSSEC management user interface to
remove zone signatures.
Configuring Trust Anchor Distribution Points

If the zone is Active Directory-integrated, and if all domain controllers are running Windows Server
2012, you can select to distribute the trust anchors to all the servers in the forest. Make this
selection with caution because the wizard turns on DNSSEC validation. If you enable DNS trust
anchors without thorough testing, you could cause DNS outages. If trust anchors are required on
computers that are not domain joinedfor example, a DNS server in the perimeter network (also
known as screened subnet)then you should enable automated key rollover.
28/66
11/17/2014
Note: A key rollover is the act of replacing one key pair with another at the end of a keys
effective period.
Configuring NRPT on Client Computers

The DNS client computer only performs DNSSEC validation on domain names where the NRPT has
configured the DNS client computer to do so. A client computer that is running Windows 7 or
newer is DNSSEC-aware, but it does not perform validation. Instead, it relies on the security-aware
DNS server to perform validation on its behalf.
New DNSSEC Features for Windows Server 2012
Windows Server 2012 has simplified DNSSEC implementation. Although DNSSEC was supported in
Windows Server 2008 R2, most of the configuration and administration tasks were performed
manually, and zones were signed when they were offline.
DNSSEC Zone Signing Wizard

Windows Server 2012 includes the DNSSEC Zone Signing Wizard, to simplify the configuration and
signing process, and to enable online signing. The wizard allows you to choose the zone signing
parameters as indicated in the previous topic. If
you choose to configure the zone-signing settings, rather than using parameters from an existing
zone or using default values, you can use the wizard to configure settings such as:
Key signing key (KSK) options.
Zone signing key (ZSK) options.
Trust anchor distribution options.
Signing and polling parameters.
New Resource Records

29/66
11/17/2014
DNS response validation is achieved by associating a private/public key pair (as generated by the
administrator) with a DNS zone, and then defining additional DNS resource records to sign and
publish keys. Resource records distribute the public key, while the private key remains on the
server. When the client requests validation, DNSSEC adds data to the response that enables the
client to authenticate the response.
The following table describes the new resource records in Windows Server 2012.
Resource record
Purpose
DNSKEY
This record publishes the public key for the zone. It checks the authority of a response against the
private key held by the DNS server. These keys require periodic replacement through key rollovers.
Windows Server 2012 supports automated key rollovers. Every zone has multiple DNSKEYs that are
then broken down to the ZSK and KSK.
Delegation Signer (DS)
This record is a delegation record that contains the hash of the public key of a child zone. This record
is signed by the parent zones private key. If a child zone of a signed parent also is signed, the DS
records from the child must be manually added to the parent so that a chain of trust can be created.
Resource Record Signature
This record holds a signature for a set of DNS records. It is used to check the authority of a response.
(RRSIG)
Next Secure (NSEC)
When the DNS response has no data to provide to the client, this record authenticates that the host
does not exist.
NSEC3
This record is a hashed version of the NSEC record that prevents alphabet attacks by enumerating the
zone.
Other New Enhancements

Other enhancements for Windows Server 2012 include:
Support for DNS dynamic updates in DNSSEC signed zones.
Automated trust anchor distribution through AD DS.
Windows PowerShell-based command-line interface for management and scripting.
Managing DNSSEC with Windows PowerShell cmdlets

Windows Server 2012 R2 added several Windows PowerShell cmdlets to manage DNSSEC, including
the cmdlets listed in the following table.
cmdlet
Description
Add- DnsServerResourceRecordDnsKey
You use this cmdlet to add a type DNSKEY resource record to a DNS zone.
Add-DnsServerResourceRecordDS
You use this cmdlet to add a type DS resource record to a DNS zone.
Add-DnsServerTrustAnchor
You use this cmdlet to add a trust anchor to a DNS server. Windows Server
2012 R2 now includes the Root option. This option allows you to retrieve
30/66
11/17/2014
trust anchors from the specified URL.

Add-DnsServerSigningKey
You use this cmdlet to add a KSK or ZSK to a signed zone.
Export-DnsServerDnsSecPublicKey
You use this cmdlet to export DS and DNSKEY information for a DNSSECsigned zone.
Get-DnsServerDnsSecZoneSetting
You use this cmdlet to get the DNSSEC settings for a zone.
Get-DnsServerSetting
You use this cmdlet to retrieve DNS server settings. Windows Server 2012
R2 adds the RootTrustAnchorsURL to the output.
Set-DnsServerDnsSecZoneSetting
You use this cmdlet to make changes to the settings for a DNSSEC zone.
Step-DnsServerSigningKeyRollover
You use this cmdlet to force a KSK rollover when the DS record has been
manually updated in the parent.
Demonstration: Configuring DNSSEC

In this demonstration, you will see how to use the Zone Signing Wizard in the DNS console to
configure DNSSEC.
Demonstration Steps Configure DNSSEC

1.
Sign in on LON-DC1 as Adatum\Administrator with the password Pa$$w0rd.
2.
Start the DNS console.
3.
Use the DNSSEC Zone Signing Wizard to sign the Adatum.com zone.
4.
Choose to customize zone signing parameters.
5.
Ensure that DNS server LON-DC1 is the Key Master.
6.
Add the Key Signing Key by accepting default values for the new key.
7.
Add the Zone Signing Key by accepting the default values for the new key.
8.
Choose to use NSCE3 with default values.
9.
Do not choose to enable the distribution of trust anchors for this zone.
10. Accept the default values for signing and polling.

11. Verify that the DNSKEY resource records were created in the Trust Points zone.
12. Use the Group Policy Management Console (GPMC) to configure NRPT. Create a rule that enables
DNSSEC for the Adatum.com suffix, and that requires DNS client computers to verify that the
name and address data is validated.
Lesson 3: Implementing IPAM
31/66
11/17/2014
With the development of IPv6 and the proliferation of devices that require IP addresses, networks
have become complex and difficult to manage. Maintaining an updated list of static IP addresses that
have been issued has often been a manual task, which can lead to errors. To help organizations
manage IP addresses, Windows Server 2012 provides the IP Address Management (IPAM) tool.
Lesson Objectives
Describe IPAM.
Describe IPAM architecture.
Describe the requirements for IPAM implementations.
Explain how to manage IP addressing by using IPAM.
Explain how to install and configure IPAM.
Explain how to manage and monitor IPAM.
Describe considerations for implementing IPAM.
What Is IPAM?
IP address management is a difficult task in large networks, because tracking IP address usage is
largely a manual operation. Windows Server 2012 introduces IPAM, which is a framework for
discovering, auditing, monitoring utilization, and managing the IP address space in a network.
IPAM enables the administration and monitoring of DHCP and DNS, and provides a comprehensive
view of where IP addresses are used. IPAM collects information from domain controllers and
Network Policy Servers (NPSs), and then stores that information in the Windows Internal Database.
IPAM assists in the areas of IP administration, as shown in the following table.
32/66
11/17/2014
IP administration
IPAM capabilities
area
Planning
Provides a tool set that can reduce the time and expense of the planning process when network
changes occur.
Managing
Provides a single point of management, and assists in optimizing utilization and capacity
planning for DHCP and DNS.
Tracking
Enables tracking and forecasting of IP address utilization.
Auditing
Assists with compliance requirements, such as the Health Insurance Portability and
Accountability Act (HIPAA) and Sarbanes-Oxley Act of 2002, and provides reporting for
forensics and change management.
Characteristics of IPAM
Characteristics of IPAM include:
A single IPAM server can support up to 150 DHCP servers and 500 DNS servers.
A single IPAM server can support up to 6,000 DHCP scopes and 150 DNS zones.
IPAM stores three years of forensics data (IP address leases, host MAC addresses, user logon and
logoff information) for 100,000 users in a Windows Internal Database when using Windows Server
2012. Windows Server 2012 R2 added the option to select a Windows Internal Database or SQL
Server. There is no database purge policy provided, and the administrator must purge the data
manually as needed.
IPAM on Windows Server 2012 supports only Windows Internal Database. An external database is
supported only when IPAM is implemented on Windows Server 2012 R2.
IP address utilization trends are provided only for IPv4.
IP address reclamation support is provided only for IPv4.
IPAM does not check for IP address consistency with routers and switches.
Benefits of IPAM
IPAM benefits include:
IPv4 and IPv6 address space planning and allocation.
IP address space utilization statistics and trend monitoring.
Static IP inventory management, lifetime management, and DHCP and DNS record creation and
deletion.
Service and zone monitoring of DNS services.
IP address lease and logon event tracking.
33/66
11/17/2014
Role-based access control (RBAC).

Remote administration support through RSAT.
Reporting in the IPAM management console.
Note: IPAM has limited support for management and configuration of non-Microsoft
network elements.
Windows Server 2012 R2 Enhancements to IPAM

Windows Server 2012 R2 improves and adds functionality for IPAM. The IPAM framework is
expanded with the following:
RBAC. RBAC for IPAM allows you to customize roles, access scopes, and access policies for IPAM
administrators.
Virtual address space management. You can use IPAM to manage IP addresses in a Microsoftbased network. You can manage both physical and virtual addresses. Integration between IPAM
and Virtual Machine Managers (VMMs) allows end-to-end address space management. You can
view virtual address space in the IPAM consoles new VIRTUALIZED ADDRESS SPACE node.
Enhanced DHCP server management. DHCP management is improved in Windows Server 2012
R2,and includes new DHCP scope and DHCP server operations. Additionally, views were added for
DHCP failover, DHCP policies, DHCP superscopes, DHCP filters, and DHCP reservations.
External database support. You can configure IPAM to use a Windows Internal Database (WID).
Support for using Microsoft SQL Server was added in Windows Server 2012 R2.
Upgrade and migration support. You can upgrade the IPAM database from Windows Server 2012 to
Windows Server 2012 R2.
Enhanced Windows PowerShell support. IPAM includes more than 50 different Windows PowerShell
commands.
For a complete list of the available commands, review IPAM Server cmdlets in Windows
PowerShell.
IPAM Overview
34/66
11/17/2014
IPAM architecture consists of four main modules, as listed in the following table.
Module
Description
IPAM discovery
You use AD DS to discover servers that are running Windows Server 2008 and newer Windows Server
operating systems, and that have DNS, DHCP, or AD DS installed. You can define the scope of discovery to
a subset of domains in the forest. You also can add servers manually.
IP address space
You can use this module to view, monitor, and manage the IP address space. You can issue addresses
management
dynamically or assign them statically. You also track address utilization and detect overlapping DHCP
scopes.
Multi-server
You can manage and monitor multiple DHCP servers. This enables tasks to execute across multiple servers.
management and
For example, you can configure and edit DHCP properties and scopes, and track the status of DHCP and
monitoring
scope utilization. You also can monitor multiple DNS servers, and monitor the health and status of DNS
zones across authoritative DNS servers.
Operational auditing
You can use the auditing tools to track potential configuration problems. You can also collect, manage, and
and IP address
view details of configuration changes from managed DHCP servers. You also can collect address lease
tracking
tracking from DHCP lease logs, and collect logon event information from NPS and domain controllers.
The IPAM server can manage only one Active Directory forest. As such, you can deploy IPAM in one
of three topologies:
Distributed. You deploy an IPAM server to every site in the forest.
Centralized. You deploy only one IPAM server in the forest.
Hybrid. You deploy a central IPAM server together with a dedicated IPAM server in each site. You
can manage DHCP services, DNS services, and NPS services for multiple IPAM servers with a
central server. This allows local administrators to manage local servers, while allowing all the
servers to be managed from a central location, if necessary.
Note: IPAM servers do not communicate with one another or share database information.
If you deploy multiple IPAM servers, you must customize each servers discovery scope.
35/66
11/17/2014
IPAM has two main components:

IPAM server. The IPAM server performs the data collection from the managed servers. It also
manages the Windows Internal Database and provides RBAC.
IPAM client. The IPAM client provides the client computer user interface. It also interacts with the
IPAM server, and invokes Windows PowerShell to perform DHCP configuration tasks, DNS
monitoring, and remote management.
Provisioning for IPAM

After you install an IPAM server, servers that are managed by IPAM need to be provisioned to allow
remote management. You can either manage it manually or through a Group Policy Object (GPO). If
you decide to provision the managed servers manually, you must create all the required network
shares, security groups, and firewall rules on each managed server.
If you decide to manually provision for IPAM, you must first create a group in AD DS named
IPAMUG. This group contains the IPAM servers in the domain. The following table summarizes the
required configuration settings that would need to be manually configured.
Configuration
Domain
Setting
Controller
DHCP Servers
DNS Servers
Servers
and NPS
<domain>\IPAM UG
Added as a
Added as a member of the
Added as a member of the
group
member of the
BUILTIN\Event Log Readers group
BUILTIN\Event Log Readers group
BUILTIN\Ev
and the BUILTIN\DHCP Users group
ent Log
Readers group
Windows Firewall with
Inbound firewall
Inbound firewall rules to allow DHCP
Inbound firewall rules to allow DNS
Advanced Security
rules to allow
Server Management, Remote
Service, Remote Service
Remote Event
Service Management, File and
Management, and Remote Event Log
Log
Printer Sharing and Remote Event
Management
Managemen t
Log Management
Network Share
Share the
%SYSTEMROOT%\System32\
DHCP folder as DHCPAudit. Grant
IPAMUG read permissions
Event Log Monitoring
Modify the
on DNS servers
HKLM\SYSTEM\CurrentCont rolSet
\Services\EventLog\DNS Server
registry key
Additional settings
Add <domain>\IPAMUG group as DNS

Administrator
36/66
11/17/2014
If you choose to use GPO provisioning, you will run the Invoke-IpamGpoProvisioning Windows
PowerShell command. Running this command will create three GPOs to configure the settings
described in the table above.
IPAM_DC_NPS. This GPO is applied to all managed AD DS servers and NPS servers.
IPAM_DHCP. This GPO is applied to all managed DHCP servers. This GPO includes scripts to
configure the network share for DHCP monitoring.
IPAM_DNS. This GPO is applied to all managed DNS servers. This GPO includes scripts to configure
the event log for DNS monitoring and to configure the IPAMUG group as a DNS administrator.
Requirements for IPAM Implementation
To ensure a successful IPAM implementation, you must meet the following prerequisites:
The IPAM server must be a domain member, but it cannot be a domain controller.
The IPAM server should be a single-purpose server. Do not install other network roles such as
DHCP or DNS on the same server.
To manage the IPv6 address space, you must have IPv6 enabled on the IPAM server.
Sign in on the IPAM server with a domain account, and not with a local account.
You must be a member of the correct IPAM local security group on the IPAM server.
You must enable logging of account logon events on domain controller and NPS servers for IPAMs
IP address tracking and auditing feature.
IPAM Hardware and Software Requirements

The IPAM hardware and software requirements are as follows:
Dual-core processor of 2.0 gigahertz (GHz) or higher.
37/66
11/17/2014
Windows Server 2012 operating system.

4 or more gigabytes (GB) of random access memory (RAM).
80 GB of free hard disk space.
In addition to the previously mentioned requirements, if you manage Windows Server 2008 and
Windows Server 2008 R2 with IPAM, the Windows 2008 or Windows 2008 R2 servers require the
following:
Service Pack 2 (SP2) must be installed on Windows Server 2008.
Microsoft .NET Framework 4.0 full installation must be installed.
Windows Management Framework 3.0 must be installed (KB2506146).
For Windows Server 2008 SP2, Windows Management Framework Core (KB968930) also is
required.
Windows Remote Management must be enabled.
Verify that service principal names (SPNs) are written.
Demonstration: Implementing IPAM

In this demonstration, you will see how to install and configure IPAM management.
Demonstration Steps Install IPAM

1.
Sign in on LON-SVR2 as Adatum\Administrator with the password Pa$$w0rd.
2.
In the Server Manager, add the IPAM feature and all required supporting features.
Configure IPAM
1.
In the IPAM Overview pane, provision the IPAM server using Group Policy.
2.
Enter IPAM as the Group Policy Object (GPO) name prefix, and provision IPAM. Provisioning will
take a few minutes to complete.
3.
In the IPAM Overview pane, configure server discovery for the Adatum domain.
4.
In the IPAM Overview pane, start the server discovery process. Discovery may take five to 10
minutes to run. The yellow bar indicates when discovery is complete.
5.
In the IPAM Overview pane, add the servers to be managed.
38/66
11/17/2014
6.
Verify that IPAM access is currently blocked.
7.
Use Windows PowerShell to grant the IPAM server permission to manage LON-DC1 by using the
following command:
Invoke-IpamGpoProvisioning Domain Adatum.com GpoPrefixName IPAM IpamServerFqdn
LON-SVR2.adatum.com DelegatedGpoUser Administrator
8.
Set the manageability status to Managed.
9.
Switch to LON-DC1.
10. Force the update of Group Policy.

11. Switch back to LON-SVR2, and refresh the IPv4 view. Discovery may take five to 10 minutes to
run.
12. In the IPAM Overview pane, retrieve data from the managed server.
Virtual Address Space Management in IPAM
Beginning with Windows Server 2012 R2, IPAM offers a centralized management console for both
physical and virtual address spaces. When IPAM is integrated with Microsoft System Center 2012
R2 Virtual Machine Manager (VMM), you can use automation for your Microsoft cloud-based network.
You can use IPAM to manage multiple instances of VMM to provide a single console for detecting
conflicts, duplicates, and overlaps of the IP Address spaces in your data center.
Virtualization support is provided when you use the two types of IPAM virtual address spaces, which
are called the provider and the customer virtual address spaces. The provider address space
typically contains the addresses associated with the datacenter, the customer address spaces
typically hold the virtual addresses used by the customers. The only address space created during
installation is the Default IP Address Space, which is a provider address space located in the
VIRTUALIZED IP ADDRESS SPACE pane.
39/66
11/17/2014
To create a new Address space, you use the Add-IpamAddressSpace Windows PowerShell cmdlet.
When you create a virtual address space, you must specify a friendly name for the address space,
regardless of whether it is a provider or a customer address space. Additionally, you can add an
optional description. When you create a customer address space, you also must specify the provider
address space in which the customer address space resides, and the isolation method the customer
network uses.
To create a new provider address space for the AdatumHQ datacenter based virtual systems, use
the following Windows PowerShell cmdlet.
Add-IpamAddressSpace Name AdatumHQ ProviderAddressSpace Description Adatum HQ

Datacenter
When you create a customer address space, you must configure additional settings. A customer
address space must reside in a provider address space. Additionally, you must specify how the
customer network will interact with other networks when you specify the network isolation method
as either IPRewrite or Network Virtualization using Generic Routing Encapsulation (NVGRE).
IPRewrite is a static isolation method in which each customer IP address gets rewritten when you
use a physical address from the provider network. Network Virtualization using Generic Routing
Encapsulation (NVGRE) is an isolation method that encapsulates the customer traffic and sends all of
that traffic using a single IP address from the provider network.
To create a new customer address space for the Security department, using the AdatumHQ provider
address space and NVGRE isolation, use the following Windows PowerShell cmdlet.
Add-IpamAddressSpace -Name "Security Department" -CustomerAddressSpace AssociatedProviderAddressSpace "AdatumHQ" -IsolationMethod NVGRE Description
Security Department Network
You can create additional optional settings as part of the Windows PowerShell command or add them
manually after creation. These optional settings include custom fields such as AD site or VMM IP
Pool Name.
IPAM RBAC
40/66
11/17/2014
Windows Server 2012 R2 includes RBAC for IPAM.

RBAC allows you to customize how administrative permissions are defined in IPAM. For example,
some people are assigned the administrator role and are able to manage all aspects of IPAM, while
other administrators may only be allowed to manage certain network objects. By default, all objects
inherit the scope of their parent object. To change the Access Scope of an object, right-click the
object and click on Set Access Scope.
RBAC security is divided into the following three aspects, roles, access scopes, and access policies:
Roles. A role is a collection of IPAM operations. The roles define the actions an administrator is
allowed to perform. Roles are associated with Windows groups and/or users through the use of
access policies. There are eight built-in RBAC roles for IPAM. New roles are created and added in
the IPAM console, in the ACCESS CONTROL pane.
The built-in roles for IPAM are:
Name
Description
DNS record administrator
Manages DNS resource records
IP address record administrator
Manages IP addresses but not IP address spaces, ranges, blocks, or subnets.
IPAM administrator
Manages all settings and objects in IPAM
IPAM ASM administrator
Completely manages IP addresses
IPAM DHCP administrator
Completely manages DHCP servers
IPAM DHCP reservations administrator
Manages DHCP reservations
IPAM DHCP scope administrator
Manages DHCP scopes
IPAM MSM administrator
Completely manages DHCP and DNS servers
Access scopes. Access scopes define the objects to which an administrator has access. By default,
the Global access scope is created when IPAM is installed, and all administrator-created access
scopes are sub-scopes of the Global access scope. Users or groups assigned to the Global access
scope can manage all the network objects in IPAM. Access scopes have up to 15 major operations
41/66
11/17/2014
that can be assigned, such as DHCP server operations. These are further defined by multiple
related operations, such as Create DHCP scope, that can be assigned individually. This allows for a
large administrative permissions customization range in IPAM. You can create and add new access
scopes in the IPAM console, in the ACCESS CONTROL pane.
Access Policies. An access policy combines a role with an access scope to assign RBAC
permissions within IPAM. You can create and add new access policies in the IPAM console, in the
ACCESS CONTROL pane.
Lesson 4: Managing IP Address Spaces with IPAM

There are multiple phases in managing IP addresses with IPAM. IPAM can automatically manage IP
addresses that DHCP servers issue, or you can create IP address ranges for management manually.
In this lesson, you will learn how to manage all aspects of IPAM, from configuring automatic
management to manually adding and updating address information. Finally, you will learn how to
monitor your IP address usage.
Lesson Objectives
Use IPAM to manage IP addressing.
Add address spaces to IPAM.
Import and update address spaces.
Maintain an IPAM inventory.
Monitor IPAM.
Using IPAM to Manage IP Addressing
42/66
11/17/2014
IP address space management allows administrators to manage, track, audit, and report on an
organizations IPv4 and IPv6 address spaces.
The IPAM IP address space console provides administrators with IP address utilization statistics and
historical trend data so that they can make informed planning decisions for dynamic, static, and
virtual address spaces. IPAM periodic tasks discover the address space and utilization data
automatically, as configured on the DHCP servers that are managed in IPAM. You also can import IP
address information from comma separated values (.csv) files.
IPAM also enables administrators to detect overlapping IP address ranges that are defined on
different DHCP servers, find free IP addresses within a range, create DHCP reservations, and create
DNS records.
IPAM provides a number of ways to filter the view of the IP address space. You can customize how
you view and manage the IP address space by using any of the following views:
IP address blocks, which contain:
o IP address subnets
o IP address ranges
o IP addresses
IP address inventory
IP address range groups
IP Address Blocks
IP address blocks are the highest-level entities within an IP address space organization.
Conceptually, an IP block is either a private IP address space or a public IP address space assigned
to an organization by various Regional Internet Registries. Network administrators use IP address
blocks to create and allocate IP address ranges to DHCP. They can add, import, edit, and delete IP
address blocks. IPAM automatically maps IP address subnets to the appropriate IP address block
based on the boundaries of the range. IPAM utilization statistics and trends are summarized at the
block level.
IP Address Subnets
IP address subnets are the next hierarchical level of address space entities after IP address blocks.
IPAM summarizes utilization statistics and trends at the IP address subnet level for the IP address
ranges that the IP address subnet contains. Additionally, you can create subnets as either physical
or virtual; if subnets are virtual, they can be assigned to either a provider or a customer virtual
network.
43/66
11/17/2014
IP Address Ranges
IP address ranges are the next hierarchical level of IP address space entities after IP address
subnets. Conceptually, an IP address range is an IP subnet, or part of an IP subnet marked by a
start and end IP address. It typically corresponds to a DHCP scope, or to a static IPv4 or IPv6
address range or address pool that assigns addresses to hosts. An IP address range is uniquely
identifiable by the value of the mandatory Managed by Service and Service Instance options, which
help IPAM manage and maintain overlapping or duplicate IP address ranges from the same console.
You can add or import IP address ranges from within the IPAM console. Whenever an IP address
range is created, it is associated automatically with an IP address subnet. If a subnet does not exist,
one can be automatically created when the IP address range is created.
IP Addresses
IP addresses are the addresses that make up the IP address range. IPAM enables end-to-end life
cycle management of IPv4 and IPv6 addresses, including record synchronization with DHCP and DNS
servers. IPAM automatically maps an address to the appropriate range based on the ranges start
and end address. An IP address is uniquely identifiable by the value of mandatory Managed By
Service and Service Instance options that help IPAM manage and maintain duplicate IP addresses
from the same console. You can add or import IP addresses from within the IPAM console.
IP Address Inventory
In the IP address inventory view, you can view a list of all IP addresses in the enterprise, along with
their device names and type. IP address inventory is a logical group defined by the Device Type
option within the IP addresses view. These groups allow you to customize the way your address
space displays for managing and tracking IP usage. You can add or import IP addresses from within
the IPAM console. For example, you could add the IP addresses for printers or routers, assign IP
addresses to the appropriate device type of printer or router, and then view your IP inventory
filtered by the device type that you assigned.
IP Address Range Groups

IPAM enables you to organize IP address ranges into logical groups. For example, you might
organize IP address ranges geographically or by business division. You define logical groups by
selecting the grouping criteria from built-in or user-defined custom fields.
Monitoring and Managing

IPAM enables automated, periodic service monitoring of DHCP and DNS servers across a forest.
Monitoring and managing is organized into the views listed in the following table.
View
Description
DNS and DHCP
By default, managed DHCP and DNS servers are arranged by their network interface in /16 subnets for IPv4 and
servers
/48 subnets for IPv6. You can select the view to see just DHCP scope properties, just DNS server properties, or
44/66
11/17/2014
both.
DHCP scopes
The DHCP scope view enables scope utilization monitoring. Utilization statistics are collected periodically and
automatically from a managed DHCP server. You can track important scope properties such as Name, ID, Prefix
Length, and Status.
DNS zone
Zone monitoring is enabled for forward and reverse lookup zones. Zone status is based on events collected by
monitoring
IPAM. The status of each zone is summarized.
Server groups
You can organize your managed DHCP and DNS servers into logical groups. For example, you might organize
servers by business unit or geography. Groups are defined by selecting the grouping criteria from built-in fields or
user-defined fields.
Note: The term prefix length is equivalent to using the term subnet mask when you define
an address range. Prefix length is used in PowerShell and refers to the routing prefix that
Classless Inter-Domain Routing (CIDR) notation uses. For example:
192.168.2.0/24, i.e. the 192.168.2.0 network with a prefix length of 24, is equivalent to
192.168.2.0/255.255.255.0, i.e. 192.168.2.0 with a network mask of 255.255.255.0.
Adding Address Spaces to IPAM
An address space is a container that consists of a set of connected IP blocks, IP subnets, IP ranges
or IP addresses. The IP ADDRESS SPACE pane contains all the IP objects discovered or created.
Non-virtualized network objects are always in the IP ADDRESS SPACE pane.
When you add IP addresses to IPAM manually, you can add either IPv4 or IPv6 addresses. When you
use the IPAM console to add IP addresses, default values are automatically filled in for required
fields, except for the IP addresses. You can add or import any of the following:
IP Address Block. When you add an IP Address Block, when you supply the Network ID and Prefix
length, the start IP address and End IP address will be calculated automatically. Additionally, if
you enter a non-private IP address range, you must specify the Regional Internet Registry where
the addresses are registered and the registration date range. Optionally, you can add a brief
description and an owner.
45/66
11/17/2014
The following Windows PowerShell cmdlet Add-IpamBlock also can be used to add an IP Address
block:
Add-IpamBlock NetworkID <network prefix, in Classless InterDomain Routing (CIDR) notation> Rir <string>
The RIR value is optional for private addresses. If you specify the RIR, the value must be one of:
AFRNIC, APNIC, ARIN, LACNIC, or RIPE.
IP Address Subnet. When you add an IP Address subnet, you must provide a friendly name for the
subnet. Additionally, you must specify the Network ID and Prefix length.
There are several optional settings when you add an IP Address subnet. You can specify one or more
VLANs to be associated with the subnet, whether or not the subnet is virtualized, or custom fields
such as AD site or VMM IP Pool Name. As with the other IP address types, you can add a brief
description and an owner.
The Windows PowerShell cmdlet Add-IpamSubnet also can be used to add an IP address subnet.
When you Add-IpamSubnet, you also must specify if the network type is NonVirtualized, Provider, or
Customer IP Subnet. You must specify the address space to which the Customer IP Subnet will be
added.
Add-IpamSubnet NetworkID <network prefix, in Classless InterDomain Routing (CIDR) notation> Rir <string>
IP Address Range. You can use an IP Address range to further divide an IP Subnet. When you
create an IP address range you must specify the Network ID and either the Prefix length or
Subnet mask. Additionally, if an IP address does not already exist that contains the addresses in
the IP address range you create, you can select to have one created automatically. The other
required fields, Managed by Service, Service Instance, and Assignment Type will use default
values unless otherwise specified. As with the other IP address types, a large variety of custom
fields is available to describe the IP address range.
You also can use the Windows PowerShell cmdlet Add-IpamRange to add an IP Address range.
When you use Add-IpamRange, you must also specify if the network type is NonVirtualized,
Provider, or Customer IP range. You must specify the address space to which the Customer IP
Subnet will be added.
46/66
11/17/2014
Add-IpamRange NetworkID <network prefix, in Classless InterDomain Routing (CIDR) notation> CreateSubnetIfNotFound
IP Address. IPAM provides end-to-end IP address management, including synchronization with

DHCP and DNS. You can use the IP address to associate the address with DHCP reservations;
however, when you use Windows PowerShell to create the IP address, IPAM does not create the
reservation automatically. You can discover duplicate addresses by the Managed by Service and
Service Instance properties of an IP address. IPAM automatically maps an address to the range
containing the address. When you create an IP address, the only required information that you
must provide is the IP address itself. The other required fields, Managed by Service, Service
Instance, Device Type, Address State, and Assignment Type, will use default values unless
otherwise specified. As with the other IP address types, a large variety of custom fields is
available to describe the IP address.
You can use the Windows PowerShell cmdlet Add-IpamAddress to add an IP Address. When you
use Add-IpamAddress, you also must specify the IP address.
Add-IpamAddress IpAddress <x.x.x.x>
Importing and Updating Address Spaces
You can create IP address objects when you import IP address information into IPAM using a text
file. When you import information for a file, you must include the required fields for the address
type, just as you do when you add addresses through the console. The file you create is a comma
delimited file with the field names in the first row.
You can import information into custom fields; however, they must be defined before you import the
data, and you must include the defined field name in the first line. The fields are not required to be
in any particular order; however, the data must be in the same order as the fields.
47/66
11/17/2014
When you create test files, the following rules apply to the data:
Field names and Data can be enclosed quotes.
Field names and Data can contain spaces.
Field names and Data are not case sensitive.
Data must be valid for the field into which it is being imported.
For example, you can use the following entries in a text file to import two addresses into the IPAM
database that manages a DHCP server named DHCP1.adatum.com:
IP Address,Managed by Service,Service Instance,Device Type,IP Address

State,Assignment Type
10.10.0.25,ms dhcp,dhcp1.adatum.com,host,in-use,static
10.10.0.26,ms dhcp,dhcp1.adatum.com,host,in-use,static
For IP address blocks, subnets, and ranges, the network ID and network prefix length are combined
in a single field named Network. For example, to import an IP Address block of 65.52.0.0/14
assigned by the ARIN regional authority, use the following entries in a text file:
Network,Start IP address,End IP address,RIR

65.52.0.0/14,65.52.0.0,65.52.255.255,ARIN
If a required field is missing or you try to import the wrong data type for a field, an error report is
created in the users Documents folder. The mandatory fields for importing data are as follows:
IP address block import: Network, Start IP address, End IP address, RIR
IP address subnet import: Name, Network
IP address range import: Network, Start IP address, End IP address, Managed by Service, Service
Instance, Assignment Type, Utilization Calculation
IP address import: IP address, Managed by Service, Service Instance, Device Type, IP Address
State, Assignment Type
Import and Update IP Address Ranges

You can import and update data for IP address ranges. Updating the data will delete ranges that are
no longer present. You do not have to perform the update step, as performing the import step only
48/66
11/17/2014
will create new ranges as appropriate. The import and update process is specific for a defined
Managed by Service and Service Instance pair.
Exporting IP Information from DNS and DHCP

Because of the potential impact of importing information from your existing DHCP and DNS servers
automatically, IPAM does not import all the available IP Information automatically. To import
existing DNS and DHCP IP address information into IPAM, you must first export the information into
text files. The IPAM Operations Guide (http://go.microsoft.com/fwlink/?LinkID=392466)
includes detailed information on using the PowerShell import commands.
Finding, Allocating, and Reclaiming IP Addresses
You can perform two operations on an IP Address Range: You can Find and Allocate Available IP
Address or Reclaim IP Addresses.
Find and Allocate Available IP Address

To find available IP addresses in a range, in the IP ADDRESS SPACE, change the current view to IP
Address Ranges. The Find and Allocate Available IP Addresses task is available by right-clicking the
desired IP address range. When you choose this operation, the Find and Allocate Available IP
Addresses dialog box opens. IPAM will search the range starting with the first unassigned IP
address.
If the address range is part of a managed DHCP scope, IPAM ignores all reserved or excluded IP
addresses. The search includes a ping of the address and a DNS PTR query; If both methods fail to
get a response, the address is available. You can then press the Find Next button to move to the
next unassigned IP address.
Once you complete the searches, you can allocate one of the addresses that you found. By default,
the last address you find is highlighted, and you can allocate that address or select a different
address is found. Choose each section to configure the IP address as needed. The Basic
Configurations section is filled in with the selected IP address and the default values for the
mandatory fields.
49/66
11/17/2014
If you configure the DHCP Reservation and DNS Record sections, only the IPAM database is affected
by default. If you want to configure a DHCP reservation for a managed IP address, complete the
DHCP Reservation section and check the Automatically create DHCP reservation for this IP
address check box. To create DNS records for the selected IP Address, complete the DNS Record
section and check the Automatically create DNS records for this IP address check box.
Reclaim IP Addresses
When manually added IP Addresses are no longer in use, you need to reclaim them to make them
available for use with other devices. Additionally, the reclaim operations cleans DHCP reservations
and DNS records on managed DNS and DHCP servers. There are two ways to reclaim IP addresses:
To reclaim IP addresses in a range, in the IP ADDRESS SPACE, change the current view to IP
Address Ranges. The Reclaim IP Addresses task is available if you right-click the desired IP address
range. If you choose this operation, it opens the Reclaim IP Addresses dialog box.
The Reclaim IP Addresses dialog box displays all the utilized IP addresses for the range, the IP
Address State, and additional information such as the Device Name and Device Type. Once you have
determined the IP addresses that you want to reclaim, check the select check box next to the IP
addresses, and click the Reclaim button. By default, this operation removes the DNS resource
records and DHCP reservations.
Maintaining IP Address Inventory in IPAM
You can manage individual addresses through the IPAM console as necessary. When you want to
manage an individual address, there are two locations where you can accomplish this. In the IP
ADDRESS SPACE, you change the current view to IP Addresses or the IP Address Inventory pane.
The management options are available when you right-click the desired IP address. The context
menu includes three types of operations: Edit, Create, and Delete.
Edit IP Address
The Edit IP Address dialog box allows you to add
50/66
11/17/2014
information to an IP address or change information that was previously configured. You can modify
all aspects of the IP address information.
Create Operations
There are three options available for creating records for an IP Address. These include:
Create DHCP Reservation. This option creates a DHCP reservation in the appropriate IP Address
Range.
Create DNS Host Record. This option creates a DNS record on the appropriate DNS server or
servers for the IP Address Range.
Create DNS PTR Record. This option creates a DNS OTR record on the appropriate DNS server or
servers for the IP Address Range.
Delete Operations
There are four options available for deleting IP addresses or the information associated with them.
These include:
Delete. The delete option will remove the IP address from the IPAM database. By default, this will
remove the DNS records and DHCP reservations if they exist.
Delete DHCP Reservation. The option will remove any DHCP reservations created for the IP
address, without removing the IP address from the IPAM database.
Delete DNS Host Record. The option will remove any DNS Host Records for the IP address,
without removing the IP address from the IPAM database.
Delete DNS PTR Record. The option will remove any DNS PTR Records for the IP address, without
removing the IP address from the IPAM database.
Demonstration: Using IPAM to Manage IP Addressing

In this demonstration, you will see how to use IPAM to manage IP addressing.
Demonstration Steps
1.
On LON-SVR2, add an IP address block in the IPAM console with the following parameters:
Network ID: 172.16.0.0
Prefix length: 16
Description: Head Office
51/66
11/17/2014
2.
Add IP addresses for the network router by adding to the IP Address Inventory with the
following parameters:
IP address: 172.16.0.1
MAC address: 112233445566
Device type: Routers
Description: Head Office Router
3.
Use the IPAM console to create a DHCP reservation as follows:

IP address: 172.16.0.101
Device type: Host
Client ID: Associate MAC to Client ID check box
Reservation server name: LON-DC1.Adatum.com
Reservation name: Webserver
Reservation type: Both
4.
Use the IPAM console to create the DNS host record as follows:
Device name: Webserver
Forward lookup zone: Adatum.com
Forward lookup primary server: LON-DC1.adatum.com
Automatically create DNS records for this IP address
5.
On LON-DC1, open the DHCP console and confirm that the reservation was created in the
172.16.0.0 scope.
6.
On LON-DC1, open the DNS Manager console and confirm that the DNS host record was created.
IPAM Monitoring
52/66
11/17/2014
The IPAM address space management feature allows you to efficiently view, monitor, and manage
the IP address space on the network.
Address space management supports IPv4 public and private addresses, and IPv6 global and unicast
addresses. By using the MONITOR AND MANAGE section and the DNS and DHCP, DHCP Scopes, DNS
Zone Monitoring, and Server Groups views, you can view and monitor health and configuration of all
the DNS and DHCP servers that IPAM manages. IPAM uses scheduled tasks to periodically collect
data from managed servers.
You also can retrieve data on demand by using the Retrieve All Server Data option.
Utilization Monitoring
Utilization data is maintained for IP address ranges, IP address blocks, and IP range groups within
IPAM. You can configure thresholds for the percentage of the IP address space that is utilized, and
then use those thresholds to determine under-utilization and over-utilization.
You can perform utilization trend building and reporting for IPv4 address ranges, blocks, and range
groups. The utilization trend window allows you to view trends over time periods, such as daily,
weekly, monthly, or annually. You also can view trends over custom date ranges. Utilization data
from managed DHCP scopes is auto-discovered, and you can view this data.
Monitoring DHCP and DNS

By using IPAM, you can monitor DHCP and DNS servers from any physical location of the enterprise.
One of the primary benefits of IPAM is its ability to simultaneously manage multiple DHCP servers
or DHCP scopes that are spread across one or more DHCP servers.
The IPAM monitoring view allows you to view the status and health of selected sets of Microsoft DNS
and DHCP servers from a single console. IPAMs monitoring view displays the basic health of servers
and recent configuration events that occurred on these servers. The monitoring view also allows you
to organize the managed servers into logical sever groups.
53/66
11/17/2014
For DHCP servers, the server view allows you to track various server settings, server options, the
number of scopes, and the number of active leases that are configured on the server. For DNS
servers, this view allows you to track all zones that are configured on the server, along with details
of the zone type. The view also allows you to see the total number of zones that are configured on
the server, and the overall zone health status as derived from the zone status of individual zones on
the server.
DHCP Server Management

From the IPAM console, you can manage DHCP servers and perform the following actions:
Edit DHCP server properties.
Edit DHCP server options.
Create DHCP scopes.
Configure predefined options and values.
Configure the user class across multiple servers simultaneously.
Create and edit new and existing user classes across multiple servers simultaneously.
Configure the vendor class across multiple servers simultaneously.
Start the management console for a selected DHCP server.
Retrieve server data from multiple servers.
DNS Server Management

You can start the DNS management console for any managed DNS server from a central console in
the IPAM server. Once you start the DNS management console, you can retrieve server data from
the selected set of servers. The DNS Zone Monitoring view displays all the forward lookup and
reverse lookup zones on all the DNS servers that IPAM is currently managing. For the forward
lookup zones, IPAM also displays all the servers that are hosting the zone, the aggregate health of
the zone across all these servers, and the zone properties.
The Event Catalog

The IPAM event catalog provides a centralized repository for auditing all configuration changes that
are performed on DHCP servers that are managed from a single IPAM management console. The
IPAM configuration events console gathers all of the configuration events. These configuration event
catalogs allows you to view, query, and generate reports of the consolidated configuration changes,
along with details specific to each record.
Demonstration: Using IPAM Monitoring

54/66
11/17/2014
In this demonstration, you will see how to use the IPAM console to monitor DNS and DHCP.
Demonstration Steps
1.
On LON-SVR2, review the information displayed in the DNS and DHCP Servers pane in the
IPAM console.
2.
Review the information in the DHCP Scopes pane.
3.
Review the information in the DNS Zone Monitoring pane.
4.
Review the information in the Server Groups pane.
Lab: Implementing Advanced Network Services

Scenario
A. Datum Corporation has grown rapidly over the last few years. The company has deployed several
new
branch offices, and it has increased significantly the number of users in the organization.
Additionally, it has expanded the number of partner organizations and customers that access A.
Datum websites and applications. Because of this expansion, the network infrastructure complexity
has increased, and the organization now needs to be much more aware of network-level security.
As one of the senior network administrators at A. Datum, you are responsible for implementing
some of the advanced networking features in Windows Server 2012 R2 to manage the networking
infrastructure. You need to implement new features in DHCP and DNS, with the primary goal of
providing higher levels of availability while increasing the security of these services. You also need
to implement IPAM so that you can simplify and centralize the IP address usage and configuration
management in an increasingly complex network.
Objectives
In this lab, you will see how to:
Configure advanced DHCP settings.
Configure advanced DNS settings.
Configure IP address management.
Lab Setup
55/66
11/17/2014
Estimated Time: 70 minutes

Virtual machines: 20412D-LON-DC1, 20412D-LON-SVR1,
20412D-LON-SVR2, 20412D-LON-CL1
User Name: Adatum\Administrator
Password: Pa$$w0rd
For this lab, you will use the available virtual machine environment. Before you begin the lab, you
must complete the following steps:
1.
On the host computer, click Start, point to Administrative Tools, and then click Hyper-V
Manager.
2.
In Hyper-V Manager, click 20412D-LON-DC1, and in the Actions pane, click Start.
3.
In the Actions pane, click Connect. Wait until the virtual machine starts.
4.
Sign in using the following credentials:

User name: Adatum\Administrator
Password: Pa$$w0rd
5.
Repeat steps 2 to 4 for 20412D-LON-SVR1 and 20412D-LON-SVR2. Do not start 20412D-LON-CL1

until directed to do so.
Exercise 1: Configuring Advanced DHCP Settings

Scenario
With the expansion of the network, and the increased availability and security requirements at A.
Datum Corporation, you need to implement additional DHCP features. Because of the recent
business expansion, the main office DHCP scope is almost completely utilized, which means that you
need to configure a superscope. Additionally, you need to configure DHCP Name Protection and
DHCP failover.
The main tasks for this exercise are as follows:
1.
Configure a superscope.
2.
Configure DHCP name protection.
3.
Configure and verify DHCP failover.
56/66
11/17/2014
Task 1: Configure a superscope
1.
On LON-DC1, configure a scope named Scope1, with a range of 192.168.0.50

192.168.0.100, and with the following settings:
Subnet mask: 255.255.255.0
Router: 192.168.0.1
DNS Suffix: Adatum.com
Choose to activate the scope later.
2.
Configure a second scope named Scope2 with a range of 192.168.1.50 192.168.1.100, and
with the following settings:
Subnet mask: 255.255.255.0
Router: 192.168.1.1
DNS Suffix: Adatum.com
Choose to activate the scope later.
3.
Create a superscope called AdatumSuper that has Scope1 and Scope2 as members.
4.
Activate the AdatumSuper superscope.
Task 2: Configure DHCP name protection
Switch to the DHCP console on LON-DC1, and enable DHCP Name Protection found on the DNS
tab of the IPv4 node.
Task 3: Configure and verify DHCP failover
1.
On LON-SVR1, start the DHCP console and observe the current state of DHCP. Note that the
server is authorized, but that no scopes are configured.
2.
On LON-DC1, in the DHCP console, launch the Configure Failover Wizard.
3.
Configure failover replication with the following settings:

Partner server: 172.16.0.21
Relationship Name: Adatum
57/66
11/17/2014
Maximum Client Lead Time: 15 minutes

Mode: Load balance
Load Balance Percentage: 50%
Message authentication shared secret: Pa$$w0rd
4.
Complete the Configure Failover Wizard.
5.
On LON-SVR1, refresh the IPv4 node. Notice that the IPv4 node is active, and that Scope
Adatum is configured.
6.
Start 20412D-LON-CL1, and sign in as Adatum\Administrator.
7.
Configure LON-CL1 to obtain an IP address from the DHCP server.
8.
Open a command prompt window, and record the IP address.
9.
Switch to LON-DC1, and stop the DHCP server service.
10. Switch back to LON-CL1, and renew the IP address.

11. On LON-DC1, in the Services console, start the DHCP server service.
12. Close the Services console.
Results: After completing this exercise, you will have configured a superscope, configured DHCP
Name Protection, and configured and verified DHCP failover.
Exercise 2: Configuring Advanced DNS Settings

Scenario
To increase the security level for the DNS zones at A. Datum, you need configure DNS security
settings such as DNSSEC, DNS socket pool, and cache locking. A. Datum has a business relationship
with Contoso, Ltd., and will host the Contoso.com DNS zone. A. Datum clients use an application that
accesses a server named App1 in the Contoso.com zone by using its NetBIOS name. You need to
ensure that these applications can resolve the names of the required servers correctly. You will
employ a GlobalNames zone to achieve this.
1.
Configure DNSSEC.
2.
Configure the DNS socket pool.
58/66
11/17/2014
3.
Configure DNS cache locking.
4.
Configure a GlobalNames zone.
Task 1: Configure DNSSEC
1.
On LON-DC1, start the DNS Manager.
2.
Use the DNSSEC Zone Signing Wizard to sign the Adatum.com zone.
3.
Choose to customize zone-signing parameters.
4.
Ensure that DNS server LON-DC1 is the Key Master.
5.
Add the Key Signing Key by accepting the default values for the new key.
6.
Add the Zone Signing Key by accepting the default values for the new key.
7.
Choose to use NSCE3 with the default values.
8.
Choose to enable the distribution of trust anchors for this zone.
9.
Accept the default values for signing and polling.
10. Verify that the DNSKEY resource records have been created in the Trust Points zone.
11. Minimize the DNS console.
12. Use the Group Policy Management Console, in the Default Domain Policy object, to configure the
Name Resolution Policy Table.
13. Create a rule that enables DNSSEC for the Adatum.com suffix, and that requires DNS clients to
verify that the name and address data were validated.
Task 2: Configure the DNS socket pool
1.
On LON-DC1, start Windows PowerShell.
2.
Run the following command to view the current size of the socket pool:
Get-DNSServer
3.
Run the following command to change the socket pool size to 3,000:
dnscmd /config /socketpoolsize 3000
59/66
11/17/2014
4.
Restart the DNS service.
5.
Run the following command to confirm the new socket pool size:
Get-DnsServer
Task 3: Configure DNS cache locking
1.
Run the following command to view the current cache lock size:
Get-DnsServer
2.
Run the following command to change the cache lock value to 75 percent:
Set-DnsServerCache LockingPercent 75
3.
Restart the DNS service.
4.
Run the following command to confirm the new cache lock value:
Get-DnsServer
Task 4: Configure a GlobalNames zone
1.
Create an Active Directory-integrated forward lookup zone named Contoso.com, by running the
following command:
Add-DnsServerPrimaryZone Name Contoso.com ReplicationScope Forest
2.
Run the following command to enable support for GlobalName zones:

Set-DnsServerGlobalNameZone AlwaysQueryServer $true
3.
Create an Active Directory-integrated forward lookup zone named GlobalNames by running the
60/66
11/17/2014
following command:
Add-DnsServerPrimaryZone Name GlobalNames ReplicationScope Forest
4.
Open the DNS Manager console, and add a new host record to the Contoso.com domain named
App1 with the IP address of 192.168.1.200.
5.
In the GlobalNames zone, create a new alias named App1 using the FQDN of
App1.Contoso.com.
6.
Close DNS Manager, and close the Windows PowerShell window.
Results: After completing this exercise, you will have configured DNSSEC, the DNS socket pool,
DNS cache locking, and the GlobalName zone.
Exercise 3: Configuring IPAM

Scenario
A. Datum Corporation is evaluating solutions for simplifying IP address management. Since you
implemented Windows Server 2012, you have decided to implement IPAM.
1.
Install the IPAM feature.
2.
Configure IPAMrelated GPOs.
3.
Configure IP management server discovery.
4.
Configure managed servers.
5.
Configure and verify a new DHCP scope with IPAM.
6.
Configure IP address blocks, record IP addresses, and create DHCP reservations and DNS
records.
7.
To prepare for the next module.
Task 1: Install the IPAM feature
On LON-SVR2, install the IP Address Management (IPAM) Server feature by using the Add
61/66
11/17/2014
Roles and Features Wizard in Server Manager.
Task 2: Configure IPAMrelated GPOs
1.
On LON-SVR2, in the Server Manager, in the IPAM Overview pane, provision the IPAM server
using Group Policy.
2.
Enter IPAM as the GPO name prefix, and provision IPAM using the Provision IPAM Wizard.
Task 3: Configure IP management server discovery
1.
In the IPAM Overview pane, configure server discovery for the Adatum domain.
2.
In the IPAM Overview pane, start the server discovery process. Discovery may take five to 10
minutes to run. The yellow bar will indicate when discovery is complete.
Task 4: Configure managed servers
1.
In the IPAM Overview pane, add the servers that you need to manage. Verify that IPAM access
is currently blocked for both LON-DC1 and LON-SVR1.
2.
Use Windows PowerShell to grant the IPAM server permission to manage by running the
following command:
Invoke-IpamGpoProvisioning Domain Adatum.com GpoPrefixName IPAM IpamServerFqdn
LON-SVR2.adatum.com DelegatedGpoUser Administrator
3.
For both LON-DC1 and LON-SVR1, set the manageability status to Managed.
4.
Switch to LON-DC1, and force the update of Group Policy using gpupdate /force.
5.
Switch to LON-SVR1, and force the update of Group Policy by using gpupdate /force.
6.
Return to LON-SVR2, and refresh the server access status for LON-DC1 and LON-SVR1 and the
Server Manager console view. It may take up to 10 minutes for the status to change. If
necessary, repeat both refresh tasks as needed until a green check mark displays next to LONDC1 and the IPAM Access Status displays as Unblocked.
7.
In the IPAM Overview pane, right click LON-SVR1 and Retrieve All Server Data.
8.
In the IPAM Overview pane, right-click LON-DC1 and Retrieve All Server Data.
62/66
11/17/2014
Task 5: Configure and verify a new DHCP scope with IPAM
1.
On LON-SVR2, use IPAM to create a new DHCP scope with the following parameters:
Scope Name: TestScope
Scope start address: 10.0.0.50
Scope end address: 10.0.0.100
Subnet mask: 255.0.0.0
Default gateway: 10.0.0.1
2.
Use IPAM to configure failover for the TestScope on LON-DC1 with the following parameters:
Partner server: LON-SVR1.adatum.com
Relationship name: TestFailover
Shared secret: Pa$$w0rd
Maximum client lead time: 15 minutes
Mode: Load balance
Load balance percentage: 50%
3.
On LON-DC1, verify the scope in the DHCP MMC.
4.
On LON-SVR1, verify the scope in the DHCP MMC.
Task 6: Configure IP address blocks, record IP addresses, and create DHCP reservations and DNS records
1.
On LON-SVR2, add an IP address block in the IPAM console with the following parameters:
Network ID: 172.16.0.0
Prefix length: 16
Description: Head Office
2.
Add IP addresses for the network router by adding to the IP Address Inventory with the
following parameters:
IP address: 172.16.0.1
63/66
11/17/2014
Device type: Routers

Description: Head Office Router
3.
Use the IPAM console to create a DHCP reservation as follows:

IP address: 172.16.0.10
Device type: Host
Client ID: Associate MAC to Client ID checkbox
Reservation server name: LON-DC1.Adatum.com
Reservation name: Webserver
Reservation type: Both
4.
Use the IPAM console to create the DNS host record as follows:
Device name: Webserver
Forward lookup zone: Adatum.com
Forward lookup primary server: LON-DC1.adatum.com
Automatically create DNS records for this IP address
5.
On LON-DC1, open the DHCP console and confirm that the reservation was created in the
172.16.0.0 scope.
6.
On LON-DC1, open the DNS Manager console and confirm that the DNS host record was created.
Task 7: To prepare for the next module
1.
On the host computer, start the Hyper-V Manager.
2.
In the Virtual Machines list, right-click 20412D-LON-DC1, and then click Revert.
3.
In the Revert Virtual Machine dialog box, click Revert.
4.
Repeat steps 2 and 3 for 20412D-LON-SVR1, 20412D-LON-SVR2, and 20412D-LON-CL1.
Results: After completing this exercise, you will have installed IPAM and configured IPAM with
IPAM-related GPOs, IP management server discovery, managed servers, a new DHCP scope, IP
address blocks, IP addresses, DHCP reservations, and DNS records.
64/66
11/17/2014
Question: Will client computers immediately stop communicating on the network if there is no
functioning DHCP server?
Question: What is the default size of the DNS socket pool?
Question: What value does the DNS cache lock use to determine when to update an IP
address in the DNS cache?
Module Review and Takeaways

Best Practice
Implement DHCP failover to ensure that client computers can continue to receive IP configuration
information in the event of a server failure.
Ensure that there are at least two DNS servers hosting each zone.
Use IPAM to control IP address distribution and static address assignments.
Common Issues and Troubleshooting Tips

Common Issue
Troubleshooting Tip
Users can no longer access a

vendors website that they have
historically been able to access.
Managed servers are unable to

connect to the IPAM server.
Review Question
Question: What is one of the drawbacks of using IPAM?
Real-world Issues and Scenarios

Some network clients are receiving incorrect DHCP configuration. What tool should you use to begin
the troubleshooting process?
Answer: The IPConfig /All command will report to you if the client is receiving DHCP configuration,
and if so, the IP address of the DHCP server from which the configuration came.
What are some possible causes of the incorrect configurations?
65/66
11/17/2014
Answer: There may be a rogue DHCP server on the network. Common things to look for will be
gateway devicessuch as cable modems or Private Branch Exchange (PBX) boxesthat have a
DHCP component enabled. Another possibility is that someone configured the IP address on the
client manually.
Tools
Tool
Use
Location
Dnscmd
Configure all aspects of DNS
%systemroot%\System32\dnscmd.exe
management
DHCP console
Control all aspects of DHCP
%systemroot%\System32\dhcpmgmt.msc
management from a user interface

DNS console
Control all aspects of DNS
%systemroot%\System32\dnsmgmt.msc
management from a user interface

IPAM management console
Control all aspects of IPAM
Server Manager
management
Get-DnsServer
Command to display DNS Server
Windows PowerShell
information.
Set-DnsServer
Command to configure the DNS
Windows PowerShell
Server, similar to dnscmd

command.
Export-Clixml
Used to write output from a
Windows PowerShell
PowerShell command as an xml file.

Import-Clixml
Used to import information from an
Windows PowerShell
xml file into an object for use with

a PowerShell command.
66/66

Module 1 - Implementing Advanced Network Services

Uploaded by

Copyright:

Available Formats

Module 1 - Implementing Advanced Network Services

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Module 1 - Implementing Advanced Network Services

Uploaded by

Copyright:

Available Formats

11/17/2014

Module 1: Implementing Advanced Network Services

Module 1: Implementing Advanced Network Services

Configuring Advanced DHCP Features

Configuring Advanced DNS Settings

Managing IP Address Spaces with IPAM

Implementing Advanced Network Services

Lesson 1 : Configuring Advanced DHCP Features

Module 1: Implementing Advanced Network Services

DHCP Components Overview

Module 1: Implementing Advanced Network Services

A name and description

A range of addresses that can be distributed

IP addresses that should be excluded from distribution

The duration of the IP address lease

Default Gateway IP address

DNS server IP address

DNS domain suffix

Globally to all scopes

Specifically to particular scopes

To specific clients based on a class ID value

To clients that have specific IP address reservations configured

Module 1: Implementing Advanced Network Services

How Clients Acquire IP Addresses

DHCP Server Authorization

Module 1: Implementing Advanced Network Services

You use this cmdlet to add an IP range to an existing scope policy.

Module 1: Implementing Advanced Network Services

You use this cmdlet to add security groups to a

You use this cmdlet to add an IP address exclusion

You use this cmdlet to add a multicast scope on the

You use this cmdlet to add a new policy to either a

You use this cmdlet to get the credentials for an

You can now use this cmdlet to display DNS settings

You use this cmdlet to retrieve the exclusion range

You use this cmdlet to retrieve multicast leases for

You use this cmdlet to get information on multicast

You use this cmdlet to get information on multicast

Configuring DHCP Interaction with DNS

Module 1: Implementing Advanced Network Services

Configuring Dynamic DNS Updates

Module 1: Implementing Advanced Network Services

DNS PTR Registration

Configuring Advanced DHCP Scope Designs

Module 1: Implementing Advanced Network Services

DHCP Integration with IPv6

Module 1: Implementing Advanced Network Services

Atlantic islands, and the United States.

Stateful and Stateless Configuration

DHCPv6 Scopes for IPv6

Name and description

This property identifies the scope.

Valid and Preferred lifetimes

This property defines how long leased addresses are valid.

As with IPv4, there are many available options.

Configuring an IPv6 Scope

Module 1: Implementing Advanced Network Services

Configure a scope prefix and preferencefor example, fe80:409c:f385:9e55:eb82:: as the

Define the starting and ending IP addresses, and any exclusions.