Implementing Dynamic Host

Editor's Notes

• #2: Presentation: 60 minutes Lab: 45 minutes After completing this module, students will be able to: Install the Dynamic Host Configuration Protocol (DHCP) server role. Configure DHCP scopes. Manage a DHCP database. Secure and monitor the DHCP server role. Required Materials To teach this module, you need the Microsoft® Office PowerPoint® file 20410B_06.pptx. Important: It is recommended that you use Office PowerPoint 2007 or a newer version to display the slides for this course. If you use PowerPoint Viewer or an earlier version of Office PowerPoint, all the features of the slides might not display correctly. Preparation tasks To prepare for this module: Read all of the materials for this module. Practice performing the demonstrations and the lab exercises. Work through the Module Review and Takeaways section, and determine how you will use this section to reinforce student learning and promote knowledge transfer to on‑the‑job performance.
• #3: Briefly present module content. Instruct students that DHCP is implemented in almost every company, and it is one of the foundational networking components in IT infrasture, so it is important for them to understand it.
• #4: Briefly present the lesson content.
• #5: Define DHCP. Explain how DHCP reduces the complexity and amount of administrative work by using automatic IP configuration. Explain the difference between manual and automatic IP configuration. Provide examples of how DHCP reduces the complexity and amount of administrative work. Instruct students that by using DHCP, correct configuration information is ensured—but only if DHCP is also configured correctly. If DHCP is misconfigured, then the clients will not receive the correct configuration from the DHCP server.
• #6: Ensure that students understand that the two methods for obtaining a lease are to request a new lease, or to renew an existing lease. Explain to students that DHCP uses IP broadcasts to initiate communications. Therefore, DHCP servers are limited to communication within their IP subnet. This means that in many networks, there is a DHCP server for each IP subnet. When this is not feasible, either for cost or management reasons, you can use a DHCP relay agent. With the DHCP relay agent, the DHCP can broadcast packets for relay into another IP subnet across a router. This makes it possible to maintain a single DHCP server that services multiple IP subnets. DHCP packets can also be relayed into other subnets using a router that is compatible with Request for Comment (RFC) 1542. Instruct students that in a later topic you will discuss the DHCP relay agent in more detail.
• #7: Explain that DHCP uses a four-step process to lease IP addressing information to DHCP clients. Describe the DHCP lease-generation process by referring to the slide’s illustration. It is important that students understand this process. Run through the demonstration as many times as necessary.
• #8: Describe the DHCP lease-renewal process by referring to the slide’s illustration. Explain to students that DHCP Renewal occurs when 50 percent of lease duration has expired. Also mention to students that renewal occurs during startup even if more than 50 percent remains. This is because a computer might have been relocated since it was shut down—perhaps because it is a laptop.
• #9: Inform students that today most routers and most enterprise switches (that can route) support RFC 1542.
• #10: Students should know and understand the importance of DHCP authorization. An unauthorized DHCP server can cause problems in a network, and incorrectly configured clients can cause numerous issues. Explain to students that when you install a DHCP role in a domain, an Enterprise Administrator must authorize it because several domains can exist in the same IP subnet. Although it is not recommended, you can use a standalone server as a DHCP server if it is not on a subnet with any authorized DHCP servers. When a standalone DHCP server detects an authorized server on the same subnet, it automatically stops leasing IP addresses to DHCP clients. It also is important to note that other network devices may run DHCP servers. These devices do not comply with the notion of being authorized, and therefore might cause issues in a networked environment.
• #11: Preparation Steps Start the virtual machines 20410B‑LON‑DC1 and 20410B‑LON‑SVR1. Demonstration Steps Install the DHCP server role Sign in to LON‑SVR1 as Adatum\Administrator with the password Pa$$w0rd. On the Taskbar, click the Server Manager icon, then in Server Manager, click Add roles and features. In the Add Roles and Features Wizard, click Next. On the Select installation type page, click Next. On Select destination server page, click Next. On Select server roles page, select the DHCP Server check box. In Add Roles and Features Wizard, click Add Features, and then click Next. On the Select features page, click Next. On the DHCP Server page, click Next. On the Confirm installation selections page, click Install. On the Installation progress page, wait until Installation succeeded on LON‑SVR1.Adatum.com displays, and then click Close.
• #12: Authorize the DHCP Server On LON‑SVR1, on the Server Manager dashboard, click Tools, and then click DHCP. In the DHCP console, expand lon‑svr1.adatum.com. Right‑click lon‑svr1.adatum.com, and then click Authorize. In the DHCP console, right‑click lon‑svr1.adatum.com, and then click Refresh. Notice that the icons next to IPv4 and IPv6 change color from red to green, which means that DHCP server has been authorized in AD DS. Note: Leave all virtual machines in their current state for the next demonstration.
• #13: Briefly introduce the lesson topics to students.
• #14: Describe the purpose of a DHCP scope. Explain that administrators must create a DHCP scope before leasing IP addresses to a client. Instruct students that a scope may contain IP addresses that are NOT available for lease. These addresses are configured as an exclusion, which they will learn about in following topics. Scope properties contain data about the scope, such as the scope range, the lease duration, Domain Name System (DNS) update settings, Network Address Protection (NAP) configuration, and DHCP/BOOTP configuration options. Describe IPv4 or IPv6 scope capabilities. Explain that you can create scopes by using the New Scope Wizard, or by using the Netsh command-line tool. Also, mention that this wizard and this tool will be discussed more later in this module.
• #15: Explain what a DHCP reservation is. Explain why and when you would use a DHCP reservation. For example, if you intend to have network devices—such as network printers—it often is desirable to provide them with a fixed address. This ensures that IP addresses in a predefined scope are not assigned inadvertently to another device. This also ensures that should a scope be depleted of addresses, the devices with reservations will be guaranteed to have an IP address. To configure a reservation, you must know the media access control (MAC) or physical address of the device. This is how the DHCP server knows that the device should have a reservation.
• #16: Explain the purpose of DHCP options. Mention the DHCP options that you use in Windows®-based operating systems deployment, that utilize Preboot eXecution Environment (PXE), which requires a DHCP server.
• #17: Explain how DHCP applies options to client computers when multiple options are configured at the server, scope, class, and reserved-client level. Ensure that students understand that DHCP applies options to client computers in a specific order: Server level Scope level Class level Reserved-client level It is also important that students understand these three points: Scope options override server options. Class options override both scope and server options. Reserved client options apply to devices that have a DHCP reservation.
• #18: Preparation Steps You will need the 20410B‑LON‑DC1, and 20410B‑LON‑SVR1, virtual machines to complete this demonstration. They should already be running after the preceding demonstration. Demonstration Steps Configure scope and scope options in DHCP In DHCP, in the navigation pane, click lon‑svr1.adatum.com, expand IPv4, right‑click IPv4, and then click New Scope. In the New Scope Wizard, click Next On the Scope Name page, in the Name box, type Branch Office, and then click Next. On the IP Address Range page, complete the page using the following information, and then click Next: Start IP address: 172.16.0.100 End IP address: 172.16.0.200 Length: 16 Subnet mask: 255.255.0.0 On the Add Exclusions and Delay page, complete the page using the following information: Start IP address: 172.16.0.190 End IP address: 172.16.0.200 Click Add, and then click Next. On the Lease Duration page, click Next. On the Configure DHCP Options page, click Next. On the Router (Default Gateway) page, in the IP address box, type 172.16.0.1, click Add, and then click Next.
• #19: On the Domain Name and DNS Servers page, click Next. On the WINS Servers page, click Next. On the Activate Scope page, click Next. On the Completing the New Scope Wizard page, click Finish.
• #20: Briefly present the lesson content.
• #21: Describe the DHCP database. Emphasize that the J50.log file, J50#####.log file, Dhcp.mdb file, and Dhcp.tmp file should not be removed or altered. Describe compacting the DHCP database. Ensure that students understand that DHCP databases do not recover space automatically when records are erased. Thus, the database is compacted periodically. If database use increases, it may be necessary to compact it manually. Starting with the Microsoft Windows NT® Server 4.0 operating system, dynamic database compaction occurs on DHCP servers as an automatic background process during idle time or after a database update.
• #22: Describe how you back up and restore the DHCP database. Automatic Backup (Synchronous Backup) Occurs every 60 minutes. Best practice: Ensure that you keep an offsite backup of the database. Best practice: Make sure that your automatic backup is to a different volume than that on which your DHCP server is running. Manual Backup (Asynchronous Backup) Requires administrative-level permissions. Can also be a member of the DHCP administrators group. Show the students where option for manual backup is in the console. What is backed up All scopes Reservations Leases All options, including server options, scope options, reservation options, and class options All registry keys and other configuration settings that are set in DHCP server properties. These settings are stored in the following registry subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer\Parameters To back up this subkey, open Registry Editor and then save the specified key to a text file. Backup Security Best Practice: Backups that are stored on another volume should grant permissions only to the administrator and the DHCP administrator groups. Restore Process Requires administrative-level permissions. Can also be a member of the DHCP administrator group. Note: Mention that performing a system state backup of a server that is hosting the DHCP server role results in a backup of the DHCP database and configuration.
• #23: Explain how you reconcile a DHCP database.
• #24: You can move a DHCP database from one server to another by using the normal backup and restore procedure. Steps for moving a DHCP database: Back up the DHCP database on the old server. Stop the old DHCP server. Copy the DHCP database to the new server and, if necessary, install the DHCP server role. Restore the database. Start the DHCP Server service.
• #25: Briefly present the lesson content.
• #26: Discuss the guidelines for preventing an unauthorized computer from obtaining a lease. Emphasize that the only way to prevent unauthorized access completely using only DHCP is to disallow network access. However, this is not feasible. Therefore, the next best actions are to limit the possibility of an unauthorized user plugging into an empty network jack, and to implement security on a wireless network. Use NAP to validate a client computer’s health. NAP can determine if the computer is running both an up‑to‑date antivirus program and the latest Windows operating system updates. If the computer is not compliant with the NAP policy, it can be denied network access or it can be relegated to a remediation network where it may obtain the necessary updates to become compliant. You also can use NAP to restrict access to a network based on whether the user is authorized for network access. Some organizations lock down the network ports based on MAC address. Each MAC address is restricted to a specific port. If a different MAC address attempts to communicate on that port, the port will shut down.
• #27: Mention to students that users must disable DHCP services from other devices, such as routers or non‑Microsoft tools. If users complain of network access problems, check the IP settings that the DHCP server is providing by using the ipconfig/all command. If the DHCP server result is not correct, investigating the IP address in question should identify the problem. The only way to restrict unauthorized DHCP servers is to find their source IP, and then to remove them from the network.
• #29: Explain that DHCP statistics provide a general view of DHCP activity and usage. Point out to students that you can configure the refresh rate for the statistics in the General tab of server’s Properties dialog box. Show students the statistics panel in the DHCP Server. For the DHCP server statistics section Provide an overview of DHCP server usage. Point out to students that they can use this data to understand the DHCP server’s state quickly. For the DHCP scope statistics section Provide basic data about the leases in the DHCP scope.
• #30: Describe the purpose of the DHCP audit log. Explain that the DHCP audit log file is stored in systemroot\system32\dhcp, and that the name of the audit log file is based on the weekday it was created. For example, if the day of the week is Monday, then the file name is DhcpSrvLog‑Mon.log.
• #31: Discuss common issues that can occur when you do not configure DHCP properly. For each of the issues, ask the students: What tests, tools, and procedures would they use to troubleshoot the issue? What is the cause of the issue? What would they consider the solution? Each student should write in the empty space of the table the possible cause and their opinion about the solution. Some suggested answers to aid the discussion: Address conflicts: Check for manually configured computers with a conflicting address. Verify that scopes do not contain overlapping addresses. Inform students that a DHCP server can be configured to ping an IP address before it leases it, which helps prevent conflicts.) Failure to obtain a DHCP address: Verify that the DHCP server is online. Verify connectivity to the subnet containing the DHCP server. Verify that there are sufficient addresses in the address pool. Address obtained from incorrect scope. Check other clients in the subnet for their configuration. DHCP database suffers data corruption or loss. Restore or recreate the DHCP database. DHCP server exhausts its IP address pool. Reduce the lease duration. Consider redesigning the IP address pools.
• #32: Before the students begin the lab, read the lab scenario and display the next slide. Before each exercise, read the scenario associated with the exercise to the class. The scenarios will give context to the lab and exercises, and will help to facilitate the discussion at the end of the lab. Remind the students to complete the discussion questions after the last lab exercise. Exercise 1: Implementing DHCP As part of configuring the infrastructure for the new branch office, you need to configure a DHCP server that will provide IP addresses and configuration to client computers. Servers are configured with static IP addresses and usually do not use DHCP for obtaining IP addresses. One of the client computers in the branch office needs to access an accounting application in the head office. The network team uses firewalls based on IP addresses to restrict access to this application. The network team has requested that you assign a static IP address to this client computer. Rather than configuring a static IP address on the client computer manually, you decide to create a reservation in DHCP for the client computer. Exercise 2: Implementing a DHCP Relay Agent (Optional Exercise) To avoid configuring an addition DHCP server on the subnet, your manager has asked you to configure a DHCP relay agent for another subnet in your branch office.
• #34: Question For what is the DHCP scope used? Answer The DHCP scope defines what information is leased to DHCP clients through the DHCP process, such as the IP address, the subnet mask, the DNS server IP address, and the Default Gateway IP address. Question How should you configure a computer to receive an IP address from the DHCP server? Answer You should not have to do anything. The computer should be configured to obtain its IP address automatically. Question Why do you need MAC address for a DHCP server reservation? Answer The MAC address uniquely identifies a computer or any other network device, such as network printer. The DHCP reservation process needs to identify the computer or the network device through the MAC address, so it can lease an IP address to the computer or network device. Question What information do you need to configure on a DHCP relay agent? Answer For a DHCP relay agent to provide IP addresses for subnets that have no DHCP server installed, you need to install DHCP relay agent protocol on a server that will act as a DHCP relay agent. In addition, you must configure the DHCP relay agent to contact the IP address of the DHCP server in another subnet, for purposes of leasing IP addresses to DHCP clients.
• #35: Review Questions Question You have two subnets in your organization and want to use DHCP to allocate addresses to client computers in both subnets. You do not want to deploy two DHCP servers. What factors must you consider? Answer Either the router that interconnects the two subnets must support DHCP relaying, or you must place a DHCP relay agent on the subnet that does not host the DHCP server. Additionally, you should consider the impact on service availability if your single DHCP server should ever fail. Question Your organization has grown, and your IPv4 scope is almost out of addresses. What should you do? Answer Consider redesigning your IPv4 scope. Question What information do you require to configure a DHCP reservation? Answer You require the MAC address of the client that will lease the reservation. Question Can you configure option 003 – Router as a Server-level DHCP scope option? Answer Yes, you can, but you should configure the option in each subnet. In a multi-subnet environment, all clients from the same subnet should obtain the same gateway setting. Tools
• #36: Best Practices: Spend time designing your IP addressing scheme so that it will accommodate both your current IT infrastructure and any potential future IT infrastructure needs. Determine which devices need DHCP reservations, such as network printers, network scanners, or IP-based cameras. Secure your network from unauthorized DHCP servers. Configure the DHCP database on highly available disk drive configurations, such as redundant array of independent disks (RAID)‑5 or RAID‑1, to provide DHCP service availability in case of single disk failure. Back up the DHCP database regularly, and test the restore procedure in an isolated, non‑production environment. Monitor the system utilization of DHCP servers, and upgrade the DHCP server hardware if needed to provide better service performance. Discuss best practices and real world scenarios with students, and ask for their experience on the topics above.