Professional Documents
Culture Documents
This document is provided "as-is". Information and views expressed in this document, including URL and other Internet Web site references, may change without notice. This document does not provide you with any legal rights to any intellectual property in any Microsoft product or product name. You may copy and use this document for your internal, reference purposes. You may modify this document for your internal, reference purposes. 2013 Microsoft. All rights reserved. Terms of Use (http://technet.microsoft.com/cc300389.aspx) | Trademarks (http://www.microsoft.com/library/toolbar/3.0/trademarks/en-us.mspx)
Table Of Contents
Chapter 1
DHCP Step-by-Step Guide: Demonstrate DHCP Link Layer-based Filtering in a Test Lab DHCP Step-by-Step Guide: Demonstrate DHCP Name Protection in a Test Lab DHCP Step-by-Step Guide: Demonstrate DHCP Split Scope with Delay on a Secondary Server in a Test Lab
Chapter 1
DHCP Step-by-Step Guide: Demonstrate DHCP Link Layerbased Filtering in a Test Lab
20 out of 23 rated this helpful Security and network administrators are increasingly wary of internal security threats, in addition to threats from the outside, due to the introduction of uncertified hardware and software on the network, such as packet sniffers, Remote Monitoring (RMON) probes, and personal portable computers and PDAs that are potentially compromised and non-security compliant. Link layer-based filtering for Dynamic Host Configuration Protocol (DHCP) enables administrators to control network access based on media access control (MAC)address, providing a low-level security method. Combined with other network access technologies, such as Network Access Protection (NAP), Internet Protocol security (IPsec), and Windows Firewall with Advanced Security, link layer-based filtering can be an integral piece of your internal network defense. The link layer filtering controls are built into the DHCP console for easy configuration and allow the administrator to specify which MAC addresses are allowed on the network and which are denied access. You can use wild cards to allow or deny network access based on vendor MAC prefixes. Link layer filtering is currently available for IPv4 address only. The step-by-step instructions in this paper will show you how to deploy link layer-based filtering in a test lab so that you can better understand how this configuration works.
In this guide
This paper contains an introduction to link layer based filtering and instructions for setting up a test lab using one DHCP server and three client computers. Important The following instructions are for configuring a test lab using the minimum number of computers. Individual computers are needed to separate the services provided on the network and to clearly show the desired functionality. This configuration is not designed to reflect best practices, nor does it reflect a recommended configuration for a production network. This configuration, including IP addresses and all other configuration parameters, is designed only to work on a separate test lab network.
Scenario overview
In this test lab, link layer-based filtering is deployed on one server running the Windows Server 2008 R2 operating system with DHCP installed, and three client computers running the Windows 7operating system with the DHCP Client service running. A computer running Windows Server 2003 is also used in the test lab as a domain controller and Domain Name System (DNS) server.
All the domain-joined DHCP clients are configured to dynamically obtain the IP address from the DHCP server in the domain. DHCP Client 1 is a healthy network authorized client computer that is active and has an IP address from the DHCP server. DHCP Client 2 is a malicious unauthorized client computer that is active and has an IP address from DHCP Server 1. DHCP Client 3 is a new client computer that is inactive and does not have network connectivity.
Software requirements
The following are required components of the test lab:
The product disc for Windows Server 2008 R2. The product disc for Windows Server 2003 with Service Pack 2 (SP2). The product disc for Windows 7. This lab demonstrates link layer-based filtering with a DHCP server in a domain with Active Directory directory services and Windows Server 2003 installed. You can also make the domain controller in this lab run Windows Server 2008 R2.
Configure DC1. DC1 is a server running the Windows Server 2003 Standard Edition operating system. DC1 is configured as a domain controller with Active Directory. It is also configured as the primary DNS server for the intranet subnet. Configure DHCP Server 1. DHCP Server 1 is a server running Windows Server 2008 R2. DHCP Server 1 is configured with the DHCP Server service, and functions as a DHCP server in the domain. Configure Windows-based DHCP clients
DHCP Client 1, DHCP Client 2, and DHCP Client 3 are client computers running Windows 7. DHCP Client 1, DHCP Client 2, and DHCP Client 3 are configured to request IP addresses from DHCP Server 1.
After all the components are configured, this guide will provide steps to demonstrate how link layer-based filtering gives you the control to allow or deny network access to the three clients based on MAC address.
Configure DC1
DC1 is a computer running Windows Server 2003 Standard Edition with SP2 that provides the following services:
A domain controller for the Contoso.com Active Directory domain. A DNS server for the Contoso.com DNS domain.
Install the operating system. Configure Transmission Control Protocol/Internet Protocol (TCP/IP) Install Active Directory and DNS. Create a user account and group in Active Directory.
6. On the Install or Configure DNS page, select No, just install and configure DNS on this computer, and then click Next. 7. Type Contoso.com next to Full DNS name for new domain, and then click Next. 8. Confirm that the Domain NetBIOS name shown is CONTOSO, and then click Next. 9. Accept the default Database Folder and Log Folder directories, and then click Next. 10. Accept the default folder location for Shared System Volume, and then click Next. 11. Verify that Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems is selected, and then click Next. 12. Leave the Restore Mode Password and Confirm Password text boxes blank, and then click Next. 13. View the summary information provided, and then click Next. 14. Wait while the wizard completes configuration of Active Directory and DNS services, and then click Finish. 15. When prompted to restart the computer, click Restart Now. 16. After the computer is restarted, log on to the CONTOSO domain using the Administrator account.
Join the computer to the domain. Install DHCP server roles. Configure DHCP.
1. In the DHCP console tree, under Scope [172.16.0.0] SS Scope, right-click Scope Options, and then click Configure Options. 2. On the Advanced tab, verify that Default User Class is selected next to User class. 3. Select the 006 DNS Servers check box, in IP Address, under Data entry, type 172.16.1.1, and then click Add. 4. Select the 015 DNS Domain Name check box, in String value, under Data entry, type contoso.com, and then click OK. Note The 003 Router option is configured in the default user class if a default gateway is required for client computers. Because all computers in the test lab are located on the same subnet, this option is not required.
Install the operating system. Configure TCP/IP. Verify network connectivity. Join the computer to the domain and restart the computer.
Install Windows 7 Client on DHCP Clients To install the operating system on DHCP Client 1, DHCP Client 2, and DHCP Client 3
1. Start your computer using the product discs for Windows 7. 2. When prompted for the installation type, select Custom Installation. 3. When prompted for a computer name, type DHCP Client 1, DHCP Client 2, and DHCP Client 3. 4. On the Select your computer's current location page, click Work. 5. Follow the rest of the instructions that appear on your screen to finish the installation.
To join DHCP Client 1, DHCP Client 2, and DHCP Client 3 to the Contoso.com domain
1. Click Start, right-click Computer, and then click Properties. 2. Under Computer name, domain, and workgroup settings, click Change settings. 3. In the System Properties dialog box, click Change. 4. In the Computer Name/Domain Changes dialog box, select Domain, type Contoso.com, and then, in Computer Name, type enggmachine1.contoso.com. 5. Click More, and then, in Primary DNS suffix of this computer, type Contoso.com. 6. Click OK two times. 7. When prompted for a user name and password, type the user name and password for the User1 account, and then click OK. 8. When you see a dialog box that welcomes you to the Contoso.com domain, click OK. 9. When you see a dialog box that tells you that you must restart the computer to apply changes, click OK. 10. In the System Properties dialog box, click Close. 11. In the dialog box that prompts you to restart the compute, click Restart the computer now.
All three clients should have unrestricted access to the network at this point. In the next steps, we will add clients to the link layer-based filtering on the DHCP Server 1 allow and deny lists and demonstrate that one client retains access while the other two clients are denied access.
DHCP Client 1 is a healthy network authorized client computer that is active and has an IP address from the DHCP server. DHCP Client 2 is a malicious unauthorized client computer that is active and has an IP address from the DHCP Server 1. DHCP Client 3 is a new client computer that is inactive and does not have network connectivity.
Appendix
This appendix will help you with troubleshooting techniques and the setting of optional features in Windows Server 2008 R2 and Windows 7.
1. Click Start, point to All Programs, click Accessories, and then click Run. 2. Type eventvwr.msc, and press ENTER. 3. In the left tree, navigate to Event Viewer (Local)\Windows Logs\System. 4. Click an event in the middle pane. 5. By default, the General tab is displayed. Click the Details tab to view additional information. 6. You can also right-click an event and then click Event Properties to open a new window for reviewing events.
20093 - ERROR_DHCP_LINKLAYER_ADDRESS_EXISTS Address or address pattern is already contained in one of the list. 20094 - ERROR_DHCP_LINKLAYER_ADDRESS_RESERVATION_EXISTS Address to be added to Deny list or to be deleted from allow list has an associated reservation. 20095 - ERROR_DHCP_LINKLAYER_ADDRESS_DOES_NOT_EXIST Address or Address pattern is not contained in either list 20096 - EVENT_FILTER_DENIED_IN_DENY_LIST DHCP services were denied to computer with hardware address %1, hardware type %4, and FQDN/Hostname %2 because it matched entry %3 in the Deny list. 20097 - EVENT_FILTER_DENIED_NOT_IN_ALLOW_LIST DHCP services were denied to computer with hardware address %1, hardware type %3, and FQDN/Hostname %2 because it did not match any entry in the Allow list. 20098 - EVENT_FILTER_EMPTY_ALLOW_LIST No DHCP clients are being served because the Allow list is empty and the server was configured to provide DHCP services to clients whose hardware addresses are present in the Allow list. 20099 - EVENT_FILTER_DENIED_IN_DENY_LIST_UNSPECIFIED DHCP services were denied to computer with hardware address %1, hardware type %4, and unspecified FQDN/Hostname%2 because it matched entry %3 in the Deny list. 20100 - EVENT_FILTER_DENIED_NOT_IN_ALLOW_LIST_UNSPECIFIED DHCP services were denied to computer with hardware address %1, hardware type %3, and unspecified FQDN/Hostname%2 because it did not match any entry in the Allow list. 20101 - ERROR_DHCP_HARDWARE_ADDRESS_TYPE_ALREADY_EXEMPT This hardware type is already exempt. 20102 - ERROR_DHCP_UNDEFINED_HARDWARE_ADDRESS_TYPE You are trying to delete an undefined hardware type. To define/add a hardware type, use 'add filterexemption'.
Server name squatting by a client. Server name squatting by another server. Client name squatting by another client. Client name squatting by a server.
In addition, support for DHCP Unique Identifier (DUID) is added to the IPv4 registration on the DHCP client. DUID is described by the IETF in RFC 4361. Name Protection can be configured for IPv4 and IPv6 at the network adapter level or scope level. Name Protection settings configured at the scope level take precedence over the setting at the IPv4 or IPv6 level. If Name Protection at the scope level is not configured at all, then the setting at the IPv4 or IPv6 network adapter takes precedence. DHCID protects names on a first come-first served basis. The step-by-step instructions in this paper show how to set up Name Protection in a test lab so that you can better understand how this feature works.
In this guide
This step-by-step guide contains an introduction to Name Protection and instructions for setting up a test lab using one DHCP server and three client computers. Two client computers have windows installed and the other client computer has a third-party operating system installed. Important The following instructions are for configuring a test lab using the minimum number of computers. Individual computers are needed to separate the services provided on the network and to clearly show the desired functionality. This configuration is not designed to reflect best practices, nor does it reflect a recommended configuration for a production network. The configuration, including IP addresses and all other configuration parameters, is designed only to work on a separate test lab network.
Scenario overview
In this test lab, Name Protection is configured on a computer running Windows Server 2008 R2 that has the DHCP Server service installed. Three DHCP client computers are also configured: one client computer running the Windows 7 operating system with the DHCP Client service running, and two client computers running a third-party operating system. A computer running Windows Server 2008 R2 is also used in the test lab as a domain controller and DNS server. Although Name Protection supports both IPv4 and IPv6 networks, this document details the configuration for IPv4 only to reduce the complexity of the test lab and demonstrate the feature. Having obtained an IP address from DHCP Server 1, (Windows) DHCP Client 1, with the name enggmachine1.contoso.com, is assigned an A record by registering with DNS. (Non-Windows) DHCP Client 2, with the name enggmachine2.contoso.com, also obtains an IP address from DHCP Server 1 and is assigned an A record and a DHCID record by registering with DNS. Name Protection is demonstrated in the lab when (non-Windows) DHCP Client 3 attempts DNS registration with an already used FQDN. Although DHCP client 3 has obtained an IP address, the DNS registration is denied.
Software requirements
The following are required components of the test lab:
The product disc for Windows Server 2008 R2. The product disc for Windows 7.
There are initial installation and configuration and post-installation configuration stages required to set up this test lab.
Configure DC1. DC1 is a server running Windows Server 2008 R2. DC1 is configured as a domain controller with AD DS and the primary DNS server for the intranet subnet. Configure DHCP Server 1. DHCP Server 1 is a server running Windows Server 2008 R2. DHCP Server 1 is configured with the DHCP Server service, and functions as a DHCP server in the domain. Configure the Windows-based DHCP clients DHCP Client 1 is a DHCP client running Windows 7. Configure non-Windows (Linux/Solaris/Unix)-based DHCP clients. DHCP Client 2 and DHCP Client 3 are DHCP clients running a non-Windows-based operating system.
Configure DC1
DC1 is a computer running Windows Server 2008 R2, which provides the following services:
A domain controller for the Contoso.com AD DS domain. A DNS server for the Contoso.com DNS domain.
Install the operating system. Configure Transmission Control Protocol/Internet Protocol (TCP/IP). Install AD DS and DNS. Create a user account and group in AD DS.
Install the operating system. Configure TCP/IP. Join the computer to the domain. Install DHCP server roles. Configure DHCP.
Install the operating system. Configure TCP/IP. Verify network connectivity. Join the computer to the domain and restart the computer.
Install Windows 7 on DHCP clients To install the operating system on DHCP Client 1
1. Start your computer using the product discs for Windows 7. 2. When prompted for the installation type, select Custom Installation. 3. When prompted for a computer name, type DHCP Client 1. 4. On the Select your computer's current location page, click Work. 5. Follow the rest of the instructions that appear on your screen to finish the installation.
Install the operating system and configure the computers to be part of the domain. On each client computer, configure TCP/IP to obtain an IP Address automatically from DHCP Server 1 in the domain and also to obtain the DNS server IPv4 address automatically. Verify network connectivity. Join the DHCP clients to the domain, giving both the same FQDN of enggmachine2.contoso.com. Then, if required, restart the computer.
Check DNS Records for entry of the non-Windows-based DHCP clients To open the DNS console
1. Click Start, click Run, type dnsmgmt.msc, and then press ENTER. 2. Leave this window open to view DNS records. 3. Click DNS, select the DNS server, and then double-click Forward Lookup Zones.
4. Click the Contoso.com domain. 5. In the right pane, there should now be two entries for DHCP Client 2. One entry records the FQDN enggmachine2.contoso.com in the Name column, Host (A) in the Type column, and the IPv4 address issued by the DHCP server in the Data column. The second entry records FQDN enggmachine2.contoso.com in the Name column, DHCID in the Type column, and some alphanumeric (unique DHCID for this record) number in the Data column. DHCP Client 3 tries to register with the same FQDN as DHCP Client 2, but cannot because there are already DNS records for both DHCP Client 1 and DHCP Client 2 available in the DNS server. Although it did obtain a DHCP address from DHCP Server 1, DHCP client 3 is unable to add an entry in DNS.
Appendix
This appendix helps you with troubleshooting techniques and the setting of optional features in Windows Server 2008 R2 and Windows 7.
1340 - EVENT_SERVER_DNSDHCID_FAIL The DNS registration for DHCPv4 Client IP address %1 , FQDN %2, and DHCID %3 is denied as there is probably an existing client with same FQDN already registered with DNS. 1340 - EVENT_SERVER_DNSDHCID_FAIL The DNS registration for DHCPv6 Client IPv6 address %1 , FQDN %2, and DHCID %3 is denied as there is probably an existing client with same FQDN already registered with DNS.
DHCP Step-by-Step Guide: Demonstrate DHCP Split Scope with Delay on a Secondary Server in a Test Lab
16 out of 19 rated this helpful A Dynamic Host Configuration Protocol (DHCP) split-scope configuration using multiple DHCP servers allows for increased fault tolerance and redundancy over using only one DHCP server. The new Split-scope Wizard in Windows Server 2008 R2 replaces the more error prone manual split-scope configuration method used in earlier versions of Windows Server. The wizard-based configuration, along with the advent of scope properties, enables IT Professionals to minimize the possibility of depletion of address pools. The new split-scope configuration employs a secondary DHCP server with a time delay that is configured in its scope properties. The time delay on the secondary DHCP server causes it to respond with a delay to DHCP DISCOVER requests from DHCP clients, enabling the primary DHCP server to respond to and accept the DHCPOFFER first. In the event that the primary DHCP server becomes unavailable, the secondary DHCP server can continue distributing addresses until the primary server is available to service clients again. The split-scope configuration is a server-side enhancement and therefore requires no client configuration to work. Only IPv4 scopes benefit from a split-scope configuration because IPv6 was designed to alleviate address exhaustion. The following step-by-step instructions guide you in deploying a DHCP split-scope with delay on a secondary server in a test lab.
In this guide
This step-by-step guide contains an introduction to using DHCP with a split scope on a secondary server, with delay, and instructions for setting up a test lab using two DHCP servers and one DHCP client. Important The following instructions are for configuring a test lab using the minimum number of computers. Individual computers are needed to separate the services provided on the network and to clearly show the desired functionality. This configuration is not designed to reflect best practices, nor does it reflect a recommended configuration for a production network. The configuration, including IP addresses and all other configuration parameters, is designed only to work on a separate test lab network.
Scenario overview
In this test lab, a DHCP split-scope is configured on two computers running Windows Server 2008 R2 (primary and secondary) with DHCP installed. A delay is configured on the secondary server. A computer running Windows 7 with the DHCP Client service is used to demonstrate proper functioning of the configuration. A computer running Windows Server 2003 is also used in the test lab as a domain controller and DNS server.
Software requirements
The following are required components of the test lab:
The product disc for Windows Server 2008 R2. The product disc for Windows Server 2003 with Service Pack 2 (SP2). The product disc for Windows 7.
Note This lab demonstrates a mixed server environment using both Windows Server 2008 R2 and Windows Server 2003. However, you could deploy a pure Windows Server 2008 R2 server environment if you do not require interaction between the two different server versions.
After all the computers are configured, this guide provides steps for a demonstration of DHCP split scope with delay configured on the secondary server. The following sections provide details about how to perform these tasks.
Configure DC1
DC1 is a computer running Windows Server 2003 Standard Edition with SP2, which provides the following services:
A domain controller for the Contoso.com AD DS domain. A DNS server for the Contoso.com DNS domain.
Install the operating system. Configure Transmission Control Protocol/Internet Protocol (TCP/IP). Install AD DS and DNS. Create a user account and group in AD DS.
9. Accept the default Database Folder and Log Folder directories, and then click Next. 10. Accept the default folder location for Shared System Volume, and then click Next. 11. Verify that Permissions compatible only with Windows 2000 or Windows Server 2003 operating systems is selected, and then click Next. 12. Leave the Restore Mode Password and Confirm Password text boxes blank, and then click Next. 13. View the summary information provided, and then click Next. 14. Wait while the wizard completes configuration of AD DS and DNS services, and then click Finish. 15. When prompted to restart the computer, click Restart Now. 16. After the computer is restarted, log on to the CONTOSO domain using the Administrator account.
Install the operating system. Configure TCP/IP. Join the computer to the domain. Install DHCP server roles. Configure DHCP.
Next, install the DHCP server role on DHCP Server 1 and DHCP Server 2.
1. In the DHCP console tree, under Scope [172.16.0.0] SS Scope, right-click Scope Options, and then click Configure Options. 2. On the Advanced tab, verify that Default User Class is selected next to User class. 3. Select the 006 DNS Servers check box, in IP Address, under Data entry, type 172.16.1.1, and then click Add. 4. Select the 015 DNS Domain Name check box, in String value, under Data entry, type contoso.com, and then click OK. Note The 003 Router option is configured in the default user class if a default gateway is required for client computers. Because all computers in the test lab are located on the same subnet, this option is not required.
Configure a split scope using the wizard on DHCP Server 1 and DHCP Server 2
Next, configure a split-scope deployment on DHCP Server 1 and DHCP Server 2 by launching the Split-scope Wizard on the scope to be split-scoped on DHCP Server 1.
4. Click Next, and then on the Delay in DHCP Offer page, configure DHCP Server 1 with a value of 0 (default) and configure Added DHCP Server (DHCP Server 2) for 1000 milliseconds. This enables DHCP Server 2 to offer DHCP OFFER messages only after a delay of 1000 milliseconds, thereby preventing the exhaustion of IPv4 addresses from the required scope of DHCP Server 2.
Install the operating system. Configure TCP/IP. Verify network connectivity. Join the computer to the domain and restart the computer.
Verify that the response reads Reply from 172.16.1.1." In the Command Prompt window, type ipconfig, and then press ENTER. In the command output, verify that the value of Connection-specific DNS Suffix is contoso.com and that the value of Subnet Mask is 255.255.255.0. In the Command Prompt window, type route print -4, and then press ENTER. In the command output, below Active Routes, verify that a Network Destination of 172.16.1.1 is displayed.
Appendix
This appendix helps you with troubleshooting techniques and the setting of optional features in Windows Server 2008 R2 and Windows 7.
Reviewing information contained in DHCP client events can help you with troubleshooting. It can also help you understand DHCP client functionality.
1340 - EVENT_SERVER_DNSDHCID_FAIL The DNS registration for DHCPv4 Client IP address %1 , FQDN %2, and DHCID %3 is denied as there is probably an existing client with same FQDN already registered with DNS. 1340 - EVENT_SERVER_DNSDHCID_FAIL The DNS registration for DHCPv6 Client IPv6 address %1 , FQDN %2, and DHCID %3 is denied as there is probably an existing client with same FQDN already registered with DNS.