.com
.edu
.org
.net
.gov
.mil
.num – phone #
.arpa – reverse DNS
.us
.cc
Look up host
1. HOSTS
2. DNS cache
3. DNS db
4. NetBIOS
5. WINS
6. Broadcast
7. LMHOSTS
Look up FQDN
1. HOSTS
2. DNS cache
3. DNS db
4. pass up until found
203.102.101.100/24, the reverse DNS PTR records is 101.102.203.in-addr.arpa
By default it is caching-only DNS server, needs lots of RAM, response from cache or pass to other DNS server (Root Hints), no zone transfer overhead.
ipconfig /displaydns
ipconfig /flushdns
BIND – Berkeley Internet Name Domain
BIND must support SRV records
Root name server acts as Start of Authority SOA for the zone and top-level server in the domain. It contains “.” domain and thus can’t be a forwarder.
SOA is the first record in the DB.
• Serial number – versioning
• Primary server
• Email address – use . symbol instead of @
• Secondary server – read-only db, need update via a zone transfer from another DNS server
• 1 Standard Primary server per zone
• 1+ Standard Secondary server per zone
• AD integrated
Forward Lookup Zone provides an IP address for a queried host name
Reverse Lookup Zone – you must provide a network IP 203.102.101 or reverse lookup zone name 101.102.203.in-addr.arpa instead of a domain name.
Allow dynamic updates
Dynamic DNS – DDNS is simply the integration of DNS and DHCP.
ipconfig /registerdns
Iterative query – DNS server get closer to final answer .com, abc.com, xyz.abc.com…
Recursive query – client query or mail server query MX
ping /a – resolve IP to hostname
Authoritative query – first query DNS get it from remote DNS
Nonauthoritative query – following same query from cache
Delegated zone domain must be lower than the domain performing delegation
DNS records
• A
• CNAME
• MX
• MG
• MB
• MINFO
• NS – Authoritative name server
• PTR
• TXT
• RT – route through
• SRV – used by Win2K for AD and Dynamic DNS.
Monitoring DNS
• AXFR and IXFR Counters
• Caching Memory
• Dynamic Updates
• Zone Transfers
DHCP Discover > (can cross routers if routers are configured with BOOTP)
DHCP Offer <
DHCP Request >
DHCP ACK <
Router must forward BOOTP or setup a DHCP Relay Agent in RRAS MMC
DHCP server must has static IP
Scope
• Address Pool – to lease and to exclude
• Address Leases – current leased
• Reservations – specific set
• Scope Options
SuperScope
Multicasting
• TTL 32 hops
• lease 30 days
Exclusions
• Routers
• Printers
• App servers
To get MAC address, ping IP, arp –g
Configure DHCP server options such as DNS WINS IP, will apply to all scopes.
In DHCP server/scope DNS tab, you can enable DDNS. To keep DNS clean, enable discard. To support UNIX or pre-W2K, enable support for other clients don’t support dynamic update.
You need authorize DHCP server in AD. It is checked every 5 mins.
Monitoring DHCP
• Discovers/sec
• Offers/sec
• Requests/sec
• Acks/sec
• Nacks/sec
• Informs/sec indicates heavy DDNS integration traffic
• Declines/sec indicates a bogus DHCP server
DHCP support SNMP and MIB
RRAS is installed by default not active. It can be configure and enabled as
• Internet connection server for NAT
• Remote Access server
• VPN server
• Networking router
• Manually configured server
RRAS supports AppletTalk, TCP/IP, IPX, NetBEUI, SLIP, PPP,
Win2000 Pro supports 1 inbound dial-in, Win2000 Server supports 256.
When use RADIUS authentication, Remote Access Policies and Logging are disappear. You need access from Internet Auth Services instead.
Default remote access policy is Allow access if dial-in permission is enabled – denies all unless in AD user’s dial-in property is set to Allow access
No remote access policy, no remote access regardless their Dial-In setting.
When you have more restrictive policy, put them first in order.
Remote Access Policy properties > Edit Profile
• Dial-in Constraints – idle time, max time, day, times, dial-in #, dial-in media
• IP – IP Packet filters
• Multilink
o BAP
o before that, you need have more than one modem, and enable multilink in both.
• Auth
o Windows Auth
o Internet Auth Services - RADIUS
• Encryption
o No encrypt
o Basic
o Strong
• Advanced – for RADIUS
VPN
• PPTP
• L2TP/IPSec
• Macintosh users can only user SSL over HTTP
To configure, open RRAS Ports Properties
• WAN Miniport PPTP
• WAN Miniport L2TP
• Direct Parallel
•
RRAS get 10 IP address at a time from DHCP and hand out them to connecting clients.
RAS Port shows stats for only that port, RAS Total shows total stats for all ports
Internet Auth Services
You need Register Service in AD, and add it to RAS and IAS AD Security Group
• Clients
o Friendly Name
o Protocol -- RADIUS
o Client address
o Client vendor
o Client must always send the signature attr in the request
• Remote Access Logging
• Remote Access Policies
Auth methods:
• EAP
o One-time passwords
o Certificates
o Smart Cards
o Access Tokens
• MS-CHAP v2
• MS-CHAP
• CHAP
• SPAP
• PAP
Encryption protocols
• MPPE - PPTP
• IPSec – L2TP
RIPv2 and OSPF support CIDR and VLSM, RIPv1 doesn’t.
CSNW
GSNW – If several clients use this method, consider use CSNW to avoid GSNW bottleneck
File and Print Services for NetWare – FPNW
Frame type
• Ethernet 802.2
• Ethernet 802.3
• SNAP
• Ethernet II
Configure GSNW
• NTGATEWAY group on NW
• Same account on both Windows 2000 and NW
• Right assignment on NW Folder
Network binding
• Keep most common used protocols first
• Remove unnecessary protocols
Network Monitor Tools –> Add/Remove Windows Components -> Management and Monitoring Tools
Network Monitor Driver -> Network -> Install -> Protocol
IPSec use Kerberos V5 as its default auth, but also support X.509 (public/private keys)
IPSec secures data by adding a IPSec Header to each data packet.
• Auth Header – use MD5 or SHA
• Encapsulating Security Payload – confidentiality by encrypting data
Encryption key is handled by ISAKMP or Oakley protocol
You need to enable IPSec in local security policy or AD domain level group policy
• IPSec on local machine, supplied but disabled by default
o Client
o Secure Server
o Server
You can customize IPSec policy
• Connection Type
o All network connections
o LAN
o Remote Access
• Tunnel Settings
o This rule does not specify an IPSec tunnel
o The tunnel endpoint is specified by this IP address
• Filter Action
o Permit
o Request Security
o Require Security
• IP Filter
IPSec for transport mode is MS version of IPSec, also known as L2TP/IPSec, enable VPN in RRAS with default setting, and it is in transport mode. IPSec for tunnel mode is IETF version, pure IPSec.
o Use transport mode if possible
o don’t use tunnel mode for remote access client using VPN
o Tunnel mode does not support protocol or port specific tunnels so make sure filter is ANY
o netdiag to check active filters
IPSECMON
WINS maps NetBIOS name to IP
• WINS Servers
o one WINS for 10,000 users plus one for redundancy
• WINS Clients
o connect directly to WINS, Win9x, NT, 2K
• Non-WINS Clients
o broadcast to WINS, Win3.1, DOS and non-win
• WINS Proxies
o intercept broadcasts on their subnet and communicate with WINS Servers
o nbtstat –c to start WINS Proxy
o don’t put more than one WINS Proxy in a single segment to avoid duplicate
NetBIOS Names – 16 chars, 15 chars + hex value
• 00h – workstation
• 03h – messenger
• 20h – file server
wins.exe in Task Manager Process tab, or check WINS snap-in stats is updated.
To see which one is primary WINS, use ipconfig /all
WINS Replication
• Pull – time based
• Push – event based, push partner doesn’t actually send data to its partner, but inform partners should pull data
• Immediate
WINS traffic types:
• B-node – broadcast
• P-node – p2p
• H-node – hybrid node – try P-node, then try B-node, default mode
• M-node – modified node, try B-node, then P-node
• To confirm, ipconfig /all check Node Type
Order of resolution
local NetBIOS Cache > WINS > Broadcast > LMHOST > DNS
To make sure record get deleted on all WINS server, manually tombstone the record.
Demand-Dial use modem, ISDN or serial connection to backup a main connection or save cost
Packet is send in one of 2 ways
• default gateway
• ICMP
• RIP listener – work with RIPv1, not RIPv2
Need to be Domain admin or RAS and IAS Servers security group
RIP
• distance vector
o simple to maintain/configure
o slow convergence
o count-to-infinity
Split Horizon
Split Horizon with Poison Reverse
Triggered updates
o create more traffic
o larger routing table
• hop count – max 15
• can send up to 25 routes in a single RTP packet
• v1
o broadcast to all
o support silent RIP
• v2
o multicast to 224.0.0.9
o support CIDR, VLSM
o prevent rogue RIP router with auth
OSPF
• link state
o only send updates when there is a change
o flooding Link State Ads – LSA
router
networks attached to router
networks costs
o loop free
o load balance
o auth
o support CIDR, VLSM, supernetting
o quick convergence
o less bandwidth
• AS, Areas(within AS with Area ID) and OSPF Backbone (link areas)
Two routers are need for Demand-Dial Routing – a calling and an answering router, each has RRAS installed
The following cause Demand-Dial takes place
• breach of dial-out hours
• breach of demand-dial filters
• wrong dial-out credentials
• mismatch of connecting interface
Demand-Dial types
• On-demand
o until a demand-dial timeout
o one-way initiated connection
static route
authorized user
o two-way initiated connection
o be careful to point default gateway 0.0.0.0 to demand-dial
• Persistent
o require X.25, ISDN, leased line connection
Silent RIP – only receive routing but don’t send out its own routes.
route
• print
• add
• delete
• change
• -f
ICS
• NAT
• DNS proxy
• DHCP
• LDAP proxy
• H323 proxy
• Directplay proxy
NAT can only be installed on Win 2000 Server, not Pro
Public Key Infrastructure PKI
• digital signature (certs)
o user name
o user public key
o serial #
o expiration date
o cert info
o issuing CA’s Info
• encryption
Don’t install CA on a DC
Windows 2000 CA
• Enterprise
o Integrated with AD
o Install before all other CA as a Root CA
o its computer account need to be in Cert Publishers group
• Standalone
o for external users
Root CA must be places in Trusted Root Cert Authorities store to make Certification Path chain works. To protect Root CA, you should take it offline and let Subordinate CA to issue certs.
Upgrading from NT, you need import old style CA with certutil convertmdb
CRL Distribution Point – where Cert Revocation List located
Authority Info Access – where certs located
http://servername/certsrv to request cert for both Enterprise and Standalone CA. In MMC, it only works with Enterprise CA.
Comments
Post a Comment