Step-by-Step Guide for Setting Up a PPTP-based Site-to-Site VPN Connection in a Test Lab

From MS

Step-by-Step Guide for Setting Up a PPTP-based Site-to-Site VPN Connection in a Test Lab

This guide provides an example with detailed information about how you can use five computers in a test lab environment to configure and test a Point-to-Point Tunneling Protocol (PPTP)-based site-to-site VPN connection using any 32-bit version of the Microsoft® Windows Server™ 2003 operating system with Service Pack 1 (SP1) as well as the Microsoft Windows® XP Professional operating system with Service Pack 2 (SP2).You can use this example deployment to learn about Windows Server 2003 with SP1 site-to-site VPN functionality before you deploy a site-to-site VPN connection in a production environment. This test lab configuration simulates a deployment of a PPTP-based site-to-site VPN connection between the Seattle and New York offices of an organization

Note
The following instructions are for configuring a test lab using a minimum number of computers. Individual computers are needed to separate the services provided on the network and to clearly show the functionality. This configuration is designed to reflect neither best practices nor a recommended configuration for a production network. The configuration, including IP addresses and all other configuration parameters, is designed to work only on a separate test lab network.

Setting Up the Test Lab

The infrastructure for a PPTP-based site-to-site VPN deployment test lab network consists of five stand-alone computers performing the roles shown in Table 1. Each computer is part of a workgroup. None of the computers are joined to a domain. In this test lab scenario, Windows Firewall is installed and turned-on automatically on the client computers running Windows XP Professional with SP2. You will configure a Windows Firewall exception on CLIENT1, allowing communication between the two client computers. On the three computers with Windows Server 2003 with SP1, Standard Edition, Windows Firewall is automatically installed, but it is not turned-on by default. On these computers, Windows Firewall will remain turned-off. In addition, the Windows Firewall/Internet Connection Sharing (ICS) service should be disabled on each of these computers.

In addition to these five computers, the test lab also contains four hubs (or Layer 2 switches):
· A hub that connects the Seattle office (CLIENT1) to the answering router (ROUTER1).
· A hub that connects the New York office (CLIENT2) to the calling router (ROUTER2).
· A hub that connects the answering router (ROUTER1) to the Internet router (INTERNET).·
A hub that connects the calling router (ROUTER2) to the Internet router (INTERNET).

Note
Because there are only two computers on each subnet, the hubs can be replaced by Ethernet crossover cables.The configuration of this test lab is shown in the following figure:

Configure your test lab by performing the following tasks:
1. Configure the client computers in the Seattle and New York offices.
2. Configure the computers performing as the answering and calling routers.
3. Configure the computer performing as the Internet router.

Configuration for CLIENT1

CLIENT1 is a client on the Seattle office subnet, running Windows XP Professional with SP2.

Configure TCP/IP properties
1. Open Network Connections, right-click the network connection you want to configure, and then click Properties.
2. On the General tab, click Internet Protocol (TCP/IP), and then click Properties.
3. Click Use the following IP address, type 172.16.4.3 for the IP address, type 255.255.255.0 for the Subnet mask, and then type 172.16.4.1 for the Default gateway.

Installing Windows XP Professional with SP2 turns on Windows Firewall by default. You will need to configure port exceptions on the firewall allowing for communication between CLIENT1 and CLIENT2.

Configure Windows Firewall on CLIENT1
1. Click Start, point to Control Panel, and then click Security Center.
2. Click Windows Firewall, and then in the Windows Firewall dialog box, click the Advanced tab.
3. Click Settings for ICMP, and then click Allow incoming echo request.
4. Click OK twice to close Windows Firewall.

Configuration for CLIENT2

CLIENT2 is a client on the New York office subnet, running Windows XP Professional with SP2. Installing Windows XP Professional with SP2 turns on Windows Firewall by default. However, because CLIENT2's only role is as a calling computer, Windows Firewall does not need to be enabled with any exceptions. Leave the default Windows Firewall settings on CLIENT2.

Configure TCP/IP properties
1. Open Network Connections, right-click the network connection you want to configure, and then click Properties.
2. On the General tab, click Internet Protocol (TCP/IP), and then click Properties.
3. Click Use the following IP address, and then type 172.16.56.3 for the IP address, type 255.255.255.0 for the Subnet mask, and then type 172.16.56.1 for the Default gateway.

Configuration for the Answering and Calling Routers

This section describes the setup for the routers in the test lab. For information about configuring routing and remote access for the answering router (ROUTER1) and the calling router (ROUTER2), see “Configuring a PPTP-based Site-to-Site VPN Connection” in this guide.

ROUTER1

ROUTER1 is a computer on the Seattle office subnet, running Windows Server 2003 with SP1, Standard Edition. ROUTER1 is acting as the answering router.
Configure TCP/IP properties
1. Open Network Connections, right-click the network connection you want to configure, and then click Properties.
2. On the General tab, click Internet Protocol (TCP/IP), and then click Properties.
3. Configure the IP address and subnet mask with the following values:
a. On the To the Internet interface, type 10.1.0.2 for the IP address, type 255.255.0.0 for the Subnet mask, and then type 10.1.0.1 for the Default gateway.
b. On the To the Seattle intranet interface, type 172.16.4.1 for the IP address, type 255.255.255.0 for the Subnet mask. Leave the Default gateway clear.

Windows Firewall and Routing and Remote Access cannot run simultaneously on VPN1. If Windows Firewall is turned on, you will need to disable it. If the Windows Firewall/Internet Connection Sharing (ICS) service has started or is set to automatic before configuring Routing and Remote Access, you must disable it.
Disable the Windows Firewall/Internet Connection Sharing (ICS) service
1. Click Administrative Tools, and then click Services.
2. In the Services details pane, right-click Windows Firewall/Internet Connection Sharing (ICS) service, and then click Properties.
3. If the service Startup Type is either Automatic or Manual, change it to Disabled.
4. Click OK to close the Windows Firewall/Internet Connection Sharing (ICS) dialog box, and then close the Services page.

ROUTER2
ROUTER2 is a computer on the New York office subnet, running Windows Server 2003 with SP1, Standard Edition. ROUTER2 is acting as the calling router.
Configure TCP/IP properties
1. Open Network Connections, right-click the network connection you want to configure, and then click Properties.
2. On the General tab, click Internet Protocol (TCP/IP), and then click Properties.
3. Configure the IP address and subnet mask with the following values:
a. On the To the Internet interface, type 10.2.0.2 for the IP address, type 255.255.0.0 for the Subnet mask, and then type 10.2.0.1 for the Default gateway.
b. On the To the Seattle intranet interface, type 172.16.56.1 for the IP address, type 255.255.255.0 for the Subnet mask. Leave the Default gateway empty.

As with ROUTER1, you must turn off Windows Firewall on ROUTER2 and disable the Windows Firewall/ICS service.
Disable the Windows Firewall/Internet Connection Sharing (ICS) service
1. Click Administrative Tools, and then click Services.
2. In the Services details pane, right-click Windows Firewall/Internet Connection Sharing (ICS) service, and then click Properties.
3. If the service Startup Type is either Automatic or Manual, change it to Disabled.
4. Click OK to close the Windows Firewall/Internet Connection Sharing (ICS) dialog box, and then close the Services page.

Configuration for the Internet Router
INTERNET is a computer running Windows Server 2003 with SP1, Standard Edition.
Configure TCP/IP properties
1. Open Network Connections, right-click the network connection you want to configure, and then click Properties.
2. On the General tab, click Internet Protocol (TCP/IP), and then click Properties.
3. Configure the IP address and subnet mask with the following values:
a. On the To Router1 interface, type 10.1.0.1 for the IP address, and then type 255.255.0.0 for the Subnet mask.
b. On the To Router2 interface, type 10.2.0.1 for the IP address, and then type 255.255.0.0 for the Subnet mask.
4. Click Administrative Tools, and then click Routing and Remote Access to open the Routing and Remote Access Microsoft Management Console (MMC) snap-in.
5. In the Routing and Remote Access snap-in, right-click INTERNET (local) in the console tree, and then click Configure and Enable Routing and Remote Access.
6. The Routing and Remote Access Server Setup Wizard opens. Click Next.
7. On the Configuration page, select Custom configuration, as shown in the following figure.

8. Click Next. On the Custom Configuration page, select LAN routing, as shown in the following figure.

9. Click Next. On the Completing the Routing and Remote Access Server Setup page, click Finish, and then click Yes to start the service.

8. Click Next. On the Custom Configuration page, select LAN routing, as shown in the following figure.

9. Click Next. On the Completing the Routing and Remote Access Server Setup page, click Finish, and then click Yes to start the service.

Make sure that Windows Firewall is turned off and that the Windows Firewall/Internet Connection Sharing (ICS) service is disabled.
Disable the Windows Firewall/Internet Connection Sharing (ICS) service
1. Click Administrative Tools, and then click Services.
2. In the Services details pane, right-click Windows Firewall/Internet Connection Sharing (ICS) service, and then click Properties.
3. If the service Startup Type is either Automatic or Manual, change it to Disabled.
4. Click OK to close the Windows Firewall/Internet Connection Sharing (ICS) dialog box, and then close the Services page.

Verify the routing infrastructure
1. On ROUTER1, ping the IP address 10.2.0.2. This should be successful.
2. On CLIENT2, ping the IP address 172.16.4.3. This should be unsuccessful because CLIENT1 cannot be reached by CLIENT2 across the simulated Internet until the site-to-site VPN connection is created.

Configuring a PPTP-based Site-to-Site VPN Connection

Configuring a PPTP-based Site-to-Site VPN Connection
To create a PPTP-based VPN connection, perform the following tasks:
1. Configure VPN on the answering router.
2. Configure the demand-dial interface on the answering router.
3. Configure VPN on the calling router.
4. Configure the demand-dial interface on the calling router.
5. Confirm remote access policy configuration on the answering and calling routers.
6. Initiate the VPN connection.
7. Test the VPN connection.

Configure VPN on the answering router (ROUTER1)
1. On ROUTER1, click Administrative Tools, and then click Routing and Remote Access.
2. In Routing and Remote Access, right-click ROUTER1 (local) in the console tree, and then click Configure and Enable Routing and Remote Access.
3. The Routing and Remote Access Server Setup Wizard appears. Click Next.
4. On the Configuration page, select Remote access (dial-up or VPN), as shown in the following figure.

5. Click Next. On the Remote Access page, select VPN, as shown in the following figure.

6. Click Next. On the VPN Connection page, select To the Internet, and then verify that the Enable security on the selected interface by setting up static packet filters check box is selected, as shown in the following figure

7. Click Next. On the IP Address Assignment page, select From a specified range of addresses, as shown in the following figure

8. Click Next. On the Address Range Assignment page, click New, as shown in the following figure

9. In the New Address Range dialog box, do the following:
a. In the Start IP address box, type 172.16.100.1.
b. In the End IP address box, type 172.16.100.2.

c. In the Number of Addresses box, accept the displayed value of 2, as shown in the following figure.

10. Click OK. On the Address Range Assignment page, click Next.
11. On the Managing Multiple Remote Access Servers page, select No, use Routing and Remote Access to authenticate connection requests, as shown in the following figure.

12. Click Next. On the Completing the Routing and Remote Access Server Setup page, click Finish.13. Click OK to close the message box prompting you to configure the DHCP Relay Agent. For this scenario the DHCP Relay Agent will not be configured.

Configure the demand-dial interface on the answering router (ROUTER1)

1. In the Routing and Remote Access snap-in, expand ROUTER1, and then right-click Network Interfaces.
2. Click New Demand-dial Interface to open the Demand-Dial Interface Wizard, and then click Next.
3. On the Interface Name page, type VPN_NewYork, as shown in the following figure. The interface name must match the user account name of the calling router.

4. Click Next. On the Connection Type page, select Connect using virtual private networking (VPN), as shown in the following figure.

5. Click Next. On the VPN Type page, select Point-to-Point Tunneling Protocol (PPTP), as shown in the following figure

6. Click Next. On the Destination Address page, type 10.2.0.2 in the Host name or IP address box, as shown in the following figure.

7. Click Next. On the Protocols and Security page, do the following:
a. Select Route IP packets on this interface.

b. Select Add a user account so a remote router can dial in, as shown in the following figure.

8. Click Next. On the Static Routes for Remote Networks page, click Add, as shown in the following figure.

9. In the Static Route dialog box, do the following:
a. In the Destination box, type 172.16.56.0.
b. In the Network Mask box, type 255.255.255.0.
c. In the Metric box, accept the displayed value 1, as shown in the following figure.

10. Click OK. On the Static Routes for Remote Networks page, click Next.11. On the Dial In Credentials page, type a password for the VPN_NewYork user account, and then retype the password in the Confirm password box. The User name box is automatically populated with the value VPN_NewYork

12. Click Next. On the Dial Out Credentials page, do the following:
a. In the User name box, type VPN_Seattle.
b. In the Domain box, type ROUTER2.
c. In the Password box, type a password for the VPN_Seattle user account.
d. In the Confirm password box, retype the password for the VPN_Seattle user account, as shown in the following figure.

13. Click Next. On the last Demand-Dial Interface Wizard page, click Finish.

14. Click OK to close the message box prompting you to configure the DHCP Relay Agent. For this scenario the DHCP Relay Agent will not be configured.

Configure VPN on the calling router (ROUTER2)

1. On ROUTER2, click Administrative Tools, and then click Routing and Remote Access.
2. In Routing and Remote Access, right-click ROUTER2 (local) in the console tree, and then click Configure and Enable Routing and Remote Access.
3. The Routing and Remote Access Server Setup Wizard appears. Click Next.
4. On the Configuration page, select Remote access (dial-up or VPN), and then click Next.
5. On the Remote Access page, select VPN, and then click Next.
6. On the VPN Connection page, select To the Internet, verify that the Enable security on the selected interface by setting up static packet filters check box is selected, and then click Next.
7. On the IP Address Assignment page, select From a specified range of addresses, click Next, and then on the Address Range Assignment page, click New.
8. In the New Address Range dialog box, do the following:
a. In the Start IP address box: type 172.56.200.1.
b. In the End IP address box, type 172.56.200.2.
c. In the Number of Addresses box, accept the displayed value of 2, and then click OK.
9. On the Address Range Assignment page, click Next.
10. On the Managing Multiple Remote Access Servers page, select No, use Routing and Remote Access to authenticate connection requests. Click Next.
11. On the Completing the Routing and Remote Access Server Setup page, click Finish.

12. Click OK to close the message box prompting you to configure the DHCP Relay Agent.

Configure the demand-dial interface on the calling router (ROUTER2)

1. In the Routing and Remote Access snap-in, expand ROUTER2 (local), and then right-click Network Interfaces.
2. Click New Demand-dial Interface to open the Demand-dial Interface Wizard. To complete the Demand-Dial Interface Wizard, click Next.
3. On the Interface Name page, type VPN_Seattle. The interface name must match the user account name of the answering router. Click Next.
4. On the Connection Type page, select Connect using virtual private networking (VPN). Click Next.
5. On the VPN Type page, select Point-to-Point Tunneling Protocol (PPTP). Click Next.
6. On the Destination Address page, type 10.1.0.2, and then click Next.
7. On the Protocols and Security page, do the following:
a. Select Route IP packets on this interface.
b. Select Add a user account so a remote router can dial in, and then click Next.
8. On the Static Routes for Remote Networks page, click Add.
9. In the Static Route dialog box, do the following:
a. In the Destination box, type 172.16.4.0.
b. In the Network Mask box, type 255.255.255.0.
c. In the Metric box, accept the displayed value 1, and then click OK.
10. On the Static Routes for Remote Networks page, click Next.
11. On the Dial In Credentials page, type the password for the VPN_Seattle user account, and then retype the password in the Confirm password box. The User name box is pre-populated with the value VPN_Seattle. Click Next.
12. On the Dial Out Credentials page, do the following:
a. In the User name box, type VPN_NewYork.
b. In the Domain box, type ROUTER1.
c. In the Password box, type the password for the VPN_NewYork user account created on ROUTER1.
d. In the Confirm password box, retype the password for the VPN_NewYork user account, and then click Next.

13. On the last Demand-Dial Interface Wizard page, click Finish

Confirm the remote access policy configuration on the answering and calling routers

1. On ROUTER2, in Routing and Remote Access, click Remote Access Policies.
2. In the details pane, right-click Connections to Microsoft Routing and Remote Access server, and then click Properties.
3. On the Settings tab, select Grant remote access permission, and then click OK to save changes.4. Repeat steps 1 through 3 on ROUTER1.

Initiate the VPN connection by performing the following steps on ROUTER2.

Initiate the VPN connection
1. On ROUTER2, in the console tree of the Routing and Remote Access snap-in, click Network Interfaces.
2. In the details pane, right-click VPN_Seattle, and then click Connect.
3. Confirm that the connection state of VPN_Seattle is connected.

Test the VPN connection
1. On CLIENT2, at the command prompt, type ping 172.16.4.3.
This is the IP address for CLIENT1. Pinging CLIENT1 from CLIENT2 will test whether the Seattle subnet is now reachable.
2. To confirm that the packets crossed the VPN connection, at the command prompt, type tracert 172.16.4.3. Note that you must use the IP address of CLIENT1, rather than its computer name, because a DNS server is not configured in this test lab scenario.
Results that are similar to the following indicate that the connection is working.
Tracing route to 172.16.4.3 over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms [172.16.56.1]
2 1 ms <1 ms <1 ms [172.56.200.2]
3 1 ms 1 ms 1 ms [172.16.4.3]
Trace complete.

Note
172.16.56.1 is the IP address of the ROUTER2 interface that connects to the New York intranet. 172.56.200.2 is the IP address that ROUTER2 assigned to ROUTER1. The presence of this IP address in the Tracert output indicates that packets are moving across the site-to-site VPN connection. 172.16.4.3 is the IP address of CLIENT1.

How to receive MCP from MS

From NhatNghe web site
Microsoft Certified Professional Programs
If U pass the mcp, U'll receive 2 mail from MS, The first mail tell U MCP ID , the second mail tell U ACCESS CODE.
Email 1:
Microsoft Certified Professional Programs (mswwprog@microsoft.com)
To: Your Email
Subject: Access Your MCP Benefits: Part 1 (Action Required)

Congratulations on becoming a Microsoft Certified Professional!As you Know,earning a Microsoft Certification is an investment in your technology skills and career,and we look forward to helping you succeed

FOLLOW THESE STEPS TO ACCESS YOUR MCP MEMBER BENEFITS:

1.SAVE THIS E-MAIL OR RECORD YOUR MCP ID.Your personal MCP ID number grants you access to the MCP member site where youwill find MCP only information, your transcript, logos, and other benefits. In addition,you 'll need to register for future exams with your MCP ID to make sure your transcript iskept up to date
-------------------------------------------------------------------------
YOUR MCP ID IS:123456
-------------------------------------------------------------------------

2.ASSOCIATE YOUR WINDOWS LIVE ID TO YOUR MCP ID.Follow these instructions (http://www.microsoft.com/learning/mcp/passport/instructions.asp) to associate yourWindows Live ID (formerly Passport Network account) with your MCP ID. This processis called ômigrationö and will allow you access to the MCP site and your benefits

3.ACCESS THE MCP PRIVATE SITE WITHIN 21 DAYS.To access the site, you will need your ômigratedö Windows Live ID and a temporaryaccess CODE that you 'll receive from Microsoft in a separate ôPart 2ö e-mail. If you do notreceive "Part 2" within 24 hours of receiving this e-mail, contact your Regional ServiceCenter (http://www.microsoft.com/learning/support/worldsites.asp).

4.CONFIRM YOUR PROFILE INFORMATION.After accessing the MCP site, you 'll want to confirm your profile to ensure you get your benefits, offers, and program news.

5.REQUEST YOUR MEMBER KIT.Welcome kits are not shipped automatically. After accessing the MCP site,you 'll need to submit a request for your kit from the MCP site.

6.EXPLORE THE COMMUNITY!Start to get familiar with the resources now available to you as an MCP fromhttp://www.microsoft.com/learning/mcpwelcome. Welcome to Microsoft Certification!Thank you,The Microsoft Certification Program Team,
************************************************************************
Please do not reply to this e-mail message. If you have comments or questions or needhelp, please contact your Regional Service Center:http://www.microsoft.com/learning/support/worldsites.asp

Email 2:
Microsoft Certified Professional Programs (mswwprog@microsoft.com)
To: Your Email
Subject: Access Your MCP Benefits: Part 2 (Action Required)

Again, congratulations on your new Microsoft Certification.

This is the second of two e-mails to help you access your benefits as part of the MCP community.

FOLLOW THESE STEPS TO ACCESS YOUR MCP MEMBER BENEFITS:

1.YOU SHOULD HAVE RECEIVED YOUR MCP ID IN A PREVIOUS E-MAIL.If you did not receive a "Part 1" e-mail from Microsoft in the last 24 hours, please contact contact your Regional Service Center (RSC) (http://www.microsoft.com/learning/support/worldsites.asp).

2.ASSOCIATE YOUR WINDOWS LIVE ID TO YOUR MCP ID.If you have not already done so, follow these instructions (http://www.microsoft.com/learning/mcp/passport/instructions.asp) to associate your Windows Live ID(formerly Passport Network account) with your MCP ID. This process is called "migration".

3.ACCESS THE MCP PRIVATE SITE WITHIN 21 DAYS.Log-in to the MCP site (https://mcp.microsoft.com/mcp/Default.aspx) by using your "migrated" Windows Live ID and temporary access CODE, below. Microsofttakes the security of your information very seriously, so this CODE will only be active for 21 days. If your CODE is no longer valid, please contact your RSC.
---------------------------------------------------------------------------------
YOUR TEMPORARY ACCESS CODE IS: FC171460-C4C6-4707-9954-AAA6DEB9701C
---------------------------------------------------------------------------------

4.CONFIRM YOUR PROFILE INFORMATION.From https://mcp.microsoft.com/mcp/Default.aspx, select VIEW MY... PROFILE from the left navigation and confirm that your e-mail address and profile is correct so we can reach you with benefits, offers, and program news.

5.REQUEST YOUR MEMBER KIT.Welcome kits are not shipped automatically. Visit https://mcp.microsoft.com/mcp/Default.aspx, select PROGRAM BENEFITS, then MEMBER KIT from the left navigation and follow the instructions to activate shipment of your kit.

6.EXPLORE THE COMMUNITY!You are now eligible to access a wealth of information and resources designed to help you stay current on Microsoft technologies, connect with peers, and plan further training. Visit http://www.microsoft.com/learning/mcpwelcome to get started. Again, welcome to Microsoft Certification!The Microsoft Certification Program Team

************************************************************************************
Please do not reply to this e-mail message. If you have comments or questions or need help, please contact your Regional Service Center:http://www.microsoft.com/learning/support/worldsites.asp


Login MCP site > Program Benefits > click Welcome Kits and Certificates > click "Request". U'll receive Certificates about 2 - 8 week
NOTE :
- 123456 : is MCP ID
- FC171460-C4C6-4707-9954-AAA6DEB9701C: is Access Code

Windows Server 2008 Certifications - Death to the MCSE

http://www.trainsignaltraining.com/windows-server-2008-certifications-death-to-the-mcse/2007-06-19/
I watched the Microsoft webinar on the new Server 2008 (formerly Longhorn) certifications last week and came away feeling a little underwhelmed. In case you didn’t know already the MCSE is “dead” for Server 2008 and they are moving on to a “job based” approach to their certifications. Read on for more details.Windows Server 2008 MCTS CertificationsTo begin with, there will be several Microsoft Certified Technology Specialist (MCTS) exams that you can take to certify specific skills on the Server 2008 platform. These are roughly equivalent to becoming a MCP in Windows 2000/2003. You will earn MCTS certification for each different exam that you pass. Here are the initial MCTS exams that will be released:70-640 MCTS: Configuring Windows Server 2008 Active Directory70-642 MCTS: Configuring Windows Server 2008 Network Infrastructure70-643 MCTS: Configuring Windows Server 2008 Application Platforms70-640 and 70-642 are no surprise but 70-643 is interesting. It will cover Internet Information Services (IIS 7) and Microsoft Virtual Server among other things. Pretty cool. These exams are scheduled to be available 30 days after Server 2008 goes RTM.Windows Server 2008 MCITP CertificationsThere are two different Server 2008 tracks, the Server Administrator and the Enterprise Server Administrator. Both of these are MCITP level certifications, requiring multiple exams. These are the highest level of certification (outside of the MCA program) that you can attain. Here are the requirements for each.Windows Server 2008 Administrator:70-640 Active Directory70-642 Network Infrastructure70-646 Windows 2008 Server Administrator Exam***Only 3 exams required; the MCTS exams 70-640 and 70-642 and the main MCITP exam for this track, 70-646Windows Server 2008 Enterprise Administrator:70-640 Active Directory70-642 Network Infrastructure70-643 Applications Platform70-620 OR 70-624 Windows Vista Client70-647 Windows Server 2008 Enterprise Administrator Exam***5 exams required; the MCTS exams 70-640, 70-642, 70-643, 70-620 (or 70-624) and the main MCITP exam for this track, 70-647The two MCITP exams are schedlued to be available 60 days after Server 2008 goes RTM.Do I lose my MCSE/MCSA?No. You get to keep your MCSE or any credential earned under the Windows 2000/2003 certification track. You essentially have a “MCSE in Windows 2003″ (for example). However, you do not become a “MCSE in Windows 2008″, because the MCSE no longer exists. You will have to upgrade to one of the MCITP certifications referenced above. Your Windows 2000/2003 certifications will not expire and will continue to be valuable as long as Windows 2000/2003 is used on company networks. If you are currently working on your MCSE/MCSA keep working on it…it is still valuable and will provide you with excellent base knowledge that will also apply to Windows 2008.Can you upgrade your MCSE/MCSA to Windows Server 2008 Certifications?Yes, there is an upgrade path but only for WINDOWS 2003 MCSEs and MCSAs. If you are certified in Windows 2000, you must upgrade to Windows 2003 first or just take the Windows 2008 exams individually. Here are the upgrade details:Windows 2003 MCSE - Pass the 70-649 (upgrade) exam and you do not have to take 70-640, 70-642, 70-643. You DO have to take the MCITP: Enterprise Server Administrator exam and the Vista client exam.Windows 2003 MCSA - Pass the 70-648 (upgrade) exam and you do not have to take 70-640, 70-642. You DO have to take the MCITP: Server Administrator exam.My Thoughts on the Windows 2008 CertificationsLike I said in the opening, I came away a little underwhelmed. It just seems like the main MCITP certifications do not have enough substance. I am all for simplicity (only 2 or 3 different professional tracks) but I would like to see a few more exams attached to the higher level certs to make them a little tougher to attain. I also think it will be a bit clunky to say (or put on a resume), “I am a MCITIP: Enterprise Administrator, MCTS: ISA Server, MCTS: Exchange Server”, etc. There should be one certification (probably the Enterprise Administator certification) that requires Exchange Server, ISA Server and perhaps SQL Server knowledge, in addition to all of the core Windows Server 2008 requirements. This would be of value to companies and IT professionals alike.

CCNA Router Simulator Question - ACL SIM

CCNA Router Simulator Question - ACL SIM

From Testinside Blog
ACL SIM

Answer: Select the console on Corp1 routerConfiguring ACL Corp1>enableCorp1#configure terminalcomment: To permit only Host C (192.168.33.3){source addr} to access finance server address (172.22.242.23) {destination addr} on port number 80 (web)Corp1(config)#access-list 100 permit tcp host 192.168.33.3 host 172.22.242.23 eq 80 comment: To deny any source to access finance server address (172.22.242.23) {destination addr} on port number 80 (web)Corp1(config)#access-list 100 deny tcp any host 172.22.242.23 eq 80 comment: To permit ip protocol from any source to access any destination because of the implicit deny any any statement at the end of ACL.Corp1(config)#access-list 100 permit ip any anyApplying the ACL on the Interfacecomment: Check show ip interface brief command to identify the interface type and number by checking the IP address configured.
Corp1(config)#interface fa 0/1
If the ip address configured already is incorrect as well as the subnet mask. this should be corrected in order ACL to work
type this commands at interface mode :
no ip address 192.x.x.x 255.x.x.x (removes incorrect configured ip address and subnet mask)
Configure Correct IP Address and subnet mask :
ip address 172.22.242.30 255.255.255.240 ( range of address specified going to server is given as 172.22.242.17 - 172.22.242.30 )
comment: Place the ACL to check for packets going outside the interface towards the finance web server.Corp1(config-if)#ip access-group 100 outCorp1(config-if)#endImportant: To save your running config to startup before exit.Corp1#copy running-config startup-configVerifying the Configuration :
Step1: show ip interface brief command identifies the interface on which to apply access list .
Step2: Click on each host A,B,C & D . Host opens a web browser page , Select address box of the web browser and type the ip address of finance web server(172.22.242.23) to test whether it permits /deny access to the finance web Server .
Step 3: Only Host C (192.168.33.3) has access to the server . If the other host can also access then maybe something went wrong in your configuration . check whether you configured correctly and in order.
Step 4: If only Host C (192.168.33.3) can access the Finance Web Server you can click on NEXT button to successfully submit the ACL SIM.

CCNA Router Simulator Question - VTP SIM

CCNA Router Simulator Question - VTP SIM
SIMQuestion:This task requires you to use the CLI of Sw-AC3 to answer five multiple-choice questions. This does not require any configuration.To answer the multiple-choice questions, click on the numbered boxes in the right panel.

There are five multiple-choice questions with this task. Be sure to answer all five questions before leaving this item.

Important: The VTP simlet has a pool of 10 question of which it will select a random 5 for the actual exam test,Therefore each person might get a different set of questions.
some very usefull commands to answer this simlet:
show cdp neighbor , show cdp neighbor detail , show interface trunk or switchport , show mac-address-table, show spanning-tree, show vlan , show vtp status , show run .
The pool of 10 questions are discussed here starting with the 4 questions in the above picture.
Question 1 :
What interface did Sw-AC3 associate with source MAC address 0010.5a0c.ffba ?
Answer:
Fa 0/8 (As per the picture above)
To find out the associate interface number for a given mac address on the switch use the show mac-address-table command and search for the mac address 0010.5a0c.ffba and its associated interface number.
Question 2 :
what ports on Sw-AC3 are operating has trunks (choose two)?
Answer:
Fa 0/9 and Fa 0/12 (As per the picture above)
To find out the ports operating has trunks on a switch
Use the show interface trunk command this will display all the trunk ports configured on switch.
(or)
Use the show interface switchport command and check the output of the command for operational mode : type trunk for each and every interface.
Question 3:
What kind of router is VLAN-R1 ?
Answer:
2611 ( as per picture above)
To know details of directly connected Neighbor, use the following command on the switch show cdp neighbors command, this output gives the following details about its neighbors
Device ID, Local Interface ,Holdtme, Capability, Platform, Port ID
To know what kind of router is VLAN-R1 we need to identify its platform details from above command output.
Question 4:
Which switch is the root bridge for VLAN 1 ?
Answer:
Sw-AC3 (As per the question above in picture)
Step1: Use the Show spanning-tree vlan 1 command this output provide the mac address of the root bridge.
Step2: now use the show mac-address-table command this output associates the mac address to a interface number.
Step3: use the command show cdp neighbors this output will give us the local interface associated with the hostname(Device ID).
Question 5 :
Out of which port on switch Sw-Ac3 would a frame containing an IP packet with destination address that is not on a local LAN be forwarded?
Answer:
To forward any packet with destination address other then the subnet network of the switch, the switch usually forwards this IP packets to the layer 3 device example router connected to it.
Step1: Find the default-gateway(Router or layer 3 device) configured on the switch.
use the Show run command to view the IP address used to configure default-gateway on the switch.
Step2: Look for the router VLAN-R1 after using the show cdp neighbor detail command
Sample output of show cdp neighbor detail command for better understanding the output details
Device ID: C2950-1Entry address(es):Platform: Cisco WS-C2950T-24, Capabilities: Switch IGMPInterface: FastEthernet0/0, Port ID (outgoing port): FastEthernet0/15Holdtime : 139 sec
Two things to notice from above output
Interface: FastEthernet0/0 this statement provides that the neighbor(c2950-1) is connected to fa 0/0 on the c3660-2 local switch.
Port ID (outgoing port): FastEthernet0/15 this explains that neighbor (c2950-1) uses fa 0/15 port to reach c3660-2 switch.
FOR OUR QUESTION WE SHOULD LOOK FOR THE ROUTER VLAN-R1 corresponding details and to which port it is connected on local switch Sw-Ac3.
Step3: The port number to which the routerVLAN-R1 is connected on switch Sw-Ac3 is used to forward the packets with destination address that is not on a local LAN.
Question 6:
What address should be configured as the default-gateway for the host connected to interface fa 0/4 of SW-Ac3 ?
Answer:
Step1: Find the details of the VLAN assigned to interface fa 0/4 by using the show vlan command on Sw-Ac3.
The above exhibit question has fa 0/4 configured has VLAN1 based on the output from show vlan command.
Step2: From the exhibit question we know that VLAN1 is configured on router using sub-interface fa 0/0.1 with IP address 192.168.1.254 /24.
Step3: 192.168.1.254 should be configure as default-gateway address for the host connected to fa 0/4 on switch.
Because VLAN1 corresponds to fa 0/4 on Sw-Ac3 and host connected to fa 0/4 will be member of vlan1.
Question 7:
Out of which ports will frame with source mac-address 0015.5A0Cc.A086 and destination mac-address 000A.8A47.0612 be forwarded ?
Answer:
Step1: Use Show mac-address-table command on the switch.
The output of a show mac-address-table provides the mapping of mac address with port numbers. Search the output for the two mac-addresses provided in the question and select the destination mac address corresponding port number for correct answers.
Step2: If you do not find the above two mac-address in MAC-ADDRESS-TABLE output , then the frame will be broadcast or flooded to all ports ( all ports may be ports of particular vlan on switch ,Selection of VLAN will be depending on the source mac-address port vlan membership) except the port it recieved from i.e the source mac-address.
Question 8:
From which switch did Sw-Ac3 receive VLAN information ?
Answer:
Step1: Use Sw-Ac3#show vtp status command .
Sample output of show vtp status command
switch# show vtp statusVTP Version : 2Configuration Revision : 255Maximum VLANs supported locally : 1005Number of existing VLANs : 35VTP Operating Mode : ServerVTP Domain Name : Lab_NetworkVTP Pruning Mode : EnabledVTP V2 Mode : EnabledVTP Traps Generation : DisabledMD5 digest : 0x08 0x7E 0x54 0xE2 0x5A 0x79 0xA9 0x2DConfiguration last modified by 127.0.0.12 at 8-7-02 11:21:43Local updater ID is 127.0.0.12 on interface EO0/0 (first interface found)
The local updater ID in the above output identifies the ip address of the device which is providing the VLAN information. The address could also be of the switch itself.
Step 2: Show cdp neighbor detail provides the hostname for corresponding to that IP address.
Question 9:
Refer to the exhibit. SwX was taken out of the production network for maintenance. It will be reconnected to the Fa 0/16 port of Sw-Ac3. What happens to the network when it is reconnected and a trunk exists between the two switches?

Answer:
Step1: On switch Sw-Ac3 use show vtp status command. Notice the output for domain name, Both switches must have same domain name configured to exchange vtp messages (exhibit domain name: home-office ).
Step2: If domain name matches, Then note Configuration Revision number of the Sw-Ac3 and compare it with the SwX , Whichever switch has highest configuration revision number will become the vtp updater. The switch which becomes vtp updater will replace other switch vlan information with its own vlan information.
Example if SwX revision number is highest , Then VLAN information that is configured in Sw-Ac3 will be replaced by the VLAN information in the SwX.

Visual Subst

Visual Subst - virtual drives in effect Visual Subst is a small tool that allows you to associate the most accessed directories with virtual drives. It uses the same API similar to the console 'subst' utility, but makes it easier to create and remove virtual drives in a GUI way.

Personally, I use virtual drives everywhere – I always prefer to press ALT+F1 in the file manager and switch to a project directory where hundreds of various files are kept. Using virtual drives, these files can be quickly accessed at any time.
Link : http://www.ntwind.com/software/utilities/visual-subst.html

Net Transport 2.00.303 UNICODE (NT/2000/XP/2003)

Net Transport 2.00.303 UNICODE (NT/2000/XP/2003)Changes in Net Transport 2.00 (Oct 29, 2005):- New release has ANSI (95/98/ME) and UNICODE (NT/2000/XP/2003) versions, UNICODE can resolve all the problem about the international character set. Please use the UNICODE firstly.- Added IE toolbar band called "NetXfer".- Enhanced Opera plug-in to avoid downloading twice.- Net Transport can check its own upgrade now.- Added support to download the file whose size is greater than 4G. But your must partition your hard disk by NTFS.Removed the progress pane, added instant speed column in the thread list pane.- Enhanced IE proxy, if the protocol is "https", NetXfer will use CONNECT method instead of GET.- You can use several different URLs to download one file. (Single Destination Several Point)- Added support to record every clip for MMS, filter all short movies.- Uniformed the internal saving data for MMS, so you can switch protocol between MMS, MMS(HTTP) and Microsoft RTSP anytime.- Added support to record partial clip.- Enhanced scheduler, you can record the dynamic URL according to time.- Added support to import/export the internal data to backup/restore.- More strongly stability, better performance.- But the bad thing is that the internal data is NOT compatible with 1.xx due to several new features. You must rebuild all the job items. Sorry.Homepage - http://www.xi-soft.com/default.htmSize: 1.83 MBDownload Full Patched Version:http://s6.ultrashare.net/hosting/fs/7da8862add13ded2/