CompTIA Security+™ Certification
From Comptia
CompTIA Security+™ CertificationCompTIA Security+ validates knowledge of communication security, infrastructure security, cryptography, operational security, and general security concepts. It is an international, vendor-neutral certification that is taught at colleges, universities and commercial training centers around the world. Although not a prerequisite, it is recommended that CompTIA Security+ candidates have at least two years on-the-job networking experience, with an emphasis on security. The CompTIA Network+ certification is also recommended.
Because human error is the number one cause for a network security breach, CompTIA Security+ is recognized by the technology community as a valuable credential that proves competency with information security. Major corporations such as Sun, IBM/Tivoli Software Group, Symantec, Motorola, Hitachi Electronics Services and Verisign value the CompTIA Security+ certification and recommend or require it of their IT employees.
Monday, June 18, 2007
Use of the Configuration Register on All Cisco Routers
From Cisco
Use of the Configuration Register on All Cisco Routers
Document ID: 50421
Introduction
This document provides a description of the configuration register (config register).
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
This document is not restricted to specific software and hardware versions.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions
Refer to Cisco Technical Tips Conventions for more information on document conventions.
The Purpose of the Configuration Register
The configuration register can be used to change router behavior in several ways, such as:
how the router boots (into ROMmon, NetBoot)
options while booting (ignore configuration, disable boot messages)
console speed (baud rate for a terminal emulation session)
The configuration register can be set from configuration mode using the config-register command. From ROMmon, use the confreg command. Issue the show version command to view the current setting of the configuration register:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-JS-L), Version 12.1(5), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Wed 25-Oct-00 05:18 by cmong
Image text-base: 0x03071DB0, data-base: 0x00001000
ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
BOOTFLASH: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE SOFTWARE (fc1)
Router uptime is 7 minutes
System returned to ROM by reload
System image file is "flash:c2500-js-l_121-5.bin"
cisco 2500 (68030) processor (revision D) with 16384K/2048K bytes of memory.
Processor board ID 03867477, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
1 Token Ring/IEEE 802.5 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
Configuration register is 0x2102
The factory-default setting for the configuration register is 0x2102. This indicates that the router should attempt to load a Cisco IOS® software image from Flash memory and load the startup configuration with a console speed of 9600 baud.
Configuration Register Values and their Meaning
If you know the value of your configuration register, you can determine its meaning. For information on the meaning of your configuration register setting, including potential issues and fixes, collect the output of the show version command, or the show tech-support command, and input into the Output Interpreter ( registered customers only) tool. In order to use Output Interpreter ( registered customers only) , you must be a registered customer, be logged in, and have JavaScript enabled.
This table contains some common settings which are valid on most platforms.
Note: Check the appropriate hardware installation guide to verify that the configuration register can be used before you change the configuration register on your router to one of the values in this table.
Configuration Register Setting
Router Behavior
0x102
Ignores break
9600 console baud
0x1202
1200 baud rate
0x2101
Boots into bootstrap
Ignores break
Boots into ROM if initial boot fails
9600 console baud rate
0x2102
Ignores break
Boots into ROM if initial boot fails
9600 console baud rate default value for most platforms
0x2120
Boots into ROMmon
19200 console speed
0x2122
Ignores break
Boots into ROM if initial boot fails
19200 console baud rate
0x2124
NetBoot
Ignores break
Boots into ROM if initial boot fails
19200 console speed
0x2142
Ignores break
Boots into ROM if initial boot fails
9600 console baud rate
Ignores the contents of Non-Volatile RAM (NVRAM) (ignores configuration)
0x2902
Ignores break
Boots into ROM if initial boot fails
4800 console baud rate
0x2922
Ignores break
Boots into ROM if initial boot fails
38400 console baud rate
0x3122
Ignores break
Boots into ROM if initial boot fails
57600 console baud rate
0x3902
Ignores break
Boots into ROM if initial boot fails
2400 console baud rate
0x3922
Ignores break
Boots into ROM if initial boot fails
115200 console baud rate
If the value you have for the configuration register is not in the table, then determine which bits are set in order to compute the value:
Bit Number
Hex
Meaning
00-03
0x0000-0x000F
Boots Field Parameters 0x0000
Stays at the system bootstrap prompt 0x0001
Boots system image on EPROM 0x0002-0x000F
Specifies a default netboot filename
06
0x0040
Ignore NVRAM contents
07
0x0080
Disable boot messages
08
0x0100
Break disabled
10
0x0400
IP broadcast with all zeros
5,11,12
0x0020, 0x0800, 0x1000
Console line speed
13
0x2000
Boots default ROM software if network boot fails
14
0x4000
IP broadcasts do not have net numbers
15
0x8000
Enables diagnostic messages
Ignores NVRAM contents
Troubleshoot Configuration Register Issues
An inappropriately set configuration register can cause many problems, such as:
The configuration file is ignored.
There is no output or garbage output from the console.
Booting into ROMmon.
Change the configuration register to an appropriate setting, such as the factory default 0x2102, in order to solve these problems.
Troubleshooting when the Configuration Register Value is Not Known
If the configuration register value is not known, try to establish a Telnet or console session with the router. You can then check the show version output to determine the value of the configuration register:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-JS-L), Version 12.1(5), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Wed 25-Oct-00 05:18 by cmong
Image text-base: 0x03071DB0, data-base: 0x00001000
ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
BOOTFLASH: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE SOFTWARE (fc1)
Router uptime is 7 minutes
System returned to ROM by reload
System image file is "flash:c2500-js-l_121-5.bin"
cisco 2500 (68030) processor (revision D) with 16384K/2048K bytes of memory.
Processor board ID 03867477, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
1 Token Ring/IEEE 802.5 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
Configuration register is 0x2142
If you cannot establish a console session, or if you see only garbage characters, a speed mismatch between the router and the terminal emulation software could be the cause. Try to change the baud rate of your terminal emulation software. Possible settings include 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200. Once you establish a session, you can issue the show version command to determine the setting. If the router is in ROMmon mode, you can try to issue the boot command to boot the operating system manually. For information on the meaning of your configuration register setting, including potential issues and fixes, collect the output of the show version command, or the show tech-support command, and input into the Output Interpreter ( registered customers only) tool. In order to use Output Interpreter ( registered customers only) , you must be a registered customer, be logged in, and have JavaScript enabled.
Troubleshooting when the Configuration Register Value is Known
If you know the value of your configuration register, use the table in Configuration Register Settings and their Meaning to determine the behavior. For information on the meaning of your configuration register setting, including potential issues and fixes, collect the output of the show version command, or the show tech-support command, and input into the Output Interpreter ( registered customers only) tool. In order to use Output Interpreter ( registered customers only) , you must be a registered customer, be logged in, and have JavaScript enabled. If you can access the router through Telnet, establish a session with the router. If not, set your terminal emulation program to the baud rate indicated by the configuration register setting to establish a console session.
Set the Configuration Register
Use the table in Configuration Register Settings and their Meaning to determine the desired configuration register setting (usually 0x2102).
Set the Configuration Register from Configuration Mode
Issue the config-register command to set the configuration register:
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#config
Router(config)#config-register 0x2102
Router(config)#end
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-JS-L), Version 12.1(5), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Wed 25-Oct-00 05:18 by cmong
Image text-base: 0x03071DB0, data-base: 0x00001000
ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
BOOTFLASH: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE SOFTWARE (fc1)
Router uptime is 11 minutes
System returned to ROM by reload
System image file is "flash:c2500-js-l_121-5.bin"
cisco 2500 (68030) processor (revision D) with 16384K/2048K bytes of memory.
Processor board ID 03867477, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
1 Token Ring/IEEE 802.5 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
Configuration register is 0x2142 (will be 0x2102 at next reload)
The new configuration register setting becomes active once the router reloads.
Router#reload
System configuration has been modified. Save? [yes/no]: n
Proceed with reload? [confirm]
Set the Configuration Register from ROMmon
Set the configuration register with the confreg command if the router is in ROMmon mode:
rommon 1 >confreg 0x2102
You must reset or power-cycle for the new configuration register to take effect.
Use of the Configuration Register on All Cisco Routers
Document ID: 50421
Introduction
This document provides a description of the configuration register (config register).
Prerequisites
Requirements
There are no specific requirements for this document.
Components Used
This document is not restricted to specific software and hardware versions.
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Conventions
Refer to Cisco Technical Tips Conventions for more information on document conventions.
The Purpose of the Configuration Register
The configuration register can be used to change router behavior in several ways, such as:
how the router boots (into ROMmon, NetBoot)
options while booting (ignore configuration, disable boot messages)
console speed (baud rate for a terminal emulation session)
The configuration register can be set from configuration mode using the config-register command. From ROMmon, use the confreg command. Issue the show version command to view the current setting of the configuration register:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-JS-L), Version 12.1(5), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Wed 25-Oct-00 05:18 by cmong
Image text-base: 0x03071DB0, data-base: 0x00001000
ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
BOOTFLASH: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE SOFTWARE (fc1)
Router uptime is 7 minutes
System returned to ROM by reload
System image file is "flash:c2500-js-l_121-5.bin"
cisco 2500 (68030) processor (revision D) with 16384K/2048K bytes of memory.
Processor board ID 03867477, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
1 Token Ring/IEEE 802.5 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
Configuration register is 0x2102
The factory-default setting for the configuration register is 0x2102. This indicates that the router should attempt to load a Cisco IOS® software image from Flash memory and load the startup configuration with a console speed of 9600 baud.
Configuration Register Values and their Meaning
If you know the value of your configuration register, you can determine its meaning. For information on the meaning of your configuration register setting, including potential issues and fixes, collect the output of the show version command, or the show tech-support command, and input into the Output Interpreter ( registered customers only) tool. In order to use Output Interpreter ( registered customers only) , you must be a registered customer, be logged in, and have JavaScript enabled.
This table contains some common settings which are valid on most platforms.
Note: Check the appropriate hardware installation guide to verify that the configuration register can be used before you change the configuration register on your router to one of the values in this table.
Configuration Register Setting
Router Behavior
0x102
Ignores break
9600 console baud
0x1202
1200 baud rate
0x2101
Boots into bootstrap
Ignores break
Boots into ROM if initial boot fails
9600 console baud rate
0x2102
Ignores break
Boots into ROM if initial boot fails
9600 console baud rate default value for most platforms
0x2120
Boots into ROMmon
19200 console speed
0x2122
Ignores break
Boots into ROM if initial boot fails
19200 console baud rate
0x2124
NetBoot
Ignores break
Boots into ROM if initial boot fails
19200 console speed
0x2142
Ignores break
Boots into ROM if initial boot fails
9600 console baud rate
Ignores the contents of Non-Volatile RAM (NVRAM) (ignores configuration)
0x2902
Ignores break
Boots into ROM if initial boot fails
4800 console baud rate
0x2922
Ignores break
Boots into ROM if initial boot fails
38400 console baud rate
0x3122
Ignores break
Boots into ROM if initial boot fails
57600 console baud rate
0x3902
Ignores break
Boots into ROM if initial boot fails
2400 console baud rate
0x3922
Ignores break
Boots into ROM if initial boot fails
115200 console baud rate
If the value you have for the configuration register is not in the table, then determine which bits are set in order to compute the value:
Bit Number
Hex
Meaning
00-03
0x0000-0x000F
Boots Field Parameters 0x0000
Stays at the system bootstrap prompt 0x0001
Boots system image on EPROM 0x0002-0x000F
Specifies a default netboot filename
06
0x0040
Ignore NVRAM contents
07
0x0080
Disable boot messages
08
0x0100
Break disabled
10
0x0400
IP broadcast with all zeros
5,11,12
0x0020, 0x0800, 0x1000
Console line speed
13
0x2000
Boots default ROM software if network boot fails
14
0x4000
IP broadcasts do not have net numbers
15
0x8000
Enables diagnostic messages
Ignores NVRAM contents
Troubleshoot Configuration Register Issues
An inappropriately set configuration register can cause many problems, such as:
The configuration file is ignored.
There is no output or garbage output from the console.
Booting into ROMmon.
Change the configuration register to an appropriate setting, such as the factory default 0x2102, in order to solve these problems.
Troubleshooting when the Configuration Register Value is Not Known
If the configuration register value is not known, try to establish a Telnet or console session with the router. You can then check the show version output to determine the value of the configuration register:
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-JS-L), Version 12.1(5), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Wed 25-Oct-00 05:18 by cmong
Image text-base: 0x03071DB0, data-base: 0x00001000
ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
BOOTFLASH: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE SOFTWARE (fc1)
Router uptime is 7 minutes
System returned to ROM by reload
System image file is "flash:c2500-js-l_121-5.bin"
cisco 2500 (68030) processor (revision D) with 16384K/2048K bytes of memory.
Processor board ID 03867477, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
1 Token Ring/IEEE 802.5 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
Configuration register is 0x2142
If you cannot establish a console session, or if you see only garbage characters, a speed mismatch between the router and the terminal emulation software could be the cause. Try to change the baud rate of your terminal emulation software. Possible settings include 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200. Once you establish a session, you can issue the show version command to determine the setting. If the router is in ROMmon mode, you can try to issue the boot command to boot the operating system manually. For information on the meaning of your configuration register setting, including potential issues and fixes, collect the output of the show version command, or the show tech-support command, and input into the Output Interpreter ( registered customers only) tool. In order to use Output Interpreter ( registered customers only) , you must be a registered customer, be logged in, and have JavaScript enabled.
Troubleshooting when the Configuration Register Value is Known
If you know the value of your configuration register, use the table in Configuration Register Settings and their Meaning to determine the behavior. For information on the meaning of your configuration register setting, including potential issues and fixes, collect the output of the show version command, or the show tech-support command, and input into the Output Interpreter ( registered customers only) tool. In order to use Output Interpreter ( registered customers only) , you must be a registered customer, be logged in, and have JavaScript enabled. If you can access the router through Telnet, establish a session with the router. If not, set your terminal emulation program to the baud rate indicated by the configuration register setting to establish a console session.
Set the Configuration Register
Use the table in Configuration Register Settings and their Meaning to determine the desired configuration register setting (usually 0x2102).
Set the Configuration Register from Configuration Mode
Issue the config-register command to set the configuration register:
Router#configure terminal
Enter configuration commands, one per line. End with CNTL/Z.
Router(config)#config
Router(config)#config-register 0x2102
Router(config)#end
Router#show version
Cisco Internetwork Operating System Software
IOS (tm) 2500 Software (C2500-JS-L), Version 12.1(5), RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2000 by cisco Systems, Inc.
Compiled Wed 25-Oct-00 05:18 by cmong
Image text-base: 0x03071DB0, data-base: 0x00001000
ROM: System Bootstrap, Version 5.2(8a), RELEASE SOFTWARE
BOOTFLASH: 3000 Bootstrap Software (IGS-RXBOOT), Version 10.2(8a), RELEASE SOFTWARE (fc1)
Router uptime is 11 minutes
System returned to ROM by reload
System image file is "flash:c2500-js-l_121-5.bin"
cisco 2500 (68030) processor (revision D) with 16384K/2048K bytes of memory.
Processor board ID 03867477, with hardware revision 00000000
Bridging software.
X.25 software, Version 3.0.0.
SuperLAT software (copyright 1990 by Meridian Technology Corp).
TN3270 Emulation software.
1 Token Ring/IEEE 802.5 interface(s)
2 Serial network interface(s)
32K bytes of non-volatile configuration memory.
16384K bytes of processor board System flash (Read ONLY)
Configuration register is 0x2142 (will be 0x2102 at next reload)
The new configuration register setting becomes active once the router reloads.
Router#reload
System configuration has been modified. Save? [yes/no]: n
Proceed with reload? [confirm]
Set the Configuration Register from ROMmon
Set the configuration register with the confreg command if the router is in ROMmon mode:
rommon 1 >confreg 0x2102
You must reset or power-cycle for the new configuration register to take effect.
Sunday, June 17, 2007
Step-by-Step Guide to a Common Infrastructure for Windows Server 2003 Deployment
From Microsoft
Step-by-Step Guide to a Common Infrastructure for Windows Server 2003 Deployment
Part 1: Installing Windows Server 2003 as a Domain Controller
Introduction
Step-by-Step Guides
The Microsoft Windows Server 2003 Deployment step-by-step guides provide hands-on experience for many common operating system configurations. The guides begin by establishing a common network infrastructure through the installation of Windows Server 2003, the configuration of Active Directory, the installation of a Windows XP Professional workstation, and finally the addition of this workstation to a domain. Subsequent step-by-step guides assume that you have this common network infrastructure in place. If you do not wish to follow this common network infrastructure, you will need to make appropriate modifications while using these guides.
The common network infrastructure requires the completion of the following guides.
•
Part I: Installing Windows Server 2003 as a Domain Controller
•
Part II: Installing a Windows XP Professional Workstation and Connecting it to a Domain
Once the common network infrastructure is configured, any of the additional step-by-step guides may be employed. Note that some step-by-step guides may have additional prerequisites above and beyond the common network infrastructure requirements. Any additional requirements will be noted in the specific step-by-step guide.
Microsoft Virtual PC
The Windows Server 2003 Deployment step-by-step guides may be implemented within a physical lab environment or through virtualization technologies like Microsoft Virtual PC 2004 or Virtual Server 2005. Virtual machine technology enables customers to run multiple operating systems concurrently on a single physical server. Virtual PC 2004 and Virtual Server 2005 are designed to increase operational efficiency in software test and development, legacy application migration, and server consolidation scenarios.
The Windows Server 2003 Deployment step-by-step guides assume that all configurations will occur within a physical lab environment although most configurations can be applied to a virtual environment without modification.
Applying the concepts provided in these step-by-step guides to a virtual environment based is beyond the scope of this document.
Important Notes
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, places, or events is intended or should be inferred.
This common infrastructure is designed for use on a private network. The fictitious company name and Domain Name System (DNS) name used in the common infrastructure are not registered for use on the Internet. You should not use this name on a public network or Internet.
The Active Directory service structure for this common infrastructure is designed to show how Windows Server 2003 Change and Configuration Management works and functions with Active Directory. It was not designed as a model for configuring Active Directory for any organization.
Top of page
Overview
This guide explains how to build a common network infrastructure beginning with the installation and configuration of the Microsoft Windows Server 2003 operating system as a domain controller. This common infrastructure allows you to learn about and evaluate Windows Server 2003. As you implement this guide, think about how you will use them in your organization.
This guide, which is the first in a two-part series, shows how to install a server as a domain controller and populate a sample Active Directory service structure. Part two describes steps to install a Windows XP Professional client and connect that client to the domain controller. First, complete the procedures in this guide, then use "Part II: Installing a Windows XP Professional Workstation and Connecting It to a Domain" to complete your common network infrastructure.
Prerequisites
•
None
Guide Requirements
These are the hardware requirements for the common infrastructure.
Item
Quantity
Comments
Server(s)
1
Capable of running Windows Server 2003
Workstation(s)
As Needed
Capable of running Windows XP Professional
Network Hub(s)
As Needed
A private network is recommended
Remote Access Hardware
As Needed
For testing slow-link and remote connections
Network Interface Cards
As Needed
100 MB Card
UPS
Optional
To protect the servers
Printer
Optional
To print configuration information and other tests
Notes:
•
An Intel processor–based server running Windows Server 2003 must have at least 128 megabytes (MB) of RAM. Microsoft also recommends that the server have several gigabytes of disk storage. In addition, servers should be equipped with high-speed network interface cards.
•
Use a sufficient number of workstations to simulate a variety of workstation environments, including your organization’s typical desktop, roaming user, mobile user, and any other configurations that may be appropriate. These computers must be capable of running Windows XP Professional. Microsoft recommends a minimum of 64 MB of RAM for Intel processor–based workstations.
•
When creating the physical infrastructure, a private network is recommended; therefore, you need sufficient network hubs and other networking hardware to connect all of the workstations and servers to a single network.
•
The most current information about hardware requirements and compatibility for servers is available at the Windows Server 2003 Product Compatibility Web site.
Additional Server Parameters
If you add additional servers to the common infrastructure, use the following server naming convention.
Parameter
Value
Computer Name(s)
HQ-CON-SRV-01HQ-CON-SRV-nn
Server Configuration
Overview
Figure 1 shows the basic server configuration.
Figure 1. The Server Configuration
Server Disk Configuration
To use a single server for the infrastructure in this guide, you will need a server with either two disk drives or a single disk drive with two partitions.
Note: Subsequent step-by-step guides in this series may require additional servers or other equipment; those additions are addressed in the specific guide.
The first disk or partition holds Windows Server 2003 and other files for the common infrastructure, such as the Windows Installer packages and application source files. The second disk or partition is reserved for Active Directory log files and procedures required by other step-by-step guides.
Each disk or partition must hold several gigabytes of information, and each disk or partition must be formatted for the NT file system (NTFS). The steps for creating and formatting partitions are contained in this guide.
Top of page
Server Installation
To begin the installation procedure, boot directly from the Windows Server 2003 CD. Your CD-ROM must support bootable CDs.
Note: When you configure partitions and format drives, all data on the server hard drive is destroyed.
Beginning the Installation
Setup creates the disk partitions on the computer running Windows Server 2003, formats the drive, and then copies installation files from the CD to the server.
Note: These instructions assume that you are installing Windows Server 2003 on a computer that is not already running Windows. If you are upgrading from an older version of Windows, some of the installation steps may differ.
To begin the installation
1.
Insert the Windows Server 2003 CD in the CD-ROM drive.
2.
Restart the computer. If prompted, press any key to boot from the CD.
The Windows Server 2003 installation begins.
3.
On the Welcome to Setup screen, press Enter.
4.
Review and, if acceptable, agree to the license agreement by pressing F8.
Note: If you had a previous version of Windows Server 2003 installed on this server, you might get a message asking if you want to repair the drive. Press Esc to continue and not repair the drive.
5.
Follow the instructions to delete all existing disk partitions. The exact steps will differ based on the number and type of partitions already on the computer. Continue to delete partitions until all disk space is labeled as Unpartitioned space.
6.
When all disk space is labeled as Unpartitioned space, press C to create a partition in the unpartitioned space on the first disk drive (as applicable).
7.
If your server has a single disk drive, split the available disk space in half to create two equal-sized partitions. Delete the total space default value. Type the value of half your total disk space at the Create partition of size (in MB) prompt, and the press Enter. (If your server has two disk drives, type the total size of the first drive at this prompt.)
8.
After the New partition is created, press Enter.
9.
Select Format the partition using the NTFS file system, and then press Enter.
Windows Server 2003 Setup formats the partition and then copies the files from the Windows Server 2003 Server CD to the hard drive. The computer restarts and the Windows Server 2003 Installation Program continues.
Completing the Installation
To continue the installation with the Windows Server 2003 Setup Wizard
1.
The Windows Server 2003 Setup Wizard detects and installs devices. This can take several minutes, and during the process your screen may flicker.
2.
In the Regional and Language Options dialog box, make changes required for your locale (typically, none are required for the United States), and then click Next.
3.
In the Personalize Your Software dialog, type Mike Nash in the Name box and type Reskit in the Organization box. Click Next.
4.
Type the Product Key (found on the back of your Windows Server 2003 CD case) in the text boxes provided, and then click Next.
5.
In the Licensing Modes dialog box, select the appropriate licensing mode for your organization, and then click Next.
6.
In the Computer Name and Administrator Password dialog box, type the new computer name HQ-CON-DC-01 in the computer name box, and then click Next.
Best Practice: To facilitate the steps in these guides, the Administrator password is left blank and there is no password. This is not an acceptable security practice. When installing a server for your production network, a password should always be set. Windows Server 2003 requires complex passwords by default.
7.
When prompted by Windows Setup, click Yes to confirm a blank Administrator password.
8.
In the Date and Time Settings dialog box, correct the current date and time if necessary, and then click Next.
9.
In the Networking Settings dialog box, make sure Typical Settings is selected, and then click Next.
10.
In the Workgroups or Computer Domain dialog box (No is selected by default), click Next.
Note: A domain name could be specified at this point, but this guide uses the Configure Your Server Wizard to create the domain name at a later time.
The Windows Server 2003 Installation continues and configures the necessary components. This may take a few minutes.
11.
The server restarts and the operating system loads from the hard drive.
Preparing a Secondary Partition or Secondary Disk Drive
The unpartitioned space from the installation of Windows Server 2003 requires formatting before it can be accessed by the operating system. Management of disks and partitions occurs through the Computer Management snap-in for Microsoft Management Console. The following steps assume a second disk drive is in use; modify procedures accordingly for a second partition.
To prepare a secondary partition or disk drive
Warning: Formatting a partition destroys all data on that partition. Make sure that you select the correct partition.
1.
Press Ctrl+Alt+Del and log on to the server as administrator. Leave the password blank.
2.
Click the Start button, point to Administrative Tools, and then click Computer Management.
3.
To define and format the unpartitioned space, click Disk Management.
4.
Right-click Unallocated on Disk 1.
5.
To define a partition, click New Partition, and then click Next to continue.
6.
Select Primary Partition (default), and then click Next to continue.
7.
Click Next leaving the Partition size in MB set to the default.
8.
For Assign the following drive letter, select L, and then click Next to continue.
9.
Under Format this partition with the following settings, click Perform a quick format. Click Next, and then Finish to complete the configuration of the secondary disk drive. Once you have finished, your disk allocation should look similar to Figure 2.
Figure 2. Disk Management
10.
Close the Computer Management console.
Configuring Your Server as a DHCP Server
Dynamic Host Configuration Protocol (DHCP) can be installed manually or by using the Windows Server 2003 Manage Your Server wizard. This section uses the wizard to complete the installation.
To install DHCP using the Windows Server 2003 Manage Your Server wizard
Warning: The following section will configure your server as a DHCP server. If this server resides on a production network, the server may distribute IP address information that might not be valid on the network. Microsoft recommends that these exercises be completed on an isolated network.
1.
Within the Manager Your Server page, click Add or remove a role.
Note: If you closed the Manage Your Server page you can start the Configure Your Server wizard from Administrative Tools. If you select this option the following steps may differ slightly.
2.
After the Configure Your Server wizard appears, click Next.
3.
Click Custom configuration, and then click Next.
4.
Under Server Role, click DHCP server, and then click Next.
5.
Review the Summary of Selections, and then click Next to begin the installation.
6.
When the New Scope Wizard appears, click Next to define a DHCP scope.
7.
For Name, type Contoso HQ. Leave the description blank, and then click Next.
8.
Enter a Start IP address of 10.0.0.10 and enter 10.0.0.254 for the End IP address. Click Next.
9.
Exclusions will not be defined at this time. Click Next to continue the installation.
10.
To accept the default Lease Duration, click Next.
11.
To set DHCP Options, click Next.
12.
On the Router (Default Gateway) screen, type 10.0.0.1 for IP address, click Add, and then click Next.
13.
For Parent Domain on the Domain Name and DNS Server screen, type contoso.com. For IP address, type 10.0.0.2, click Add, and then click Next.
14.
Click Next as WINS Servers will not be utilized in this environment.
15.
Click Next to Activate Scope.
16.
Click Finish twice.
17.
Close the Manage Your Server screen.
Configuring Your Server as a Domain Controller
Domain Name Service (DNS) and DCPromo (the command-line tool that creates DNS and Active Directory) can be installed manually or by using the Windows Server 2003 Manager Your Server Wizard. This section uses the manual tools to complete the installation.
To install DNS and Active Directory using the manual tools
1.
Click the Start button, click Run, type DCPROMO, and then click OK.
2.
When the Active Directory Installation Wizard appears, click Next to begin the installation.
3.
After reviewing the Operating System Compatibility information, click Next.
4.
Select Domain controller for a new domain (default), and then click Next.
5.
Select Domain in a new forest (default), and then click Next.
6.
For Full DNS name, type contoso.com, and then click Next. (This represents a Fully Qualified name.)
7.
Click Next to accept the default Domain NetBIOS name of CONTOSO. (NetBIOS names provides for down-level compatibility.)
8.
On the Database and Log Folders screen, point the Active Directory Log Folder to L:\Windows\NTDS, and then click Next to continue.
9.
Leave the default folder location for Shared System Volume, and then click Next.
10.
On the DNS Registration Diagnostics screen, click Install and configure the DNS server on this computer. Click Next to continue.
11.
Select Permissions compatible only with Windows 2000 or Windows Server 2003 (default), and then click Next.
12.
Type password for Restore Mode Password and Confirm password, and then click Next to continue.
Note: Production environments should employ complex passwords for Directory Services Restore passwords.
Figure 3. Summary of the Active Directory Installation Options
13.
Figure 3 represents a summary of the Active Directory installation options. Click Next to start the installation of Active Directory. If prompted, insert the Windows Server 2003 installation CD.
14.
Click OK to acknowledge the warning of having a dynamically assigned IP address for a DNS server.
15.
If you have more than one network interface, select the 10.0.0.0 network interface from the Choose Connection drop-down list, and then click Properties.
16.
Under the This connection uses the following items section, click Internet Protocol (TCP/IP), and then click Properties.
17.
Select Use the following IP address, and then type 10.0.0.2 for the IP address. Press the Tab key twice, and then type 10.0.0.1 for the Default gateway. Type 127.0.0.1 for the Preferred DNS server, and then click OK. Click Close to continue.
18.
Click Finish once the Active Directory Installation Wizard is finished.
19.
Click Restart Now to reboot the computer.
To authorize the DHCP server
1.
After the computer reboots, press Ctrl+Alt+Del and log on to the server as administrator@contoso.com. Leave the password blank.
2.
Click the Start menu, select Administrative Tools, and then click DHCP
3.
Click hq-con-dc-01.contoso.com. Right click hq-con-dc-01.contoso.com and then click Authorize
4.
Close the DHCP management console
Active Directory Sample Infrastructure
The common infrastructure is based on the fictitious organization Contoso. Contoso owns the DNS name contoso.com, which was configured with the Active Directory Installation Wizard in the preceding section. Figure 4 illustrates the sample Active Directory structure.
Figure 4. Sample Active Directory Structure
The most interesting aspects of this structure are the Domain (contoso.com); the Accounts, Headquarters, Production, Marketing, Groups, Resources, Desktops, Laptops, and Servers organizational units (OUs). These are represented by folders (book) in Figure 4. OUs exist for the delegation of administration and for the application of Group Policy—not simply to mirror a business organization. For an in-depth discussion on designing an OU structure, see "Designing and Deploying Directory and Security Services".
Populating Active Directory
This section describes how to manually create the OUs, Users, and Security Groups outlined in Appendix A.
Creating Organizational Units and Groups
To create OUs and Security Groups
1.
Click the Start button, point to All Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2.
Click the + next to contoso.com to expand it. Click contoso.com itself to show its contents in the right pane.
3.
In the left pane, right-click contoso.com, point to New, and then click Organizational Unit.
4.
Type Accounts in the name box, and then click OK.
5.
Repeat steps 3 and 4 to create the Groups and Resources OUs.
6.
Click Accounts in the left pane. Its contents now display in the right pane. (It is empty at the beginning of this procedure.)
7.
Right-click Accounts, point to New, and then click Organizational Unit.
8.
Type Headquarters, and then click OK.
9.
Repeat steps 7 and 8 to create the Production and Marketing OUs in Accounts. When you have finished, the OU structure should look like Figure 5.
Figure 5. Creating Organizational UnitsSee full-sized image
10.
In the same way, create Desktops, Laptops, and Servers in the Resources OU.
11.
Create the two security groups by right-clicking Groups, pointing to New, and then clicking Group. The two groups to add are Management and Non-management. The settings for each group should be Global and Security. Click OK to create each group. When all steps are completed, the final OU structure should look like Figure 6.
Figure 6. Final OU StructureSee full-sized image
Creating User Accounts
To create a user account
1.
In the left-hand pane, click Headquarters (in Accounts).. Its contents now display in the right pane. (It is empty at the beginning of this procedure.)
2.
Right-click Headquarters, point to New, and then click User.
3.
Type Christine for the first name and Koch for the last name. (Note that the full name automatically appears in the Full name box.)
4.
Type Christine for the User logon name. The window should look like Figure 7.
Figure 7. Adding a User
5.
Click Next.
6.
Type pass#word1 for Password and Confirm password, and then click Next to continue.
Note: By default, Windows Server 2003 requires complex passwords for all newly created users. Password complexity requirements may be disabled through Group Policy.
7.
Click Finish. Christine Koch now displays in the right-hand pane as a user under Reskit.com/Accounts/Headquarters.
8.
Repeat steps 2 through 7, adding the names listed in Appendix A for the Headquarters OU. When you are finished, the Headquarters OU screen should look like Figure 8.
Figure 8. User listing in the Headquarters OUSee full-sized image
9.
Repeat steps 1 through 8 to create the users in the Production and Marketing OUs.
Adding Users to Security Groups
To add a user to a security group
1.
In the left pane, click Groups.
2.
In the right pane, double-click the Management group.
3.
Click the Members tab, and then click Add.
4.
Click Advanced, and then click Find Now.
5.
Select all appropriate users from the lower section by holding down the Ctrl key while clicking each name. Click OK while all members are highlighted. (The users who should be members of this security group are listed in Appendix A.) Click OK again to add these members to the Management Security Group. Click OK to close the Management Security Group Properties sheet.
Figure 9. The Members of the Management Security Group Are Drawn from Three OUs
6.
Repeat steps 2 through 5 to add members to the Non-management group.
7.
Close the Active Directory Users and Computers snap-in.
Top of page
Appendix A: Active Directory Populace
Users
OU
Full Name
Login Name
Group Membership
Headquarters
Koch, Christine
Christine
Management
West, Paul
Paul
Management
Clark, Molly
Molly
Management
Sprenger, Christof
Christof
Management
Schleger, Yvonne
Yvonne
Management
Nash, Mike
Mike
Management
Brink, Monica
Monica
Non-management
Production
Ola, Preeda
Preeda
Management
Grande, Jon
Jon
Non-management
Hector, Clair
Clair
Non-management
Kim, Jim
Jim
Non-management
Nay, Lorraine
Lorraine
Management
Randall, Cynthia
Cynthia
Non-management
Browne, Kevin F.
Kevin
Non-management
Marketing
Fitzgerald, Charles
Charles
Management
Mustafa, Ahmad
Ahmad
Non-management
Narp, Sylvie
Sylvie
Non-management
Step-by-Step Guide to a Common Infrastructure for Windows Server 2003 Deployment
Part 1: Installing Windows Server 2003 as a Domain Controller
Introduction
Step-by-Step Guides
The Microsoft Windows Server 2003 Deployment step-by-step guides provide hands-on experience for many common operating system configurations. The guides begin by establishing a common network infrastructure through the installation of Windows Server 2003, the configuration of Active Directory, the installation of a Windows XP Professional workstation, and finally the addition of this workstation to a domain. Subsequent step-by-step guides assume that you have this common network infrastructure in place. If you do not wish to follow this common network infrastructure, you will need to make appropriate modifications while using these guides.
The common network infrastructure requires the completion of the following guides.
•
Part I: Installing Windows Server 2003 as a Domain Controller
•
Part II: Installing a Windows XP Professional Workstation and Connecting it to a Domain
Once the common network infrastructure is configured, any of the additional step-by-step guides may be employed. Note that some step-by-step guides may have additional prerequisites above and beyond the common network infrastructure requirements. Any additional requirements will be noted in the specific step-by-step guide.
Microsoft Virtual PC
The Windows Server 2003 Deployment step-by-step guides may be implemented within a physical lab environment or through virtualization technologies like Microsoft Virtual PC 2004 or Virtual Server 2005. Virtual machine technology enables customers to run multiple operating systems concurrently on a single physical server. Virtual PC 2004 and Virtual Server 2005 are designed to increase operational efficiency in software test and development, legacy application migration, and server consolidation scenarios.
The Windows Server 2003 Deployment step-by-step guides assume that all configurations will occur within a physical lab environment although most configurations can be applied to a virtual environment without modification.
Applying the concepts provided in these step-by-step guides to a virtual environment based is beyond the scope of this document.
Important Notes
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, email address, logo, person, places, or events is intended or should be inferred.
This common infrastructure is designed for use on a private network. The fictitious company name and Domain Name System (DNS) name used in the common infrastructure are not registered for use on the Internet. You should not use this name on a public network or Internet.
The Active Directory service structure for this common infrastructure is designed to show how Windows Server 2003 Change and Configuration Management works and functions with Active Directory. It was not designed as a model for configuring Active Directory for any organization.
Top of page
Overview
This guide explains how to build a common network infrastructure beginning with the installation and configuration of the Microsoft Windows Server 2003 operating system as a domain controller. This common infrastructure allows you to learn about and evaluate Windows Server 2003. As you implement this guide, think about how you will use them in your organization.
This guide, which is the first in a two-part series, shows how to install a server as a domain controller and populate a sample Active Directory service structure. Part two describes steps to install a Windows XP Professional client and connect that client to the domain controller. First, complete the procedures in this guide, then use "Part II: Installing a Windows XP Professional Workstation and Connecting It to a Domain" to complete your common network infrastructure.
Prerequisites
•
None
Guide Requirements
These are the hardware requirements for the common infrastructure.
Item
Quantity
Comments
Server(s)
1
Capable of running Windows Server 2003
Workstation(s)
As Needed
Capable of running Windows XP Professional
Network Hub(s)
As Needed
A private network is recommended
Remote Access Hardware
As Needed
For testing slow-link and remote connections
Network Interface Cards
As Needed
100 MB Card
UPS
Optional
To protect the servers
Printer
Optional
To print configuration information and other tests
Notes:
•
An Intel processor–based server running Windows Server 2003 must have at least 128 megabytes (MB) of RAM. Microsoft also recommends that the server have several gigabytes of disk storage. In addition, servers should be equipped with high-speed network interface cards.
•
Use a sufficient number of workstations to simulate a variety of workstation environments, including your organization’s typical desktop, roaming user, mobile user, and any other configurations that may be appropriate. These computers must be capable of running Windows XP Professional. Microsoft recommends a minimum of 64 MB of RAM for Intel processor–based workstations.
•
When creating the physical infrastructure, a private network is recommended; therefore, you need sufficient network hubs and other networking hardware to connect all of the workstations and servers to a single network.
•
The most current information about hardware requirements and compatibility for servers is available at the Windows Server 2003 Product Compatibility Web site.
Additional Server Parameters
If you add additional servers to the common infrastructure, use the following server naming convention.
Parameter
Value
Computer Name(s)
HQ-CON-SRV-01HQ-CON-SRV-nn
Server Configuration
Overview
Figure 1 shows the basic server configuration.
Figure 1. The Server Configuration
Server Disk Configuration
To use a single server for the infrastructure in this guide, you will need a server with either two disk drives or a single disk drive with two partitions.
Note: Subsequent step-by-step guides in this series may require additional servers or other equipment; those additions are addressed in the specific guide.
The first disk or partition holds Windows Server 2003 and other files for the common infrastructure, such as the Windows Installer packages and application source files. The second disk or partition is reserved for Active Directory log files and procedures required by other step-by-step guides.
Each disk or partition must hold several gigabytes of information, and each disk or partition must be formatted for the NT file system (NTFS). The steps for creating and formatting partitions are contained in this guide.
Top of page
Server Installation
To begin the installation procedure, boot directly from the Windows Server 2003 CD. Your CD-ROM must support bootable CDs.
Note: When you configure partitions and format drives, all data on the server hard drive is destroyed.
Beginning the Installation
Setup creates the disk partitions on the computer running Windows Server 2003, formats the drive, and then copies installation files from the CD to the server.
Note: These instructions assume that you are installing Windows Server 2003 on a computer that is not already running Windows. If you are upgrading from an older version of Windows, some of the installation steps may differ.
To begin the installation
1.
Insert the Windows Server 2003 CD in the CD-ROM drive.
2.
Restart the computer. If prompted, press any key to boot from the CD.
The Windows Server 2003 installation begins.
3.
On the Welcome to Setup screen, press Enter.
4.
Review and, if acceptable, agree to the license agreement by pressing F8.
Note: If you had a previous version of Windows Server 2003 installed on this server, you might get a message asking if you want to repair the drive. Press Esc to continue and not repair the drive.
5.
Follow the instructions to delete all existing disk partitions. The exact steps will differ based on the number and type of partitions already on the computer. Continue to delete partitions until all disk space is labeled as Unpartitioned space.
6.
When all disk space is labeled as Unpartitioned space, press C to create a partition in the unpartitioned space on the first disk drive (as applicable).
7.
If your server has a single disk drive, split the available disk space in half to create two equal-sized partitions. Delete the total space default value. Type the value of half your total disk space at the Create partition of size (in MB) prompt, and the press Enter. (If your server has two disk drives, type the total size of the first drive at this prompt.)
8.
After the New
9.
Select Format the partition using the NTFS file system
Windows Server 2003 Setup formats the partition and then copies the files from the Windows Server 2003 Server CD to the hard drive. The computer restarts and the Windows Server 2003 Installation Program continues.
Completing the Installation
To continue the installation with the Windows Server 2003 Setup Wizard
1.
The Windows Server 2003 Setup Wizard detects and installs devices. This can take several minutes, and during the process your screen may flicker.
2.
In the Regional and Language Options dialog box, make changes required for your locale (typically, none are required for the United States), and then click Next.
3.
In the Personalize Your Software dialog, type Mike Nash in the Name box and type Reskit in the Organization box. Click Next.
4.
Type the Product Key (found on the back of your Windows Server 2003 CD case) in the text boxes provided, and then click Next.
5.
In the Licensing Modes dialog box, select the appropriate licensing mode for your organization, and then click Next.
6.
In the Computer Name and Administrator Password dialog box, type the new computer name HQ-CON-DC-01 in the computer name box, and then click Next.
Best Practice: To facilitate the steps in these guides, the Administrator password is left blank and there is no password. This is not an acceptable security practice. When installing a server for your production network, a password should always be set. Windows Server 2003 requires complex passwords by default.
7.
When prompted by Windows Setup, click Yes to confirm a blank Administrator password.
8.
In the Date and Time Settings dialog box, correct the current date and time if necessary, and then click Next.
9.
In the Networking Settings dialog box, make sure Typical Settings is selected, and then click Next.
10.
In the Workgroups or Computer Domain dialog box (No is selected by default), click Next.
Note: A domain name could be specified at this point, but this guide uses the Configure Your Server Wizard to create the domain name at a later time.
The Windows Server 2003 Installation continues and configures the necessary components. This may take a few minutes.
11.
The server restarts and the operating system loads from the hard drive.
Preparing a Secondary Partition or Secondary Disk Drive
The unpartitioned space from the installation of Windows Server 2003 requires formatting before it can be accessed by the operating system. Management of disks and partitions occurs through the Computer Management snap-in for Microsoft Management Console. The following steps assume a second disk drive is in use; modify procedures accordingly for a second partition.
To prepare a secondary partition or disk drive
Warning: Formatting a partition destroys all data on that partition. Make sure that you select the correct partition.
1.
Press Ctrl+Alt+Del and log on to the server as administrator. Leave the password blank.
2.
Click the Start button, point to Administrative Tools, and then click Computer Management.
3.
To define and format the unpartitioned space, click Disk Management.
4.
Right-click Unallocated on Disk 1.
5.
To define a partition, click New Partition, and then click Next to continue.
6.
Select Primary Partition (default), and then click Next to continue.
7.
Click Next leaving the Partition size in MB set to the default.
8.
For Assign the following drive letter, select L, and then click Next to continue.
9.
Under Format this partition with the following settings, click Perform a quick format. Click Next, and then Finish to complete the configuration of the secondary disk drive. Once you have finished, your disk allocation should look similar to Figure 2.
Figure 2. Disk Management
10.
Close the Computer Management console.
Configuring Your Server as a DHCP Server
Dynamic Host Configuration Protocol (DHCP) can be installed manually or by using the Windows Server 2003 Manage Your Server wizard. This section uses the wizard to complete the installation.
To install DHCP using the Windows Server 2003 Manage Your Server wizard
Warning: The following section will configure your server as a DHCP server. If this server resides on a production network, the server may distribute IP address information that might not be valid on the network. Microsoft recommends that these exercises be completed on an isolated network.
1.
Within the Manager Your Server page, click Add or remove a role.
Note: If you closed the Manage Your Server page you can start the Configure Your Server wizard from Administrative Tools. If you select this option the following steps may differ slightly.
2.
After the Configure Your Server wizard appears, click Next.
3.
Click Custom configuration, and then click Next.
4.
Under Server Role, click DHCP server, and then click Next.
5.
Review the Summary of Selections, and then click Next to begin the installation.
6.
When the New Scope Wizard appears, click Next to define a DHCP scope.
7.
For Name, type Contoso HQ. Leave the description blank, and then click Next.
8.
Enter a Start IP address of 10.0.0.10 and enter 10.0.0.254 for the End IP address. Click Next.
9.
Exclusions will not be defined at this time. Click Next to continue the installation.
10.
To accept the default Lease Duration, click Next.
11.
To set DHCP Options, click Next.
12.
On the Router (Default Gateway) screen, type 10.0.0.1 for IP address, click Add, and then click Next.
13.
For Parent Domain on the Domain Name and DNS Server screen, type contoso.com. For IP address, type 10.0.0.2, click Add, and then click Next.
14.
Click Next as WINS Servers will not be utilized in this environment.
15.
Click Next to Activate Scope.
16.
Click Finish twice.
17.
Close the Manage Your Server screen.
Configuring Your Server as a Domain Controller
Domain Name Service (DNS) and DCPromo (the command-line tool that creates DNS and Active Directory) can be installed manually or by using the Windows Server 2003 Manager Your Server Wizard. This section uses the manual tools to complete the installation.
To install DNS and Active Directory using the manual tools
1.
Click the Start button, click Run, type DCPROMO, and then click OK.
2.
When the Active Directory Installation Wizard appears, click Next to begin the installation.
3.
After reviewing the Operating System Compatibility information, click Next.
4.
Select Domain controller for a new domain (default), and then click Next.
5.
Select Domain in a new forest (default), and then click Next.
6.
For Full DNS name, type contoso.com, and then click Next. (This represents a Fully Qualified name.)
7.
Click Next to accept the default Domain NetBIOS name of CONTOSO. (NetBIOS names provides for down-level compatibility.)
8.
On the Database and Log Folders screen, point the Active Directory Log Folder to L:\Windows\NTDS, and then click Next to continue.
9.
Leave the default folder location for Shared System Volume, and then click Next.
10.
On the DNS Registration Diagnostics screen, click Install and configure the DNS server on this computer. Click Next to continue.
11.
Select Permissions compatible only with Windows 2000 or Windows Server 2003 (default), and then click Next.
12.
Type password for Restore Mode Password and Confirm password, and then click Next to continue.
Note: Production environments should employ complex passwords for Directory Services Restore passwords.
Figure 3. Summary of the Active Directory Installation Options
13.
Figure 3 represents a summary of the Active Directory installation options. Click Next to start the installation of Active Directory. If prompted, insert the Windows Server 2003 installation CD.
14.
Click OK to acknowledge the warning of having a dynamically assigned IP address for a DNS server.
15.
If you have more than one network interface, select the 10.0.0.0 network interface from the Choose Connection drop-down list, and then click Properties.
16.
Under the This connection uses the following items section, click Internet Protocol (TCP/IP), and then click Properties.
17.
Select Use the following IP address, and then type 10.0.0.2 for the IP address. Press the Tab key twice, and then type 10.0.0.1 for the Default gateway. Type 127.0.0.1 for the Preferred DNS server, and then click OK. Click Close to continue.
18.
Click Finish once the Active Directory Installation Wizard is finished.
19.
Click Restart Now to reboot the computer.
To authorize the DHCP server
1.
After the computer reboots, press Ctrl+Alt+Del and log on to the server as administrator@contoso.com. Leave the password blank.
2.
Click the Start menu, select Administrative Tools, and then click DHCP
3.
Click hq-con-dc-01.contoso.com. Right click hq-con-dc-01.contoso.com and then click Authorize
4.
Close the DHCP management console
Active Directory Sample Infrastructure
The common infrastructure is based on the fictitious organization Contoso. Contoso owns the DNS name contoso.com, which was configured with the Active Directory Installation Wizard in the preceding section. Figure 4 illustrates the sample Active Directory structure.
Figure 4. Sample Active Directory Structure
The most interesting aspects of this structure are the Domain (contoso.com); the Accounts, Headquarters, Production, Marketing, Groups, Resources, Desktops, Laptops, and Servers organizational units (OUs). These are represented by folders (book) in Figure 4. OUs exist for the delegation of administration and for the application of Group Policy—not simply to mirror a business organization. For an in-depth discussion on designing an OU structure, see "Designing and Deploying Directory and Security Services".
Populating Active Directory
This section describes how to manually create the OUs, Users, and Security Groups outlined in Appendix A.
Creating Organizational Units and Groups
To create OUs and Security Groups
1.
Click the Start button, point to All Programs, point to Administrative Tools, and then click Active Directory Users and Computers.
2.
Click the + next to contoso.com to expand it. Click contoso.com itself to show its contents in the right pane.
3.
In the left pane, right-click contoso.com, point to New, and then click Organizational Unit.
4.
Type Accounts in the name box, and then click OK.
5.
Repeat steps 3 and 4 to create the Groups and Resources OUs.
6.
Click Accounts in the left pane. Its contents now display in the right pane. (It is empty at the beginning of this procedure.)
7.
Right-click Accounts, point to New, and then click Organizational Unit.
8.
Type Headquarters, and then click OK.
9.
Repeat steps 7 and 8 to create the Production and Marketing OUs in Accounts. When you have finished, the OU structure should look like Figure 5.
Figure 5. Creating Organizational UnitsSee full-sized image
10.
In the same way, create Desktops, Laptops, and Servers in the Resources OU.
11.
Create the two security groups by right-clicking Groups, pointing to New, and then clicking Group. The two groups to add are Management and Non-management. The settings for each group should be Global and Security. Click OK to create each group. When all steps are completed, the final OU structure should look like Figure 6.
Figure 6. Final OU StructureSee full-sized image
Creating User Accounts
To create a user account
1.
In the left-hand pane, click Headquarters (in Accounts).. Its contents now display in the right pane. (It is empty at the beginning of this procedure.)
2.
Right-click Headquarters, point to New, and then click User.
3.
Type Christine for the first name and Koch for the last name. (Note that the full name automatically appears in the Full name box.)
4.
Type Christine for the User logon name. The window should look like Figure 7.
Figure 7. Adding a User
5.
Click Next.
6.
Type pass#word1 for Password and Confirm password, and then click Next to continue.
Note: By default, Windows Server 2003 requires complex passwords for all newly created users. Password complexity requirements may be disabled through Group Policy.
7.
Click Finish. Christine Koch now displays in the right-hand pane as a user under Reskit.com/Accounts/Headquarters.
8.
Repeat steps 2 through 7, adding the names listed in Appendix A for the Headquarters OU. When you are finished, the Headquarters OU screen should look like Figure 8.
Figure 8. User listing in the Headquarters OUSee full-sized image
9.
Repeat steps 1 through 8 to create the users in the Production and Marketing OUs.
Adding Users to Security Groups
To add a user to a security group
1.
In the left pane, click Groups.
2.
In the right pane, double-click the Management group.
3.
Click the Members tab, and then click Add.
4.
Click Advanced, and then click Find Now.
5.
Select all appropriate users from the lower section by holding down the Ctrl key while clicking each name. Click OK while all members are highlighted. (The users who should be members of this security group are listed in Appendix A.) Click OK again to add these members to the Management Security Group. Click OK to close the Management Security Group Properties sheet.
Figure 9. The Members of the Management Security Group Are Drawn from Three OUs
6.
Repeat steps 2 through 5 to add members to the Non-management group.
7.
Close the Active Directory Users and Computers snap-in.
Top of page
Appendix A: Active Directory Populace
Users
OU
Full Name
Login Name
Group Membership
Headquarters
Koch, Christine
Christine
Management
West, Paul
Paul
Management
Clark, Molly
Molly
Management
Sprenger, Christof
Christof
Management
Schleger, Yvonne
Yvonne
Management
Nash, Mike
Mike
Management
Brink, Monica
Monica
Non-management
Production
Ola, Preeda
Preeda
Management
Grande, Jon
Jon
Non-management
Hector, Clair
Clair
Non-management
Kim, Jim
Jim
Non-management
Nay, Lorraine
Lorraine
Management
Randall, Cynthia
Cynthia
Non-management
Browne, Kevin F.
Kevin
Non-management
Marketing
Fitzgerald, Charles
Charles
Management
Mustafa, Ahmad
Ahmad
Non-management
Narp, Sylvie
Sylvie
Non-management
Step-by-Step Guide to Building a Site-to-Site Virtual Private Network Connection
From : Microsoft
Step-by-Step Guide to Building a Site-to-Site Virtual Private Network Connection
This step-by-step guide provides guidance for building a Routing and Remote Access Services (RRAS) infrastructure supporting Site-to-Site Virtual Private Network (VPN) through demand-dial connections.
On This Page
Introduction
Overview
Configuring the Routing and Remote Access Service
Configuring Demand-Dial Interfaces
Extending Site-to-Site Security Through Remote Access Policies
Configuring for IPSec Shared Key and Testing the Connection
Additional Resources
Introduction
Step-by-Step Guides
The Windows Server 2003 Deployment step-by-step guides provide hands-on experience for many common operating system configurations. The guides begin by establishing a common network infrastructure through the installation of Windows Server 2003, the configuration of Active Directory®, the installation of a Windows XP Professional workstation, and finally the addition of this workstation to a domain. Subsequent step-by-step guides assume that you have this common network infrastructure in place. If you do not want to follow this common network infrastructure, you will need to make appropriate modifications while using these guides.
The common network infrastructure requires the completion of the following guides.
•
Part I: Installing Windows Server 2003 as a Domain Controller
•
Part II: Installing a Windows XP Professional Workstation and Connecting It to a Domain
Once the common network infrastructure is configured, any of the additional step-by-step guides may be employed. Note that some step-by-step guides may have additional prerequisites above and beyond the common network infrastructure requirements. Any additional requirements will be noted in the specific step-by-step guide.
Microsoft Virtual PC
The Windows Server 2003 Deployment step-by-step guides may be implemented within a physical lab environment or through virtualization technologies like Microsoft Virtual PC 2004 or Microsoft Virtual Server 2005. Virtual machine technology enables customers to run multiple operating systems concurrently on a single physical server. Virtual PC 2004 and Virtual Server 2005 are designed to increase operational efficiency in software testing and development, legacy application migration, and server consolidation scenarios.
The Windows Server 2003 Deployment step-by-step guides assume that all configurations will occur within a physical lab environment, although most configurations can be applied to a virtual environment without modification.
Applying the concepts provided in these step-by-step guides to a virtual environment is beyond the scope of this document.
Important Notes
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, places, or events is intended or should be inferred.
This common infrastructure is designed for use on a private network. The fictitious company name and Domain Name System (DNS) name used in the common infrastructure are not registered for use on the Internet. You should not use this name on a public network or Internet.
The Active Directory service structure for this common infrastructure is designed to show how Windows Server 2003 Change and Configuration Management works and functions with Active Directory. It was not designed as a model for configuring Active Directory for any organization.
Top of page
Overview
Many organizations have offices located in different geographical locations, requiring remote-site connectivity. You can use the Windows Server 2003 Routing and Remote Access Service (RRAS) to deploy a cost-effective and secure site-to-site solution.
Traditionally, organizations have used wide area network (WAN) site-to-site connection technologies, such as T-Carrier or Frame Relay, to connect remote sites across a private data network. However, these private lines are expensive. For example, the cost of T-Carrier services are based on both bandwidth and distance, which makes the connections relatively expensive. In addition, T-Carrier typically requires a dedicated infrastructure, including a Channel Service Unit/Data Service Unit (CSU/DSU) and line-specific routers at each end of the connection.
In contrast, you can integrate the Windows Server 2003 RRAS solution into your organization’s current network by using existing servers. With the site-to-site connections provided by the RRAS, you have two alternatives to conventional WAN links: a site-to-site dial-up connection or a site-to-site VPN connection. If you deploy a RRAS solution to replace an existing WAN connection, or to implement a new connection, you can optimize cost savings by tailoring your connection type to your traffic volume. You can also customize security to fit your organization’s requirements.
In a site-to-site deployment, RRAS allows demand-dial routing (also known as dial-on-demand routing). By using a demand-dial interface, the router can initiate a connection to a remote site when the packet to be routed is received by the router. The connection becomes active only when data is sent to the remote site. When no data has been sent over the link for a specified amount of time, the link is disconnected.
RRAS also includes support for demand-dial filters and dial-out hours. You can use demand-dial filters to specify what types of traffic are allowed to create the connection. Demand-dial filters are separate from Internet Protocol (IP) packet filters, which you configure to specify what traffic is allowed into and out of an interface once the connection is made. You can set dial-out hours to specify the hours that a router is allowed to dial out to make demand-dial connections. You can configure when the router accepts incoming connections through remote access policies.
Note: RRAS supports both site-to-site connections between remote offices and remote access connections for individual computers. This step-by-step guide focuses on the deployment of a site-to-site VPN connection using Internet Protocol Security (IPSec) with a shared key.
Prerequisites
•
Part 1: Installing Windows Server 2003 as a Domain Controller
•
Step by Step Guide to Setting Up Additional Domain Controllers
•
Step-by-Step Guide to Managing Active Directory
Guide Requirements
•
For the configuration of a site-to-site VPN solution, both the calling and answering routers must be configured as multi-homed servers. Accordingly, each server should have a secondary network interface card (NIC) available for use. For the procedures in this guide, the following settings are used for the secondary NIC.
•
HQ-CON-DC-01 - IP Address: 20.0.0.1, IP MASK: 255.0.0.0, Default Gateway: Blank, DNS Server: 127.0.0.1
•
HQ-CON-DC-02 - IP Address: 20.0.0.2, IP MASK: 255.0.0.0, Default Gateway: Blank, DNS Server: 127.0.0.1
•
To correctly simulate a site-to-site demand-dial connection, all machines under the child domain, vancouver, should be moved to a separate network, or, have a third network interface available for use. In the sections that follow, each machine in the vancouver child domain has been configured with a third network interface. Each interface is configured with a 30.0.0.0 network address. If you decide to physically segment the Vancouver domain, you should install and configure DNS on HQ-CON-DC-02.
Warning: The steps detailed in this guide provide a general overview of the configurations necessary to create a demand-dial site-to-site VPN connection using an IPSec shared key. Accordingly, this guide should only be implemented within a test environment. For more information about the planning and deployment of Windows Server 2003 VPNs, see Virtual Private Networks for Windows Server 2003.
Top of page
Configuring the Routing and Remote Access Service
When you run the Routing and Remote Access Server Setup Wizard, the wizard prompts you to choose the configuration path that most closely resembles the remote access solution that you want to deploy. If none of the wizard configuration paths meets your needs exactly, you can further configure your server after the wizard finishes, or you can choose the custom configuration path.
Although the immediate goal is the configuration of a secure connection between two private networks, additional guides in this series expand on the core functionality of RRAS through the inclusion of dial-up. Accordingly, in the sections that follow, RRAS will initially be configured as a VPN server while the site-to-site VPN will be configured manually.
Note: With a basic installation of Windows Server 2003, the components for RRAS are actually installed by default but not enabled or configured.
To enable and configure Routing and Remote Access Service on HQ-CON-DC-01
1.
Click the Start button, point to All Programs, select Administrative Tools, and then click Routing and Remote Access.
2.
On the Routing and Remote Access console, right-click HQ-CON-DC-01, and then click Configure and Enable Routing and Remote Access.
3.
On the Routing and Remote Access Server Setup Wizard screen, click Next.
4.
Click the Remote access (dial-up or VPN) radio button (default), and then click Next.
5.
Select the VPN check box as shown in Figure 1, and then click Next.
Figure 1. Selecting a Remote Access Method
6.
Under Network Interfaces, click to highlight the adapter representing the Internet connection on which this site-to-site VPN will operate. Leave the default selection of Enable Security, and then click Next.
7.
On the IP Address Assignment screen, leave the default setting of Automatically, and then click Next to continue.
Note: When configuring an RRAS server, you need to determine whether the remote access server will use Dynamic Host Configuration Protocol (DHCP) or a static IP address pool to obtain addresses for dial-up clients. If you use a static IP address pool, determine whether the pool will be ranges of addresses that are a subset of addresses from the IP network to which the server is attached, or a separate subnet. If the static IP address pool address ranges represent a different subnet, ensure that routes to the address ranges exist in the routers of your intranet so that traffic to connected remote access clients is forwarded to the remote access server.
8.
On the Managing Multiple Remote Access Servers screen, leave the default setting of No, use RRAS to authenticate authentication request, and then click Next.
Note: If you have more than one remote access server, rather than administer the remote access policies of all the remote access servers separately, you can configure a single server with the Internet Authentication Service (IAS) as a Remote Authentication Dial-In User Service (RADIUS) server and configure the remote access servers as RADIUS clients. The IAS server provides centralized remote access authentication, authorization, accounting, and auditing.
9.
On the Completing the Routing and Remote Access Server Setup Wizard screen, click Finish to complete the configuration of RRAS.
10.
In the Routing and Remote Access dialog box, shown in Figure 2, click OK to acknowledge DHCP Relay requirements.
Note: By default, the DHCP services provided by RRAS automatically handle all DHCP Relay requirements. In a scenario that includes a different DHCP server, you must ensure that the server is configured to relay DHCP requests.
Figure 2. DHCP RelaySee full-sized image
To enable and configure Routing and Remote Access Service on HQ-CON-DC-02
1.
Click the Start button, point to All Programs, select Administrative Tools, and then click Routing and Remote Access.
2.
On the Routing and Remote Access console, right-click HQ-CON-DC-02, and then click Configure and Enable Routing and Remote Access.
3.
On the Routing and Remote Access Server Setup Wizard screen, click Next.
4.
Click the Custom Configuration radio button, and then click Next.
5.
Click the Demand-dial connections (used for branch office routing) radio button, and then click Next.
6.
On the Completing the Routing and Remote Access Server Setup Wizard screen, click Finish to complete the configuration of RRAS.
7.
In the Routing and Remote Access dialog box, click Yes to start the RRAS service.
Top of page
Configuring Demand-Dial Interfaces
Network interfaces enable any server running RRAS to communicate with other computers over private or public networks. Network interfaces have two aspects that relate to Routing and Remote Access: the physical hardware, such as a network adapter, and the network interface configuration.
In Routing and Remote Access, network interfaces fall into the following categories.
•
Private interface A private interface is a network adapter that is physically connected to a private network. Most private networks are configured with a private network IP address range, and the private interface is also configured with a private address. Because a private network is, in theory, composed of known users and computers, you generally have fewer security considerations for a private interface than for a public interface.
•
Public interface A public interface is a network adapter that is physically connected to a public network, such as the Internet. The public interface is configured with a public IP address. You can configure a public interface to perform network address translation (NAT). Because a public interface is theoretically accessible by anyone on the public network, security considerations are generally higher for a public interface than for a private interface.
•
Demand-dial interface Demand-dial interfaces connect specific routers on either public or private networks. A demand-dial interface can be either on-demand (activated only when needed) or persistent (always connected).
In addition to configuring each network interface as a public, private, or demand-dial interface, you can configure packet filters, addresses, and other options for network interfaces. Some options for public interfaces, such as Basic Firewall, are not available for private interfaces.
To configure a demand-dial interface on the Answering Server (HQ-CON-DC-01)
1.
On the Routing and Remote Access console, click the plus sign (+) next to HQ-CON-DC-01 to expand the tree.
2.
Under the HQ-CON-DC-01 tree, right-click Network Interfaces, and then click New Demand-dial Interface.
3.
On the Welcome to the Demand-Dial Interface Wizard, click Next to begin the configuration.
4.
For the Interface Name, type VPN_Vancouver, and then click Next.
5.
For the Connection Type, leave the default setting of Connect using virtual private networking, and then click Next.
6.
On the VPN Type screen, select Layer 2 Tunneling Protocol (L2TP) as shown in Figure 3, and then click Next.
Figure 3. Selecting the VPN Type
7.
On the Destination Address screen, type 20.0.0.2 for Host name or IP address, and then click Next.
8.
On the Protocols and Security screen, select both Route IP packets on this interface and Add a user account so a remote router can dial-in, and then click Next.
9.
On the Static Routes for Remote Networks screen, click Add. Type 30.0.0.0 for Destination and 255.0.0.0 for Network Mask, click OK, and then click Next.
Note: The previous step assumes that the vancouver domain has been reconfigured to reside on a 30.0.0.0 network.
10.
On the Dial-in Credentials screen, type pass#word1 for both Password and Confirm Password, and then click Next.
11.
On the Dial-Out Credentials screen, type VPN_HQ for the User name, type VANCOUVER for the Domain, and type pass#word1 for both Password and Confirm Password. When completed, configurations should appear as shown in Figure 4. Click Next to continue.
Figure 4. Setting Dial-Out Credentials on HQ-CON-DC-01
12.
On the Completing the Demand–Dial Interface Wizard, click Finish.
To configure a demand-dial interface on the Calling Server (HQ-CON-DC-02)
1.
On the Routing and Remote Access console, click the plus sign (+) next to HQ-CON-DC-02 to expand the tree.
2.
Under the HQ-CON-DC-02 tree, right-click Network Interfaces, and then click New Demand-dial Interface.
3.
On the Welcome to the Demand-Dial Interface Wizard, click Next to begin the configuration.
4.
For the Interface Name, type VPN_HQ, and then click Next.
5.
For the Connection Type, leave the default setting of Connect using virtual private networking, and then click Next.
6.
On the VPN Type screen, select Layer 2 Tunneling Protocol (L2TP) as shown in Figure 3, and then click Next.
7.
On the Destination Address screen, type 20.0.0.1 for Host name or IP address, and then click Next.
8.
On the Protocols and Security screen, select both Route IP packets on this interface and Add a user account so a remote router can dial-in, and then click Next.
9.
On the Static Routes for Remote Networks screen, click Add. Type 10.0.0.0 for Destination and 255.0.0.0 for Network Mask, click OK, and then click Next.
Note: The previous step assumes that the contoso root domain still resides on the 10.0.0.0 network.
10.
On the Dial-in Credentials screen, type pass#word1 for both Password and Confirm Password, and then click Next.
11.
On the Dial-Out Credentials screen, type VPN_Vancouver for the User name, type CONTOSO for the Domain, and type pass#word1 for both Password and Confirm password. When completed, configurations should appear as shown in Figure 5.
Figure 5. Setting the Dial-Out Credentials on HQ-CON-DC-02
12.
Click Next to continue.
13.
On the Completing the Demand–Dial Interface Wizard, click Finish.
Top of page
Extending Site-to-Site Security Through Remote Access Policies
For RRAS in Windows Server 2003, network access authorization is granted on the basis of user account dial-in properties and remote access policies.
Remote access policies are an ordered set of rules that define how connections are either authorized or rejected. For each rule, there are one or more conditions, a set of profile settings, and a remote access permission setting. If a connection is authorized, the remote access policy profile specifies a set of connection restrictions. The dial-in properties of the user account also provide a set of restrictions. Where applicable, user account connection restrictions override the remote access policy profile connection restrictions.
There are two ways to use remote access policies to grant authorization.
•
By user If you are managing authorization by user, set the remote access permission on the user or computer account to either Grant access or Deny access and, optionally, create different remote access policies based on different types of connections. For example, you might want to have one remote access policy that is used for dial-up connections and a different remote access policy that is used for wireless connections. Managing authorization by user is recommended only when you have a small number of user or computer accounts to manage.
•
By group If you are managing authorization by group, set the remote access permission on the user account to Control access through Remote Access Policy and create remote access policies that are based on different types of connections and group membership. For example, you might want to have one remote access policy for dial-up connections for employees (members of the Employees group) and a different remote access policy for dial-up connections for contractors (members of the Contractors group).
Remote access policy conditions are one or more attributes that are compared to the settings of the connection attempt. If multiple conditions exist, all the conditions must match the settings of the connection attempt for it to match the policy. If all conditions of a remote access policy are met, remote access permission is either granted or denied. You can use either the Grant remote access permission option or the Deny remote access permission option to set remote access permission for a policy.
In the following sections, remote access policies will be configured to grant authorization by group.
To prepare remote access policies to grant authorization by group
1.
On server HQ-CON-DC-01, open the Active Directory Users and Computers console.
2.
On the Active Directory Users and Computers console, click the plus sign (+) next to contoso.com to expand the tree.
3.
Under the contoso.com tree, click the Users Organization Unit (OU). In the results pane, double-click VPN_Vancouver.
4.
On the VPN_Vancouver Properties sheet, click the Dial-in tab.
5.
In the Remote Access Permissions section, click Control access through Remote Access Policy as shown in Figure 6.
Figure 6. Forcing Remote Access Permissions Through RRAS Policies
6.
On the VPN_Vancouver Properties sheet, click OK.
7.
Under the contoso.com tree, click the Groups OU, right-click the Groups OU, select New, and then click Group.
8.
On the New Object – Group screen, type Branch Office VPN for Group name, and then click OK.
9.
In the results pane, double-click Branch Office VPN. On the Branch Office VPN Properties screen, click the Members tab. Click Add, type VPN_Vancouver, and then click OK twice.
10.
Close the Active Directory Users and Computers console.
To configure a remote access policy to grant authorization by group
1.
In the Routing and Remote Access console, click Remote Access Policies.
2.
In the results pane, double-click Connection to Microsoft Routing and Remote Access server.
3.
Under Policy Conditions, click Add. Double-click Windows-Groups, click Add, type Branch Office VPN, and then click OK twice.
4.
On the bottom of the Properties sheet, click Grant remote access permission, and then click OK.
Top of page
Configuring for IPSec Shared Key and Testing the Connection
By default, both the L2TP client and L2TP server for Windows Server 2003 are pre-configured for certificate-based IPSec authentication. When you make an L2TP over IPSec connection, an IPSec policy is automatically created to specify that the Internet Key Exchange (IKE) will use certificate-based authentication during the negotiation of security settings for L2TP. This means that both the L2TP client and L2TP server must have a computer certificate (also known as a machine certificate) installed before a successful L2TP over IPSec connection can be established. Both computer certificates must be from the same certificate authority (CA) or the root certificate of each computer's CA must be installed as a trusted root CA in each other's trusted root certificate store.
In some cases, a certificate-based IPSec authentication method is not desired for L2TP-based router-to-router VPN connections. In these cases, you can manually configure IPSec policy to use pre-shared keys when creating router-to-router VPN connections. This pre-shared authentication key acts like a simple password in the IKE negotiation. If both sides can prove they know the same password, then they trust each other and will continue to negotiate private, symmetric encryption keys, and specific security settings for L2TP traffic.
Using an IKE pre-shared key is generally considered not as secure as using certificates because the IKE authentication (and implicit trust) is dependent on the key value only, which is stored in plain-text format in the IPSec policy. Anyone who views the policy can see the pre-shared key value. If a malicious user views the pre-shared key, then they could configure their system to successfully establish IPSec security with your system. However, the L2TP connection requires user-level authentication using a Point-to-Point Protocol (PPP). Therefore, a malicious user would have to know both the pre-shared key and the proper user credentials to successfully establish the L2TP over IPSec connection.
To configure an IPSec shared key on the answering server (HQ-CON-DC-01)
1.
On the Routing and Remote Access console, right-click HQ-CON-DC-01 (local), and the click Properties.
2.
On the HQ-CON-DC-01 (local) Properties sheet, click the Security tab. Select Allow custom IPSec policy for L2TP connection, type 12345 for Pre-shared Key as shown in Figure 7, and then click OK.
Figure 7. Setting a Pre-Shared Key on the Answering Router
To configure an IPSec shared key on the calling server (HQ-CON-DC-02)
1.
On the Routing and Remote Access console, under the HQ-CON-DC-02 (local) tree, click Network Interfaces, and then double-click VPN_HQ.
2.
On the VPN_HQ Properties page, click the Security tab, and then click the IPSec Settings button.
3.
In the IPSec Settings dialog box, select Use pre-shared key for authentication, type 12345 for Key as shown in Figure 8, and then click OK twice.
Figure 8. Setting a Pre-Shared Key on the Calling Router
To test the Site-to-Site VPN connection
•
On the Routing and Remote Access console, right-click VPN_HQ, and then click Connect
Step-by-Step Guide to Building a Site-to-Site Virtual Private Network Connection
This step-by-step guide provides guidance for building a Routing and Remote Access Services (RRAS) infrastructure supporting Site-to-Site Virtual Private Network (VPN) through demand-dial connections.
On This Page
Introduction
Overview
Configuring the Routing and Remote Access Service
Configuring Demand-Dial Interfaces
Extending Site-to-Site Security Through Remote Access Policies
Configuring for IPSec Shared Key and Testing the Connection
Additional Resources
Introduction
Step-by-Step Guides
The Windows Server 2003 Deployment step-by-step guides provide hands-on experience for many common operating system configurations. The guides begin by establishing a common network infrastructure through the installation of Windows Server 2003, the configuration of Active Directory®, the installation of a Windows XP Professional workstation, and finally the addition of this workstation to a domain. Subsequent step-by-step guides assume that you have this common network infrastructure in place. If you do not want to follow this common network infrastructure, you will need to make appropriate modifications while using these guides.
The common network infrastructure requires the completion of the following guides.
•
Part I: Installing Windows Server 2003 as a Domain Controller
•
Part II: Installing a Windows XP Professional Workstation and Connecting It to a Domain
Once the common network infrastructure is configured, any of the additional step-by-step guides may be employed. Note that some step-by-step guides may have additional prerequisites above and beyond the common network infrastructure requirements. Any additional requirements will be noted in the specific step-by-step guide.
Microsoft Virtual PC
The Windows Server 2003 Deployment step-by-step guides may be implemented within a physical lab environment or through virtualization technologies like Microsoft Virtual PC 2004 or Microsoft Virtual Server 2005. Virtual machine technology enables customers to run multiple operating systems concurrently on a single physical server. Virtual PC 2004 and Virtual Server 2005 are designed to increase operational efficiency in software testing and development, legacy application migration, and server consolidation scenarios.
The Windows Server 2003 Deployment step-by-step guides assume that all configurations will occur within a physical lab environment, although most configurations can be applied to a virtual environment without modification.
Applying the concepts provided in these step-by-step guides to a virtual environment is beyond the scope of this document.
Important Notes
The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, places, or events is intended or should be inferred.
This common infrastructure is designed for use on a private network. The fictitious company name and Domain Name System (DNS) name used in the common infrastructure are not registered for use on the Internet. You should not use this name on a public network or Internet.
The Active Directory service structure for this common infrastructure is designed to show how Windows Server 2003 Change and Configuration Management works and functions with Active Directory. It was not designed as a model for configuring Active Directory for any organization.
Top of page
Overview
Many organizations have offices located in different geographical locations, requiring remote-site connectivity. You can use the Windows Server 2003 Routing and Remote Access Service (RRAS) to deploy a cost-effective and secure site-to-site solution.
Traditionally, organizations have used wide area network (WAN) site-to-site connection technologies, such as T-Carrier or Frame Relay, to connect remote sites across a private data network. However, these private lines are expensive. For example, the cost of T-Carrier services are based on both bandwidth and distance, which makes the connections relatively expensive. In addition, T-Carrier typically requires a dedicated infrastructure, including a Channel Service Unit/Data Service Unit (CSU/DSU) and line-specific routers at each end of the connection.
In contrast, you can integrate the Windows Server 2003 RRAS solution into your organization’s current network by using existing servers. With the site-to-site connections provided by the RRAS, you have two alternatives to conventional WAN links: a site-to-site dial-up connection or a site-to-site VPN connection. If you deploy a RRAS solution to replace an existing WAN connection, or to implement a new connection, you can optimize cost savings by tailoring your connection type to your traffic volume. You can also customize security to fit your organization’s requirements.
In a site-to-site deployment, RRAS allows demand-dial routing (also known as dial-on-demand routing). By using a demand-dial interface, the router can initiate a connection to a remote site when the packet to be routed is received by the router. The connection becomes active only when data is sent to the remote site. When no data has been sent over the link for a specified amount of time, the link is disconnected.
RRAS also includes support for demand-dial filters and dial-out hours. You can use demand-dial filters to specify what types of traffic are allowed to create the connection. Demand-dial filters are separate from Internet Protocol (IP) packet filters, which you configure to specify what traffic is allowed into and out of an interface once the connection is made. You can set dial-out hours to specify the hours that a router is allowed to dial out to make demand-dial connections. You can configure when the router accepts incoming connections through remote access policies.
Note: RRAS supports both site-to-site connections between remote offices and remote access connections for individual computers. This step-by-step guide focuses on the deployment of a site-to-site VPN connection using Internet Protocol Security (IPSec) with a shared key.
Prerequisites
•
Part 1: Installing Windows Server 2003 as a Domain Controller
•
Step by Step Guide to Setting Up Additional Domain Controllers
•
Step-by-Step Guide to Managing Active Directory
Guide Requirements
•
For the configuration of a site-to-site VPN solution, both the calling and answering routers must be configured as multi-homed servers. Accordingly, each server should have a secondary network interface card (NIC) available for use. For the procedures in this guide, the following settings are used for the secondary NIC.
•
HQ-CON-DC-01 - IP Address: 20.0.0.1, IP MASK: 255.0.0.0, Default Gateway: Blank, DNS Server: 127.0.0.1
•
HQ-CON-DC-02 - IP Address: 20.0.0.2, IP MASK: 255.0.0.0, Default Gateway: Blank, DNS Server: 127.0.0.1
•
To correctly simulate a site-to-site demand-dial connection, all machines under the child domain, vancouver, should be moved to a separate network, or, have a third network interface available for use. In the sections that follow, each machine in the vancouver child domain has been configured with a third network interface. Each interface is configured with a 30.0.0.0 network address. If you decide to physically segment the Vancouver domain, you should install and configure DNS on HQ-CON-DC-02.
Warning: The steps detailed in this guide provide a general overview of the configurations necessary to create a demand-dial site-to-site VPN connection using an IPSec shared key. Accordingly, this guide should only be implemented within a test environment. For more information about the planning and deployment of Windows Server 2003 VPNs, see Virtual Private Networks for Windows Server 2003.
Top of page
Configuring the Routing and Remote Access Service
When you run the Routing and Remote Access Server Setup Wizard, the wizard prompts you to choose the configuration path that most closely resembles the remote access solution that you want to deploy. If none of the wizard configuration paths meets your needs exactly, you can further configure your server after the wizard finishes, or you can choose the custom configuration path.
Although the immediate goal is the configuration of a secure connection between two private networks, additional guides in this series expand on the core functionality of RRAS through the inclusion of dial-up. Accordingly, in the sections that follow, RRAS will initially be configured as a VPN server while the site-to-site VPN will be configured manually.
Note: With a basic installation of Windows Server 2003, the components for RRAS are actually installed by default but not enabled or configured.
To enable and configure Routing and Remote Access Service on HQ-CON-DC-01
1.
Click the Start button, point to All Programs, select Administrative Tools, and then click Routing and Remote Access.
2.
On the Routing and Remote Access console, right-click HQ-CON-DC-01, and then click Configure and Enable Routing and Remote Access.
3.
On the Routing and Remote Access Server Setup Wizard screen, click Next.
4.
Click the Remote access (dial-up or VPN) radio button (default), and then click Next.
5.
Select the VPN check box as shown in Figure 1, and then click Next.
Figure 1. Selecting a Remote Access Method
6.
Under Network Interfaces, click to highlight the adapter representing the Internet connection on which this site-to-site VPN will operate. Leave the default selection of Enable Security, and then click Next.
7.
On the IP Address Assignment screen, leave the default setting of Automatically, and then click Next to continue.
Note: When configuring an RRAS server, you need to determine whether the remote access server will use Dynamic Host Configuration Protocol (DHCP) or a static IP address pool to obtain addresses for dial-up clients. If you use a static IP address pool, determine whether the pool will be ranges of addresses that are a subset of addresses from the IP network to which the server is attached, or a separate subnet. If the static IP address pool address ranges represent a different subnet, ensure that routes to the address ranges exist in the routers of your intranet so that traffic to connected remote access clients is forwarded to the remote access server.
8.
On the Managing Multiple Remote Access Servers screen, leave the default setting of No, use RRAS to authenticate authentication request, and then click Next.
Note: If you have more than one remote access server, rather than administer the remote access policies of all the remote access servers separately, you can configure a single server with the Internet Authentication Service (IAS) as a Remote Authentication Dial-In User Service (RADIUS) server and configure the remote access servers as RADIUS clients. The IAS server provides centralized remote access authentication, authorization, accounting, and auditing.
9.
On the Completing the Routing and Remote Access Server Setup Wizard screen, click Finish to complete the configuration of RRAS.
10.
In the Routing and Remote Access dialog box, shown in Figure 2, click OK to acknowledge DHCP Relay requirements.
Note: By default, the DHCP services provided by RRAS automatically handle all DHCP Relay requirements. In a scenario that includes a different DHCP server, you must ensure that the server is configured to relay DHCP requests.
Figure 2. DHCP RelaySee full-sized image
To enable and configure Routing and Remote Access Service on HQ-CON-DC-02
1.
Click the Start button, point to All Programs, select Administrative Tools, and then click Routing and Remote Access.
2.
On the Routing and Remote Access console, right-click HQ-CON-DC-02, and then click Configure and Enable Routing and Remote Access.
3.
On the Routing and Remote Access Server Setup Wizard screen, click Next.
4.
Click the Custom Configuration radio button, and then click Next.
5.
Click the Demand-dial connections (used for branch office routing) radio button, and then click Next.
6.
On the Completing the Routing and Remote Access Server Setup Wizard screen, click Finish to complete the configuration of RRAS.
7.
In the Routing and Remote Access dialog box, click Yes to start the RRAS service.
Top of page
Configuring Demand-Dial Interfaces
Network interfaces enable any server running RRAS to communicate with other computers over private or public networks. Network interfaces have two aspects that relate to Routing and Remote Access: the physical hardware, such as a network adapter, and the network interface configuration.
In Routing and Remote Access, network interfaces fall into the following categories.
•
Private interface A private interface is a network adapter that is physically connected to a private network. Most private networks are configured with a private network IP address range, and the private interface is also configured with a private address. Because a private network is, in theory, composed of known users and computers, you generally have fewer security considerations for a private interface than for a public interface.
•
Public interface A public interface is a network adapter that is physically connected to a public network, such as the Internet. The public interface is configured with a public IP address. You can configure a public interface to perform network address translation (NAT). Because a public interface is theoretically accessible by anyone on the public network, security considerations are generally higher for a public interface than for a private interface.
•
Demand-dial interface Demand-dial interfaces connect specific routers on either public or private networks. A demand-dial interface can be either on-demand (activated only when needed) or persistent (always connected).
In addition to configuring each network interface as a public, private, or demand-dial interface, you can configure packet filters, addresses, and other options for network interfaces. Some options for public interfaces, such as Basic Firewall, are not available for private interfaces.
To configure a demand-dial interface on the Answering Server (HQ-CON-DC-01)
1.
On the Routing and Remote Access console, click the plus sign (+) next to HQ-CON-DC-01 to expand the tree.
2.
Under the HQ-CON-DC-01 tree, right-click Network Interfaces, and then click New Demand-dial Interface.
3.
On the Welcome to the Demand-Dial Interface Wizard, click Next to begin the configuration.
4.
For the Interface Name, type VPN_Vancouver, and then click Next.
5.
For the Connection Type, leave the default setting of Connect using virtual private networking, and then click Next.
6.
On the VPN Type screen, select Layer 2 Tunneling Protocol (L2TP) as shown in Figure 3, and then click Next.
Figure 3. Selecting the VPN Type
7.
On the Destination Address screen, type 20.0.0.2 for Host name or IP address, and then click Next.
8.
On the Protocols and Security screen, select both Route IP packets on this interface and Add a user account so a remote router can dial-in, and then click Next.
9.
On the Static Routes for Remote Networks screen, click Add. Type 30.0.0.0 for Destination and 255.0.0.0 for Network Mask, click OK, and then click Next.
Note: The previous step assumes that the vancouver domain has been reconfigured to reside on a 30.0.0.0 network.
10.
On the Dial-in Credentials screen, type pass#word1 for both Password and Confirm Password, and then click Next.
11.
On the Dial-Out Credentials screen, type VPN_HQ for the User name, type VANCOUVER for the Domain, and type pass#word1 for both Password and Confirm Password. When completed, configurations should appear as shown in Figure 4. Click Next to continue.
Figure 4. Setting Dial-Out Credentials on HQ-CON-DC-01
12.
On the Completing the Demand–Dial Interface Wizard, click Finish.
To configure a demand-dial interface on the Calling Server (HQ-CON-DC-02)
1.
On the Routing and Remote Access console, click the plus sign (+) next to HQ-CON-DC-02 to expand the tree.
2.
Under the HQ-CON-DC-02 tree, right-click Network Interfaces, and then click New Demand-dial Interface.
3.
On the Welcome to the Demand-Dial Interface Wizard, click Next to begin the configuration.
4.
For the Interface Name, type VPN_HQ, and then click Next.
5.
For the Connection Type, leave the default setting of Connect using virtual private networking, and then click Next.
6.
On the VPN Type screen, select Layer 2 Tunneling Protocol (L2TP) as shown in Figure 3, and then click Next.
7.
On the Destination Address screen, type 20.0.0.1 for Host name or IP address, and then click Next.
8.
On the Protocols and Security screen, select both Route IP packets on this interface and Add a user account so a remote router can dial-in, and then click Next.
9.
On the Static Routes for Remote Networks screen, click Add. Type 10.0.0.0 for Destination and 255.0.0.0 for Network Mask, click OK, and then click Next.
Note: The previous step assumes that the contoso root domain still resides on the 10.0.0.0 network.
10.
On the Dial-in Credentials screen, type pass#word1 for both Password and Confirm Password, and then click Next.
11.
On the Dial-Out Credentials screen, type VPN_Vancouver for the User name, type CONTOSO for the Domain, and type pass#word1 for both Password and Confirm password. When completed, configurations should appear as shown in Figure 5.
Figure 5. Setting the Dial-Out Credentials on HQ-CON-DC-02
12.
Click Next to continue.
13.
On the Completing the Demand–Dial Interface Wizard, click Finish.
Top of page
Extending Site-to-Site Security Through Remote Access Policies
For RRAS in Windows Server 2003, network access authorization is granted on the basis of user account dial-in properties and remote access policies.
Remote access policies are an ordered set of rules that define how connections are either authorized or rejected. For each rule, there are one or more conditions, a set of profile settings, and a remote access permission setting. If a connection is authorized, the remote access policy profile specifies a set of connection restrictions. The dial-in properties of the user account also provide a set of restrictions. Where applicable, user account connection restrictions override the remote access policy profile connection restrictions.
There are two ways to use remote access policies to grant authorization.
•
By user If you are managing authorization by user, set the remote access permission on the user or computer account to either Grant access or Deny access and, optionally, create different remote access policies based on different types of connections. For example, you might want to have one remote access policy that is used for dial-up connections and a different remote access policy that is used for wireless connections. Managing authorization by user is recommended only when you have a small number of user or computer accounts to manage.
•
By group If you are managing authorization by group, set the remote access permission on the user account to Control access through Remote Access Policy and create remote access policies that are based on different types of connections and group membership. For example, you might want to have one remote access policy for dial-up connections for employees (members of the Employees group) and a different remote access policy for dial-up connections for contractors (members of the Contractors group).
Remote access policy conditions are one or more attributes that are compared to the settings of the connection attempt. If multiple conditions exist, all the conditions must match the settings of the connection attempt for it to match the policy. If all conditions of a remote access policy are met, remote access permission is either granted or denied. You can use either the Grant remote access permission option or the Deny remote access permission option to set remote access permission for a policy.
In the following sections, remote access policies will be configured to grant authorization by group.
To prepare remote access policies to grant authorization by group
1.
On server HQ-CON-DC-01, open the Active Directory Users and Computers console.
2.
On the Active Directory Users and Computers console, click the plus sign (+) next to contoso.com to expand the tree.
3.
Under the contoso.com tree, click the Users Organization Unit (OU). In the results pane, double-click VPN_Vancouver.
4.
On the VPN_Vancouver Properties sheet, click the Dial-in tab.
5.
In the Remote Access Permissions section, click Control access through Remote Access Policy as shown in Figure 6.
Figure 6. Forcing Remote Access Permissions Through RRAS Policies
6.
On the VPN_Vancouver Properties sheet, click OK.
7.
Under the contoso.com tree, click the Groups OU, right-click the Groups OU, select New, and then click Group.
8.
On the New Object – Group screen, type Branch Office VPN for Group name, and then click OK.
9.
In the results pane, double-click Branch Office VPN. On the Branch Office VPN Properties screen, click the Members tab. Click Add, type VPN_Vancouver, and then click OK twice.
10.
Close the Active Directory Users and Computers console.
To configure a remote access policy to grant authorization by group
1.
In the Routing and Remote Access console, click Remote Access Policies.
2.
In the results pane, double-click Connection to Microsoft Routing and Remote Access server.
3.
Under Policy Conditions, click Add. Double-click Windows-Groups, click Add, type Branch Office VPN, and then click OK twice.
4.
On the bottom of the Properties sheet, click Grant remote access permission, and then click OK.
Top of page
Configuring for IPSec Shared Key and Testing the Connection
By default, both the L2TP client and L2TP server for Windows Server 2003 are pre-configured for certificate-based IPSec authentication. When you make an L2TP over IPSec connection, an IPSec policy is automatically created to specify that the Internet Key Exchange (IKE) will use certificate-based authentication during the negotiation of security settings for L2TP. This means that both the L2TP client and L2TP server must have a computer certificate (also known as a machine certificate) installed before a successful L2TP over IPSec connection can be established. Both computer certificates must be from the same certificate authority (CA) or the root certificate of each computer's CA must be installed as a trusted root CA in each other's trusted root certificate store.
In some cases, a certificate-based IPSec authentication method is not desired for L2TP-based router-to-router VPN connections. In these cases, you can manually configure IPSec policy to use pre-shared keys when creating router-to-router VPN connections. This pre-shared authentication key acts like a simple password in the IKE negotiation. If both sides can prove they know the same password, then they trust each other and will continue to negotiate private, symmetric encryption keys, and specific security settings for L2TP traffic.
Using an IKE pre-shared key is generally considered not as secure as using certificates because the IKE authentication (and implicit trust) is dependent on the key value only, which is stored in plain-text format in the IPSec policy. Anyone who views the policy can see the pre-shared key value. If a malicious user views the pre-shared key, then they could configure their system to successfully establish IPSec security with your system. However, the L2TP connection requires user-level authentication using a Point-to-Point Protocol (PPP). Therefore, a malicious user would have to know both the pre-shared key and the proper user credentials to successfully establish the L2TP over IPSec connection.
To configure an IPSec shared key on the answering server (HQ-CON-DC-01)
1.
On the Routing and Remote Access console, right-click HQ-CON-DC-01 (local), and the click Properties.
2.
On the HQ-CON-DC-01 (local) Properties sheet, click the Security tab. Select Allow custom IPSec policy for L2TP connection, type 12345 for Pre-shared Key as shown in Figure 7, and then click OK.
Figure 7. Setting a Pre-Shared Key on the Answering Router
To configure an IPSec shared key on the calling server (HQ-CON-DC-02)
1.
On the Routing and Remote Access console, under the HQ-CON-DC-02 (local) tree, click Network Interfaces, and then double-click VPN_HQ.
2.
On the VPN_HQ Properties page, click the Security tab, and then click the IPSec Settings button.
3.
In the IPSec Settings dialog box, select Use pre-shared key for authentication, type 12345 for Key as shown in Figure 8, and then click OK twice.
Figure 8. Setting a Pre-Shared Key on the Calling Router
To test the Site-to-Site VPN connection
•
On the Routing and Remote Access console, right-click VPN_HQ, and then click Connect
Saturday, June 16, 2007
New life
Welcome to namslump's site
Night to meet everybody
.................................. namslump
Night to meet everybody
.................................. namslump
Subscribe to:
Comments (Atom)