70-741 MIDTERM

Which records are automatically created when you create a zone?

-SOA

-NS

Start of Authority (SOA) record

Specifies authoritative information about a DNS zone, including the primary name server, the email of the domain administrator, the domain serial number, and the expiration and reload timers of the zone

Name Server (NS) record

Specifies an authoritative name server for the host

The Canonical Name (CNAME) resource record

an alias for a host name. It is used to hide the implementation details of your network from the clients that connect to it, particularly if you need to make changes in the future.

Minimum TTL

Specifies a default TTL value, which defines the default time a resource record remains in a DNS cache after a DNS query has retrieved a record.

If you type nslookup without any parameters

you start nslookup.exe in interactive mode.

A better approach to static IP address assignment

dynamically assign TCP/IP configurations from a central pool of IP addresses using the DHCP server. can also be config to provide the default gateway, primary, and secondary DNS information; WINS server; and DNS

domain name.

What happens with DHCP‐enabled clients (DORA)

1. Discovery: client broadcasts request for an IP address.

2. Offer: Any DHCP servers that receive the request review their pool of IP addresses (DHCP scope) and select one to offer to the client.

3. Request: The client reviews the offers and broadcasts a message to the servers, letting them know which IP address it has accepted.

4. Acknowledge: All DHCP servers see the message. Those whose offers are not accepted place the IP address back into their pool for a future client request. The server the client accepted acknowledges and provides additional information to complete the client configuration (default gateway, DNS information, and so on).

On the Lease Duration page, specify the length of the leases for the addresses in the scope. The default lease duration is set to:

8 days.

DHCP scopes

A range of IP addresses that can be allocated to clients. consists of a name and description, a range of addresses, and a subnet mask.

To ease allocation - define excluded IP addresses.

can specify the duration of the IP address leases. By the end of the lease, renewed or released.

After a scope is created, the scope has to be activated before it can allocate addresses.

DHCP client reservations

allow admins to reserve an IP address for permanent

use by a DHCP client.

- ensure that the host will always have the same IP address.

- also receives all assigned options, (addresses of the default gateway and DNS servers.) If changed, they are automatically updated on the client when the lease is renewed.

Engine used by DHCP database

Microsoft Jet Database Engine, which is stored in the %systemroot%\System32\Dhcp folder.

A DHCP policy consists of conditions and settings. A condition allows you to identify and group clients based on whether a specified criteria is equal or not equal to a specified value. The criteria include:

• MAC address

• Vendor class

• User class

• Client identifier

• Relay Agent information, such as remote ID, circuit ID, and subscriber ID

Class D addresses

are defined from 224.0.0.0 to 239.255.255.255 and are used for multicast addresses.

Split scopes

Uses two DHCP servers to assign IP addresses. 80% on the primary server, and 20% to a secondary server.

When the primary server is down, the secondary server can assign IP addresses long enough to fix or replace the primary server.

DHCP uses to listen for failover traffic.

TCP port 647

Though backups occur automatically, every 60 minutes by default, it is beneficial to

take a manual backup and store it in a safe location prior to any changes to a DHCP production environment.

Load Sharing

Both servers simultaneously supply IP configuration to clients. By default, the load is distributed evenly, 50:50. However, you can adjust the ratio if you prefer one server to another. This is the default mode.

IP address block

The highest‐level conceptual entities in an IP address space.

-Marked with a starting and ending IP address.

-For public IP addresses, *THIS* is assigned by the Internet Registry or ISP.

-Network administrators split address blocks into address ranges, which is the basis of DHCP scopes.

-An administrator can use IPAM to add, import,

edit, and delete IP address blocks.

-IPAM automatically tracks the address ranges belonging to an address block.

IP address range

IP address ranges are the next hierarchical level of an IP address space, beneath the address block.

-Typically, an address range is a subnet marked by a starting and ending address, using a subnet mask.

-An IP address range normally maps to a DHCP scope. IP address ranges can be added or imported by IPAM.

IP addresses

IP addresses are the individual addresses that are contained in an IP address range.

- IPAM allows complete end‐to‐end management of both IPv4 and IPv6 IP addresses.

- IPAM automatically maps IP addresses to the correct range by using the starting and ending addresses of a range.

- IP addresses can be added manually or

imported by IPAM from external sources.

To manage the Windows Server 2008 DHCP and DNS roles using IPAM on Windows Server 2016, the following requirements should be installed on the WS 2008 systems:

• Service Pack 2 on Windows Server 2008

•.NET Framework 4.0 full installation

• Windows Management Framework (WMF) 3.0, which provides PowerShell 3.0

• Windows Remote Management (WinRM) must be enabled

Database solutions supported by IPAM

Supported:

-the Windows Internal Database

-Microsoft SQL Server.

NOT Supported:

-MYSQL,

-any other third‐party solution.

cmdlet that can be used to create IPAM provisioning GPOs.

Invoke‐IpamGpoProvisioning

-Domain contoso.com -GpoPrefixName IPAM1 -IpamServerFqdn ipam1.contoso.com -DelegatedGpoUser user1

Four categories of IPAM servers Monitor and Manage section:

• DNS and DHCP Servers

• DHCP Scopes

• DNS Zones

• Server Groups

The IPAM client console options for importing IP address data from a comma‐separated value (CSV) file include the following:

• Import IP Address Block

• Import IP Address Ranges

• Import IP Addresses

• Import and Update IP Address Ranges

Benefits of using an external database

you have additional scalability, disaster recovery, and reporting.

An IPAM server must be

must be a domain member but cannot be a domain controller.

An IPAM server never communicates with

another IPAM server

Group Policy‐based provisioning method creates

the Group Policy Objects (GPOs) that allow the required access settings on all the IPAM managed servers. The GPOs created are:

• IPAM1_DHCP for DHCP servers

• IPAM1_DNS for DNS servers

• IPAM1_DC_NPS for domain controllers and NPS servers

DHCP failover

-establishes a failover relationship between the two DHCP servers

-Each relationship has a unique name, which is exchanged during configuration. A single DHCP server

can have multiple failover relationships with other DHCP servers as long as each relationship has a unique name.

-DHCP failover is time sensitive. The time between partners must be no greater than one minute. If the time is greater, the failover process will halt with a critical error.

Dynamic Host Configuration Identifier (DHCID)

DHCP Name Protection addresses uses a

resource record known as *THIS* to track which machines originally requested which names.

Compacting the DHCP database

-required if the database becomes too large.

During the compaction process, the DHCP database is copied to a temporary database and compacted, the original DHCP database is deleted, and the temporary database is migrated to be the live database. The temporary database is then removed.

-requires the use of jetpack.exe, which is installed when the WINS Server feature is installed on the DHCP server. Therefore, you will need to install WINS to get access to jetpack.exe and compact the DHCP database.

Anycast

provides one‐to‐one‐of‐many transmission service to groups of interfaces, only the nearest of which (measured by the number of intermediate routers) receives the transmission. You typically use this for locating services or the nearest router.

The DNS client is known as the

DNS resolver.

signing the zone

client that uses DNS to connect is always vulnerable to redirection to an attacker's servers

unless the zone has been secured using DNSSEC. The process for securing a zone using

DNSSEC is called signing the zone. Once signed, any queries on the signed zone returndigital signatures along with the normal DNS resource records. The digital signatures are verified

using the public key of the server or zone from the trust anchor. DNSSEC uses trust

anchors represented by public keys that define the top of a chain of trust. The trust anchor

verifies that a digital signature and associated data are valid.

RRSIG record

returned to the client in response to a successful query along with the A record

Only to servers listed on the Name Servers tab

Restricts zone transfers to secondary

DNS servers as defined with NS resource records

If the reverse lookup zone does not exist to store the PTR record

a message appears warning

that the associated Pointer (PTR) record cannot be created.

If you suspect a DNS issue

you can use the ipconfig command to verify the IP configuration

of the client. Used without parameters, ipconfig displays the IP address, subnet mask,

and default gateway for all adapters. When you execute ipconfig /all, it displays the full

TCP/IP configuration for all adapters including host name, DNS servers, and the physical

address (or MAC address).

Serial number

Shows the version or how many times the zone has been updated. As explained previously, it is used to determine whether the zone's secondary server needs to initiate a zone transfer with the master server. If the serial number of the master server is

higher, the secondary server initiates a zone transfer.

The dnscmd.exe command was introduced with Windows Server 2008. With it, you can

perform the following:

Create, delete, and view zones and records.

Nslookup.exe

a command‐line administrative tool for testing and troubleshooting

DNS name resolution. Entering hostname in nslookup provides a forward lookup of the

host name to IP address. Entering IP_Address in nslookup performs a reverse lookup of IP

address to host name

if you don't get anything back when using nslookup.exe

PTR record does not exist

Dynamic Host Configuration Protocol (DHCP) server

When you assign static IP addresses (IPv4 or IPv6) to your clients, you run the risk of

duplicating IP addresses on your network or misconfiguring the settings. A better approach is to dynamically assign your TCP/IP configurations

from a central pool of IP addresses. The DHCP server can also be configured to provide

the default gateway, primary, and secondary DNS information; WINS server; and DNS

domain name.

default lease period

8 days

IPv6 provides a number of benefits for TCP/IP‐based networking connectivity, including

• A 128‐bit address space to provide addressing for every device on the Internet with a

globally unique address

• More efficient routing than IPv4

• Support for automatic configuration

• Enhanced security to protect against address and port scanning attacks and utilization of

IPsec to protect IPv6 traffic

when link local address is assigned.

when PC boots

Intra‐Site Automatic Tunnel Addressing Protocol (ISATAP)

an automatic tunneling

protocol used by the Windows workstation operating systems, which allows you to use

IPv6 applications on an IPv4 network by emulating an IPv6 link using an IPv4 network.

The ISATAP address consists of a valid 64‐bit unicast address prefix and the interface

identifier, such as a link‐local address prefix (FE80::/64), site‐local prefix, or global prefix.

The last 64 bits are ISATAP addresses, which are the locally administered interface ID

::0:5EFE:w.x.y.z, where w.x.y.z is any unicast IPv4 address in hexadecimal form.