Network Services - Gilham Consulting Microsoft Notepad

6/23/2009

Introducing the DirectAccess solution for Microsoft Forefront UAG

Nitzan Daube. PM for UAG posts:

As the PM lead responsible for the UAG DirectAccess, I’m proud to present our solution based on the new and exciting technology introduced by Windows 7 Direct Access. If you want to learn more about this technology click here.
Microsoft Frorefront Unified Access Gateway (UAG) utilizes DirectAccess technology built into Windows 7 and Windows Server 2008 R2 to create an enterprise level solution. UAG offers an all in one, end-to-end solution that lets the enterprise open its resources to managed clients in a seamless, painless manner.
UAG DirectAccess extends access to IPv4 servers

In order to support all backend servers, UAG DirectAccess adds a necessary transition technology (NAT64 and DNS64 also known as NAT-PT and DNS-ALG) to also allow clients access to IPv4 only servers – in addition to IPv6 based servers (natively or via ISATAP).
UAG DirectAccess enhances scalability, high-availability and management

Our solution adds the ability to scale and have multiple Direct Access Servers (DAS) in a cluster for providing high-availability of the service as well as scale-up. As part of ‘all in the box’ paradigm, UAG integrates Windows Network Load Balancing (NLB) support that could be seamlessly activated for the cluster.
UAG DirectAccess simplifies deployment and administration

We incorporated and augmented the DirectAccess configuration into its Unified Access Gateway management console allowing an easier deployment of the cluster. The console will help you setup, configure, activate and manage the cluster and each node in it from a central location. This console can be used to enforce policies (such as NAP and Smartcard), set IPs, etc.
UAG also provides access, from within the same cluster, for down level and non Windows clients

As its name suggests, Unified Access Gateway provides multiple access scenarios for managed remote clients (via UAG DirectAccess) as well as unmanaged, or even ‘foreign’ remote access clients in a secure way. By utilizing various remote access technologies, UAG can publish business server applications to unmanaged clients enforcing various authentication methods.

Read the complete article @> Microsoft Forefront Unified Access Gateway Product Team Blog : Introducing UAG DirectAccess solution

Posted at 8:18 AM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

6/1/2008

TCP/IP Fundamentals Training for Microsoft Windows Networks

A good read, especially if you haven't read in to IPv6 concepts.

There is nothing particularly fundamental about this book, unless you are a CCNP or otherwise live and breathe packets. Surprisingly (to me) however, the book remains quite readable. Written by Joseph Davies (aka The Cable Guy in TechNet Magazine)... he even has an entry on Wikipedia here.

This online book is a structured, introductory approach to the basic concepts and principles of the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol suite, how the most important protocols function, and their basic configuration in the Microsoft® Windows Vista™, Windows Server® 2008, Windows® XP, and Windows Server 2003 families of operating systems. This book is primarily a discussion of concepts and principles to lay a conceptual foundation for the TCP/IP protocol suite and provides an integrated discussion of both Internet Protocol version 4
(IPv4) and Internet Protocol version 6 (IPv6).

Weighing in at a hefty 559 pages, this e-book covers TCP/IP end-to-end. If you already know the fundamentals of TCP/IP, you probably do not yet have a good handle on IPV6, which is coming whether I want it to or not. This book has quite a bit of content in IPV6 routing, DNS, DHCP, and IPv6 Transition Technologies. The Table of Contents is as follows:

Chapter 1 – Introduction to TCP/IP
Chapter 2 – Architectural Overview of the TCP/IP Protocol Suite
Chapter 3 – IP Addressing
Chapter 4 – Subnetting
Chapter 5 – IP Routing
Chapter 6 – Dynamic Host Configuration Protocol
Chapter 7 – Host Name Resolution
Chapter 8 – Domain Name System Overview
Chapter 9 – Windows Support for DNS
Chapter 10 – TCP/IP End-to-End Delivery
Chapter 11 – NetBIOS over TCP/IP
Chapter 12 – Windows Internet Name Service Overview
Chapter 13 – Internet Protocol Security and Packet Filtering
Chapter 14 – Virtual Private Networking
Chapter 15 – IPv6 Transition Technologies
Chapter 16 – Troubleshooting TCP/IP
Appendix A – IP Multicast
Appendix B – Simple Network Management Protocol
Appendix C – Computer Browser Service

Download the eBook here

The Sean Blog : TCP/IP Fundamentals for Microsoft Windows

Posted at 10:45 AM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

5/4/2008

How to Use NTttcp to Test Network Performance on Windows

Great tool. After install, you can view the whitepaper in the following directory (no shortcuts created):

%programfiles%\Microsoft Corporation\NT Testing TCP Tool

NTttcp is a multithreaded, asynchronous application that sends and receives data between two or more endpoints and reports the network performance for the duration of the transfer. It is essentially a Winsock-based port of the ttcp tool that measures networking performance in terms of bytes transferred per second and CPU cycles per byte. Because it can be difficult to diagnose a system's overall performance without dividing the system into smaller subsystems, NTttcp allows users to narrow the focus of their testing and investigation to just the networking subsystem.
NTttcp can be configured in a variety of ways, including:

Software affinity for threads can be set to a specified processor index.

Asynchronous or synchronous data transfers.

Data verification at the application level for a pre-determined pattern in the application buffers.

Send and receive traffic from multiple IP addresses with single command.

Support IPv6 performance testing.

Support UDP performance testing.

Support time-driven testing.

Version 3.0

NTttcp_x86.exe: [-l|-n|-p|-a|-x|-rb|-sb|-i|-f|-u|-w|-d|-t|-v|-6|-fr|-mb] 
-m <mapping> [mapping]

        -l   <Length of buffer>     [default:  64K]
        -n   <Number of buffers>    [default:  20K]
        -p   <Port base>            [default: 5001]
        -a   [outstanding I/O]      [default:    2]
        -x   [PacketArray size]     [default:    1]
        -rb  <Receive buffer size>  [default:  64K]
        -sb  <Send buffer size>     [default:    0]
        -i   Infinite Loop          [Only UDP mode]

        -f   <File Name>            [default: output.txt]
        -u   UDP send/recv
        -w   WSARecv/WSASend
        -d   Verify Flag
        -t   <Runtime> in seconds
        -v   enable verbose mode
        -6   enable IPv6 mode
        -fr  Full buffers posted on reads
        -mb  Multiple buffer post mode
        -m   <mapping> [mapping]

        where a mapping is a session(s),processor,receiver IP set
        e.g. -m 4,0,1.2.3.4 sets up:
        4 sessions on processor 0 to test a network on 1.2.3.4

Download the MSI $ Whitepaper @> How to Use NTttcp to Test Network Performance

Posted at 8:53 AM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

3/21/2008

Best Practices on Windows DNS Scavenging

Scavenging will help you clean up old unused records in DNS. Since "clean up" really means "delete stuff" a good understanding of what you are doing and a healthy respect for "delete stuff" will keep you out of the hot grease. Because deletion is involved there are quite a few safety valves built into scavenging that take a long time to pop. When enabling scavenging patience is required. It will work just fine, but not today!
Note: For purposes of this discussion we are going to concentrate on the most common Windows DNS scenario: Windows Server 2003 DNS servers hosting AD integrated zones.
Scavenging is set in three places on a Windows Server:

On the individual resource record to be scavenged.
On a zone to be scavenged.
At one or more servers performing scavenging.

It must be set in all three places or nothing happens.
Scavenging settings on a Resource Record

To see the scavenging setting on a record hit View | Advanced in the DNS MMC then bring up properties on a record.

Scavenging gets set on a resource record in one of three ways. The first is by someone coming in here, checking the "Delete this record when it becomes stale" checkbox and hitting apply. When you hit apply the time of day will be rounded down to the nearest hour and applied as the timestamp on the record. Static records have a timestamp of 0 indicating do not scavenge.
The second is when a record gets created by a client machine registering using dynamic DNS. Windows clients will attempt to dynamically update DNS every 24 hours. All DDNS records get set to scavenge. When a record is first created by a client that has no existing record it is considered an "Update" and the timestamp is set. If the client has an existing host record and changes the IP of the host record this is also considered an "Update" and the timestamp is set. If the client has an existing host record with the same IP address then this is considered a "Refresh" and the timestamp may or may not get changed depending on zone settings. More on this later.
The third way to set scavenging on records is by using DNScmd.exe with the /ageallrecords switch. Let's pause here for a few moments to consider a few important words: All, Records, Delete, Stuff. If you actually run this command against a zone it will truly set scavenging and a timestamp on all records in the zone including static records that you never want to be scavenged. Because of the time it takes scavenging to do it's thing people find this command and get tempted to give it a try. Do not. It will delete stuff. Have patience instead.
Once a timestamp is set on a record it will replicate around to all servers that host the zone. There is one caveat to this. If scavenging is not enabled on the zone that hosts the record then it will never scavenge so the timestamp is essentially irrelevant. The timestamp may get updated on the server where the client dynamically registers but it will not replicate around to the other servers in the zone.

Read the rest of the article @> Microsoft Enterprise Networking Team : Don't be afraid of DNS Scavenging. Just be patient.

Posted at 2:09 PM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

Migrating Your Windows Network to IPv6 with ISATAP

In the next 5 years, this will become even more important. To stay ahead of the game, all new networks installed in the next 2-3 years should consider going to IPv6.

If you’ve been thinking about migrating to IPv6 , the Cable Guy explains how you can use an IPv6 transition technology to get started. Using the tunneled IPv6 connectivity that ISATAP provides, hosts can communicate using IPv6 traffic that is encapsulated with an IPv4 header. ISATAP traffic can traverse an IPv4-only intranet, so you can begin testing IPv6-capable applications immediately, without having to wait until you have a native IPv6 infrastructure in place.

For more information on this topic, visit TechNet's IPv6 and IPv6 Transition Technologies pages.

IPv6 Transition Technologies in Windows Server 2008 and Vista

This article describes IPv6 transition technologies and how these technologies are supported by the IPv6 protocol for Windows Server 2008 and Windows Vista. This article is intended for network engineers and support professionals who are already familiar with basic networking concepts, TCP/IP, and IPv6.

For a WebCast version of this white paper, click here.

Included in This Document - IPv6Trans.doc

Transition Mechanisms
Tunneling Configurations
ISATAP
6to4
Teredo
PortProxy
Migrating to IPv6

From: TechNet Magazine Blog : The Cable Guy: Migrating Your Intranet to IPv6 with ISATAP

Posted at 1:54 PM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

2/25/2008

Deployment Guide and Project Plan: Windows Server 2008 Active Directory Domain Services

Welcome to the Windows Server® 2008 Active Directory® Domain Services guide, a part of the Infrastructure Planning and Design series from Solution Accelerators.
In This Guide
The Planning and Design Series Approach
Introduction to Active Directory Planning and Design
Active Directory in Microsoft Infrastructure Optimization
Active Directory Design Decision Process
Step 1: Determine the Number of Forests
Step 2: Determine the Number of Domains
Step 3: Assign Domain Names
Step 4: Select the Forest Root Domain
Step A1: Design the OU Structure
Step B1: Determine Domain Controller Placement
Step B2: Determine the Number of Domain Controllers
Step B3: Determine Global Catalog Placement
Step B4: Determine Operations Master Role Placement
Step C1: Create the Site Design
Step C2: Create the Site Link Design
Step C3: Create the Site Link Bridge Design
Step D1: Determine Domain Controller Configuration
Conclusion
Appendix: Design Job Aid
Acknowledgments

Posted at 11:41 AM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

1/26/2008

Upgrade paths for Active Directory Domain Controllers to Windows 2008

Supported upgrades for domain controllers to Windows 2008 (Melting Pot in CorpNet)

Currently we are running Win2k3 SP1, R2, SP2, Win2k8 Beta3, RC0, RC1, and RTM Escrow idomain controllers in production... Since we're running some downlevel servers in the environment and I was interested in what is supported to be upgraded to Windows 2008 when we sign off and the the DVDs start getting pressed. Luckily a mail came by on one of our discussion aliases that has the details I (we) desire.

You can have DCs with down-level OS down to Windows 2000 SP4 in the same forest along with WS2008 DCs.
This means you can have forests with a mix of WS2008, WS2003 SP2, WS2003 R2, WS2003 SP1 and Win2K SP4 (please have in mind that this depends on the forest and domain functional levels).
If you have a down-level only forest (i.e. no WS2008) and want to introduce a new WS2008 you will need to run ADPrep (ForestPrep and DomainPrep).
You can run ADPrep having down-level OS down to Win2K SP4, you don’t need to have all of them with WS03 SP2.
However if you are going to in-place upgrade any of the down-level DCs, these have to be at least WS2003 SP1.

Refs:
Upgrading Active Directory Domains to Windows Server 2008 AD DS Domains
What Service Packs can be upgraded to Windows 2008

Brad Rutkowski's Blog : Supported upgrades for domain controllers to Windows 2008 (Melting Pot in CorpNet)

Posted at 1:06 AM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

10/27/2007

DHCP Best Practices: Reservations in Split Scopes

Split scopes are genrally created to provide the backup cabability in DHCP Server. In case if one server goes down, the clients can still gets the Ip address from the other server.
Lets take an example how Split scopes are created.We have the range from 10.0.0.1 to 10.0.0.200 and we want to configure the split scope in 50-50 manner then
1)-We will create the scope 10.0.0.1 to 10.0.0.200 on first server(say A), we will configure the Exclusion on server A from address 10.0.0.101 to 10.0.0.200 so that it serves the addresses from 10.0.0.1 to 10.0.0.100.
2)- We will create the scope 10.0.0.1 to 10.0.0.200 on second server(say B), we will configure the Exclusion on server B from address 10.0.0.1 to 10.0.0.100 so that it serves the adderss from 10.0.0.101 to 10.0.0.200.
Now some times we want that few network devices like Printers,fax m/c should always get constant IP address, this problem can be solved by two ways
1)-We can configure the same reservation on these boxes, this will make sure that these machine are getting reserved IP address only but it can be assigned by any of the server(A or B)
2)- If we want that server A only should give IP X to client C and server B should not assign any address to that client then we can create the the reservation for client A on Server A and we can implement call out DLL on Server B that when ever this server receives the packet from client X, it should drop the packet. for more information for callout dlls one can refer http://blogs.msdn.com/anto_rocks/archive/2005/02/25/380510.aspx

Microsoft Windows DHCP Team Blog : Reservations in Split Scopes

Posted at 9:03 PM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

10/22/2007

Backup important Windows network information.

I have some simple scheduled jobs that run to backup key Windows network infrastructure such as DHCP, WINS, and CertSVR. These can be run automatically via Windows Scheduled Tasks in the Windows control panel.

DHCP

While you can restore on any Windows 2003 computer with the DHCP service installed. The import will include all leases (w/MAC addresses), configuration info, and scopes.

Note - If you have multiple routed subnets, you might need to update your router DHCP or bootp IP forwarders to the new server IP address on your routers. A good way to prevent router ip helper address configuration issues when switching DHCP server in an outage is to configure the router forwarder to a broadcast subnet (i.e. ip helper-address 172.24.1.255), as opposed to a specific host. The new DHCP server could then be any server in the destination subnet.

Backup:
netsh dhcp server export C:\dhcp.txt all

Restore:
netsh dhcp server import c:\dhcpdatabase.txt all

More info:
http://support.microsoft.com/kb/325473
http://www.ciscopress.com/articles/article.asp?p=330807&seqNum=9&rl=1
http://blogs.technet.com/teamdhcp/

Certificate Server (PKI, Certificates)

Backup:
certutil -backup c:\backup\certsvr\%computername%\

Restore
View: http://support.microsoft.com/kb/298138

Wins

Backup:

1. Open WINS Manager.

2. Double-click on the server entry in the WINS Servers List to ensure you are working on that server.

3. Click to select Server, and then click to select Configuration.

4. In the WINS Server Configuration window, click Advanced to view the Advanced WINS Server Configuration options.

5.Click to select Logging Enabled or the WINS database cannot be backed up.

6.Type the folder location of the WINS database backup files in the Database Backup Path box. You may use the Browse button to visually select a path (i.e. C:\backup\dhcp\%computername%). If no entry is made, the default location is used.

7.Click to select Backup On Termination if you want WINS to backup the database every time the WINS service is stopped.

8.When these steps are completed, a manual backup of the database is required for the first time or automatic backups cannot occur. To accomplish this, on the Mappings menu, click Backup Database.

9.Choose the folder where the backup files are to be stored (this should be the location you identified in Step 6), and then click OK.

Restore:

1. Stop the WINS service. At a command prompt, type net stop wins, and then press Enter. You can also use the Control Panel Services tool by click Windows Internet Name Service, and then click Stop.

2. After the WINS Service is stopped, highlight the server in WINS Manager and, from the Mappings menu, click Restore Local Database. Select the location where the backup database is located. Using the Browse button, find the correct location of the backup files, and then click OK.

3. A successful backup is indicated by a pop-up message stating Restore Successfully Completed.

4. At this point, your database includes all entries that were in the backup copy of the Wins.mdb file. This information is current as of the last time the WINS database was either manually backed up using the Backup Database function on the Mappings menu or automatically backed up by the WINS service itself.

More info:
http://support.microsoft.com/kb/235609

Other important info for disaster recovery

Active Directory

(Stored as LDIF), passwords are not exported:

Backup: ldifde -f c:\backup\AD\%computername%\ldifde-%computername%.ldf

Restore: N/A for complete restore.

Posted at 7:33 PM by John Gilham | Category: Network Services | Permalink | Email this Post | Comments (0)

Gilham Consulting Microsoft Notepad

6/23/2009

UAG DirectAccess extends access to IPv4 servers

UAG DirectAccess enhances scalability, high-availability and management

UAG DirectAccess simplifies deployment and administration

UAG also provides access, from within the same cluster, for down level and non Windows clients