Routing Protocols

This article gives a high level overview of the routing protocols, and how they fit into our online lives.

I have written at length about the TCP/IP protocol suite. All of those protocols are routed ones, but what are they in turn routed by? Read on to get a high level overview of the routing protocols, and how they fit into our online lives.

The routed vs. the routing

There has always been a great attraction for me to the networking protocols. I don’t know why I have always been fascinated by them, but they do interest me greatly. A good deal of my time has been spent studying and playing with the protocols contained in the TCP/IP protocol suite. What all those protocols have in common is that they are routed protocols. This begs the question of what routes them? A very good question indeed, and one that a great many books have been written about.

What I shall cover in this article is a breakdown of what routing protocols are. How they work, and what kinds of routing protocols there are. Things I won’t be covering are the Cisco IOS syntax used when configuring these routing protocols. Quite a few excellent books out there already do an admirable job of doing just that. Instead, as mentioned, I will concentrate on giving you a high level overview of what routing protocols are, the various types, and what it is that they do.

Onwards and upwards

Well we already know that the packets generated by our computers are comprised of routed protocols. These protocols in turn need to be routed if they are to reach their intended recipients. How does a packet ultimately get to its destination? Well this is accomplished via it being routed by a series of routers, and this is also done primarily via the IP address listed in the IP header. With this simplistic explanation in hand we will now take a look at the two categories of routing protocols.

The routing protocols themselves are broken down into two groups. Those are the IGP and EGP, or Interior Gateway Protocols, and Exterior Gateway Protocols. Much like their respective names infer, one group is used internally and the other externally. For example the IGP series of routing protocols are used on internal networks, and the EGP series of routing protocols is used on the actual Internet itself. What does that all really mean though? Well it means that when you do the initial configuration of your, in all likelihood, Cisco router that you will need to choose what type of routing protocol to install and configure.

Now is as good a time as any to list the various types of routing protocols for each group. Interior Gateway Protocols are comprised of the following;

• IGRP: Interior Gateway Routing Protocol
• EIGRP: Enhanced Interior Gateway Routing Protocol
• OSPF: Open Shortest Path First
• RIP: Routing Information Protocol
• IS-IS: Intermediate System – Intermediate System

For Exterior Gateway Protocols there are;

• EGP: Exterior Gateway Protocol
• BGP: Border Gateway Protocol

Interior Gateway Protocols

We can see from the above noted examples of IGP protocols that there are several of them. Are they all used in today’s internal networks? Well I suppose they very well could be, but likely the most common ones used today are OSPF and RIP. With that in hand let’s go over RIP. RIP is what is called a dynamic routing protocol. What that means is that it will automatically figure out routing tables on its own. In other words the system administrator does not have to manually input all the various routes. That would be a serious pain in the butt!

So RIP will automatically compute the routes, as well as secondary routes to be used in case a primary path should fail. If you are thinking that this sounds like “load balancing” you would indeed be correct. Another key piece of information to remember about RIP is that it is a “distance vector” protocol. Seen as this article is only a high level overview I will say only that “distance vector” involves the method of discovering routes. For more information on this very important topic please click here. Some key points to remember about RIP are that it uses port 520 and uses UDP as its transport protocol.

OSPF is the other commonly used IGP. A key differentiator between RIP and OSPF is that OSPF is a “link state protocol”. This simply means that it uses a different way to build its routing tables. OSPF enabled routers will advertise metrics which contain the information that the other OSPF enabled routers will use to build its routing tables. It is as simple and as complicated as that. Further reading can be found here. Also, as above, some key points to remember are that OSPF supports multicasting and subnets. Lastly, OSPF uses IP, and not TCP or UDP.

Exterior Gateway Protocols

Well we covered the two main IGP’s at a very high level, but what about the EGP protocols? Well let’s indeed take a look at the two better known ones. BGP or Border Gateway Protocol is the routing protocol in use today by the routers which populate the Internet. By that I mean routers that are used by your ISP for example, or what are also called Internet facing routers. These routers form the backbone of the Internet and BGP v4 is what is currently running on them. Much like RIP above, BGP is essentially itself a distance vector protocol or algorithm. One notable fact about BGP is that it uses TCP for its transport protocol and will communicate via port 179. In other words, routing tables are exchanged using TCP for transport and done via port 179. With that said about BGP, what is there to know about EGP? Well realistically not a whole lot as it is not really used anymore. It has been replaced, if you will, by BGP. Should you wish to read more about it please click here.

Wrapping up

Well as you can see I was not kidding about the high-level overview of routing protocols. There have literally been thick books written on BGP alone. It really is impossible to cover all about these routing protocols in one article, let alone a book. What this article hopes to convey rather is the diversity within the routing protocols themselves, and the difference between them and the routed protocols. What can you do to learn more about these routing protocols? I have always been a big believer in putting concepts into practice. It is, in my opinion, the only way to really learn and furthermore cement lessons learnt.

To that end you should, if financially possible, pick up some used Cisco networking gear. They are not all that expensive to buy and will pay dividends in your quest to know more about how traffic is actually routed. Further to buying some networking gear I would advise you to use programs such as Nemesis which will allow you to craft RIP, OSPF, and IGMP amongst others. Being able to craft some routing protocol packets will also let you see how they react to certain stimulus. Packet crafting is how I initially taught myself about TCP/IP, and I would certainly encourage you to do so with these routing protocols. Doing so will force you to learn more about the protocol itself and how it works. Lastly, as mentioned, getting some networking gear really is the key as much of the protocol configurations must be done via this hardware. You will only get so far by actually reading. If you really are on a limited budget then you may wish to buy one of many available simulators.

Well this brings to an end my high-level overview of routing protocols. I hope that this is enough to whet your appetite and push you to further study this critically important area of computer networks. As always I welcome your feedback, and on that note till next time!

Crash Course in IPv6 (Part 1)

An introduction to the IPv6 address space.

If you would like to read the other parts in this article series please go to:

• Crash Course in IPv6 (Part 2)
• Crash Course in IPv6 (Part 3)

A couple of months ago, I wrote an article for the site called “Get Ready to Run IPv6 (Whether You Want to or not)”. In that article, I explained that both Windows Vista and Longhorn Server will natively run the IPv6 protocol alongside the IPv4 protocol that is so commonly used today. There are several features in these operating systems that simply will not work unless IPv6 is used. That being the case, it probably makes sense to go ahead and learn a little bit about how IPv6 works. If that isn’t a compelling enough reason for you, it has been estimated that the IPv4 address pool will be completely exhausted by sometime around the year 2009. As such, the United States government has mandated that all federal agencies deploy IPv6 for their network backbones by the year 2008.

As you can see, the IPv6 protocol is about to go from relative obscurity to widespread use in the next couple of years. I am writing this article series as a way of introducing you to the IPv6 protocol.

The IPv6 Address Space

The most obvious difference between the two protocols is the length of their source and destination addresses. The whole point of making the switch to IPv6 is to compensate for a global shortage of IP addresses. It only makes sense that the IPv6 protocol has a larger address space than the IPv4 protocol does.

The IPv4 protocol uses a 32-bit source and destination address. These addresses are typically represented as a series of four octets. As I’m sure you know, a typical IPv4 address looks something like this: 192.168.0.1.

In contrast, an IPv6 address is 128 bits in length. This allows for a total of 3.4x10³⁸ (or 340,000,000,000,000,000,000,000,000,000,000,000,000) addresses. There are several different ways of representing an IPv6 address. An IPv6 address is normally written as eight groups of four hexadecimal digits, each separated by colons. For example, an IPv6 address looks like this: 2001:0f68:0000:0000:0000:0000:1986:69af.

You might be looking at the sample address listed above and thinking that typing an IPv6 address involves a lot of effort. Fortunately, IPv6 addresses can be shortened by eliminating zeros. There are two rules that must be followed when condensing an IPv6 address. First, a series of four consecutive zeros can be replaced by two colons, so long as there is only one set of double colons in the resulting address. Using this rule alone, our sample address from above could be condensed to look like this: 2001:0f68::0000:0000:0000:1986:69af

In the example above, we were only able to eliminate one block of zeros because the rule says that there can only be a single set of double colons in an address. Obviously, the sample address above is still a lot to type. Fortunately, the second rule will allow us to make this address a lot shorter. The second rule states that leading zeros in a group can be omitted. What this means is that if a block of four numbers starts with a zero, zero can be removed leaving three numbers in the block. If that three digit block of numbers happens to start with a zero, then the zero can be removed again. The process goes on and on so long as there is a zero in the left-hand position in a block. It’s a little tricky to try to explain the process, so I will demonstrate it below. I will start with our original sample address and then work toward condensing that address.

2001:0f68:0000:0000:0000:0000:1986:69af
2001:f68:000:000:000:000:1986:69af
2001:f68:00:00:00:00:1986:69af
2001:f68:0:0:0:0:1986:69af
2001:f68::1986:69af

Notice that in each line, I simply stripped away the leading zero from each section. Since there were several sections containing all zeros, I was able to completely remove the sections and replace them with a double colon. This was only possible because the sections containing all zeros were found in a row. If the sections of zeros had been scattered, then only one set of zeros could have been completely eliminated (because you are only allowed a single set of double colons). All the other sets of zeros would have to be represented as a single zero.

Using IPv6 Addresses in URLs

Although DNS servers make it possible to access a website by using a fully qualified domain name rather than an IP address, it is still a somewhat standard practice to enter an IP address as a part of a URL. For example, my personal website uses the URL www.brienposey.com, which corresponds to the IP address 24.235.10.4. It would be possible to access my website by entering the following URL: http://24.235.10.4

Most casual Web surfers do not make a habit of entering IP addresses in place of fully qualified domain names. Even so, the practice does exist. This is especially true for private Web applications. Not associating a fully qualified domain name with an application makes it a lot less likely for an unauthorized person to stumble onto the application accidentally.

When an IP address is used in place of a fully qualified domain name, a port number is sometimes specified as part of the address. If you simply enter HTTP:// followed by an address, then your Web browser assumes that you want to use port number 80. However, you can specify any port that you want by appending a colon and the port number to the end of the address. For example, if you wanted to access the www.brienposey.com website by IP address, and specifically require a port 80 to be used, then the command would look like this: http://24.235.10.4:80

The IPv6 protocol can also be used as a part of a URL. If you pay attention to the IPv6 format, you’ll notice that an IPv6 address contains a lot of colons. This poses a bit of a problem since your Web browser typically treats anything after a colon as a port number. That being the case, IPv6 addresses are enclosed in brackets when they are used as a part of a URL. For example, if you were to use our sample IPv6 address in a URL, it would look something like this:

HTTP://[ 2001:0f68:0000:0000:0000:0000:1986:69af]/

Just as you can specify a port number alongside an IPv4 address, you can also specify a port number when using an IPv6 address. The port number follows the exact same format as it does when IPv4 is being used, and falls outside of the brackets. For example, if you were wanting to access the website at our sample IPv6 address over port 80, the URL would look something like this:

HTTP://[ 2001:0f68:0000:0000:0000:0000:1986:69af]:80/

Notice that the port number, in this case 80, falls between the close bracket and the ending slash. A colon is also used to designate the port number, just as it is in the IPv4 protocol.

Conclusion

So far, I have shown you some different ways of representing an IPv6 address. Like the IPv4 protocol, an IPv6 address range can be subnetted. Although the basic concept of Subnetting works in much the same way that it did in the IPv4 protocol, the method of expressing the subnet has changed dramatically. In Part 2 of this article series, I will discuss network notation and subnetting and IPv6. I will also discuss some special addresses (and address fragments), and what they mean in the IPv6 protocol.

An Introduction to the Windows 2003 POP3 Service

This document is intended to give the reader a brief introduction to the Windows 2003 POP3 service - just one of the many new features offered by the Windows 2003 Server family.

Introduction

What is POP3?

POP3 is a client-server protocol in which email is received and held by a mail server. Messages are downloaded to a local computer all at once, thereby making offline reading easier. You can specify whether to keep copies of the messages on the server. The default port number for POP3 is 110.

What is the POP3 Service?

The POP3 (Post Office Protocol version 3) service is an email service that retrieves email messages. Administrators can use the POP3 service to store and manage email accounts on the mail server. Although the Microsoft Exchange family provides more flexibility to a mail server, the user experience on an email client (such as Outlook Express) - when sending or receiving email - is the same. The end user will not notice the difference when downloading their personal email from the server.

Pros

• Very good for small sized companies who wish to setup a basic mail system.
• Support for multiple domains if using either Active Directory or encrypted password file authentication.
• Cheaper than the alternative method of having to buy Exchange Server.

Cons

• Windows Server POP3 email should be backed up when it is offline. Having to back up while offline could lead to a service interruption for users.
• The Windows Server POP3 service does not support AVAPI
  
  

Installing the POP3 Service

Navigate to the Add/Remove programs icon in the control panel and double click it. This will open the window on which you must click the Add/Remove windows components button. Tick the E-Mail Services option and press details.

A window will open allowing you to select whether or not you want the POP3 Service Web Administration facility installed as well. (This is disabled by default). Web Administration allows you to administer the POP3 Service via the web browser, using HTTP.

Press OK and Next to start the installation. Once this is complete, close all open windows.

Setting up a mailbox in the Windows 2003 POP3 Service.

After you have installed the POP3 Service, you are ready to setup and configure mailboxes. Open the main window by pressing Start > Programs > Adminstrative Tools > POP3 Service.

Before proceeding with the setup, make sure you have configured the authentication from the properties box. You can tick the Secure Password Authentication (SPA) check box for increased security.

Once that is done, the first thing you have to do is create a domain. Do this by right clicking the server name in the main window, select new > domain. Type the name of your desired domain and click OK.

Further to this, you are now able to create a mailbox by right clicking the domain, pressing New > Mailbox (as shown below).

The following screen will appear. Type the mailbox name and the password in the appropriate boxes and press OK.

A confirmation box should pop up notifying you that the mailbox was successfully added. Select the "Do not show this message again" if you do not wish to have this box appear everytime you add a mailbox.

The new mailbox you created is shown in the main window. As you can see in the following window, the "State" of the mailbox is "Unlocked" and therefore available for use. If you right click the mailbox and select "Lock", you will disable it.

That's it - you're new mailbox has been setup successfully. If you have multiple POP3 servers you can connect to them remotely by right clicking the root node in the POP3 Service MMC window and selecting "Connect..." (as shown below).

Type the name of an available server or browse to one on your network.

Press OK to establish the connection.

This document is intended to give the reader a brief introduction to the Windows 2003 POP3 service - just one of the many new features offered by the Windows 2003 Server family. The Internet Information Services manager offers SMTP, FTP, WEB server administration - these three services can be set up and configured from here. It may be of interest to you to take a look at the SMTP service as it is related to mail servers.

Windows 2003 Active Directory: An overview

Active directory has been around since the release of Windows 2000 several years ago, and is now a standard sight in many offices. Its inclusion marked a radical change at the heart of the Windows Server platform, one that people are still adjusting to today. In this article, we will be taking a brief look at the history of Active Directory, as well as the current version, Active Directory 2003, and possible future inclusions to the platform.

Times gone by

Some years ago, you could have been excused for thinking that selecting the right server software for your Windows network was a tough job. Microsoft hasn’t always been the toughest dog in the pound. On one hand Microsoft’s NT4 platform provided good integration and, more importantly, a platform that IT managers were immediately familiar with. On the other hand, Novell had a rock solid, lean, and world proven product in Novell Netware (4.1 or 5). The secret at the heart of the world dominance of Novell, and the foot blocking the door of Microsoft in the critical international corporate server market, was the inclusion of a directory service called NDS (Novell Directory Services). Such a directory allowed for scalable and more easily managed networks, and lent itself well to multi-office, global networks, at least it was the better alternative to the provisions in Windows NT4.

Fig 1: Novells NDS was world class…at the time.

For those of you knew to the idea of a Directory in network terms, you can think of it as a telephone directory, with each entry being a network object, such as a user or a printer or a network share, rather than a piece of contact information. This information can be structured in to logical containers, called Organisational Units (OU’s) allowing for a more manageable environment when dealing with large numbers of users and other objects. This directory can be duplicated and replicated across multiple servers, allowing for redundancy and a distributed structure to be built in to the network design. This directory, like its paper based name sake, can be searched quickly an easily, though this can be done far faster than turning the pages of the book. Allowing for a logical structure and design allows IT Departments to apply policies to groups of users or computers based upon the needs of the business.

Clearly, in order for Microsoft to gain global dominance in the server field, they had to rework the server platform, and make it scalable, reliable and resilient from the ground up, and without completely reinventing the wheel. Thus Active Directory was born.

Learning the basics

Before we begin, lets quickly cover the basics of Active Directory. Any Active Directory installation goes hand in hand with a correctly setup DNS server running on your network. The reliance on DNS is apparent in Windows 2000, and it’s almost impossible to run a Windows 2000 network with out it being underpinned by DNS. This is very different from the old NT networks, which could do without, or would most likely use WINS which was a Microsoft ‘alternative’ to DNS offered up at the time. Such is the reliance on DNS, that it should be the first point of call when fault finding an issues with AD working or replication issues.

Active Directory itself is made up of three ‘logical’ partitions, these being ‘Domain’, ‘Configuration’ and ‘Schema’. Within the file system these are stored in the NTDS.DIT on any domain controller. The Domain partition stores information relating to the domain, while the Configuration partition holds information relating to the forest structure. Finally the Schema holds information on the definition of objects within the network. These can roughly be associated, in order, with the following tools; Active Directory Users and Computers, Active Directory Sites and Services, and ADSIEdit.

Is there a spin doctor in the house?

You’re not going to be bowled over by swathes of new features in Active Directory 2003, the most visible new features are to be found in the management tools which, as part of the Admin Pak, can be installed on a Windows XP machine and will work quite happily with Windows 2000. One of the most useful features of the new AD tools, for the general IT person, is the ability to create and store queries in Active Directory Users and Computers. You can now create queries to display users, computers, or any other object you can think of, based on pretty much any attribute you can think of. Microsoft have wisely included some predefined criteria, for performing the most common searches, which include; Disabled Accounts, Accounts not logged for xx days, Username (which can be the usual starts with, ends with, or contains etc), Description, and Expired Passwords. These queries alone should be able to help most IT folk, but the list of objects and attributes are endless.

Fig 2: Queries let you quickly find common groups of objects

We will be covering queries in further detail in a future article. There are also significant changes to the Group Policy management facilities of AD Users and Computers. Again, these features will be covered in further detail in future articles.

There are also, however, several overhauls under the bonnet as well that should be given due attention. Clearly the priority with which you regard these new features will depend squarely upon the kind of network you have, it’s structure, and your job role.

AD/AM

One of the most interesting features of this release is in actual a separate release balancing on the coat tails of Active Directory 2003. Active Directory / Application Mode (or ADAM to it’s closest friends) is a separate application that should proof to be a boon to application developers and IT Managers alike. As Active Directory is a customisable database that allows for replication across various internet links and connections, many applications (bespoke and otherwise) can use it to store data relating to a package and its users, as well as for authorisation of users. This means that the programmers of such applications needn’t reinvent the wheel when it comes to creating distributed data stores, and development cycles can be reduced. It does, however, introduce several massive problems in turn mainly a big increase in bandwidth and big lag. Network links between branch offices are often slow, the additional data added by such applications can easily result in these lines crawling to halt. Even in the biggest of offices, with the fastest of lines, replication data management can be black art, and additional replication data is never needed. In addition to this issue is that of replication speed. In a busy office with multiple branches (the kind of network that could well make use of such bespoke applications running on distributed data stores such as AD) the replication of all this new data means that none of the offices are ever going to be seeing the latest of information.

Due to these issues most application developers have turned away from using AD as an application data store. Microsoft seeks to change that by introducing a stand alone version of Active Directory tailored towards application data storage. ADAM is available as a download from Microsoft and is installable on either a Windows 2003 server or a Windows XP workstation. When installed it runs in the context of a nominated account, and as it’s separate to Active Directory replication schedules can be configured separately. On top of that, multiple instances of ADAM can run on the same machine, which should allow developers and others alike to test different schema setups far more easily that before.

Fig 3: Active Directory running under XP, who would of thought it!

It should be said that Microsoft has included a new Application Directory Partition feature in AD2003, which allows for a new fourth ‘logical’ partition, called ‘Application’. This new partition is tailor made to store data from 3^rd party AD aware programs, and means that data for Ad aware programs can be stored outside of the main three partitions, and can have separate replication schedules. This obviously has several of the advantages that benefit the ADAM approach, but with ADAM you are able to run multiple instances, something which cannot be done with a normal AD installation.

Replication improvements

One of the areas that people have been most vocal about is that of replication traffic. Microsoft have long had a reputation for bloat-ware, applications that seem to be unnecessarily large in the file department, and they have been working hard to try to cut down on the amount of data moved across network links in the name of AD replication.

One of the most apparent examples of the new improvements in replication techniques can be seen in the form of Linked Value Replication. This new feature will seem logical to some, but was much desired in the Active Directory 2000. Linked Value Replication allows single values of multi-value attributes to be replicated between servers, so that, for example, when you add a new member to a security group containing 1000 users, only that one new user is replicated. Previously, all the values in multi-valued attributes where replicated, so that all 1000 members would have had to have been replicated in order for just that one new user to be included in the group. Even in my current small network, with three branch offices and 6 servers, this could make a real difference. On side note, Microsoft have now removed the maximum limit of objects within a group which was set to 5000. You can now have an infinite number of members within a group.

With bandwidth in mind, Microsoft has also included ‘cached credentials’. Cached Credentials allow users at remote branch offices, which have a domain controller running,, to log on even without a connection to a Global Catalogue server. Even though modern leased line and wan links are far more reliable than they once were and have up times rated in the area of 99.99%, they still fail, and if you consider that a lot of small remote offices are connected via some form of fixed DSL line you can see why anything that allowed users to get working while a line was down would be a great boon.

One last improvement that can be grouped in to the bandwidth saving category is ‘Install of Replica from Media”, which is, as I’m sure you would agree, a catchy title! In simple terms this allows you install a copy of the Active Directory database via a network copy, or a CD or any other media, rather than relying on the replication to take place across the network. Imagine, if you will, that you are on site at a remote branch office installing a new Domain Controller. The connection to the branch office is a low speed leased line, or possibly a form of DSL (which may not be the most reliable of beasts), and you know that the AD replication will take some time. In a hurry to move on you pull out a copy of the AD database on CD, or DVD, from your bag of tricks, and install it in a matter of minutes. It would seem that we are being smothered in new bandwidth saving features, which in all is no bad thing.

While I hope that, after reading this article, you agree with me that Active Directory 2003 has some significant improvements over the previous version, there are still several areas where future improvements could be made. The Active Directory is an important, and complex, part of any network, and as such further facilities to document the layout of any Active Directory setup would be very useful. On a more important note, better tools are needed in the area of Health Monitoring. There are several good tools in the market for monitoring and assessing your Active Directory installation, but these often come with a great cost. Its about time that these kind of tools, at least basic versions of them, where a feature of even the most minimal installations.

If the current version is anything to go by, the future of Active Directory is promising.

Setting up a DHCP server in Windows 2003

"Dynamic Host Configuration Protocol (DHCP) is an IP standard designed to reduce the complexity of administering IP address configurations." - Microsoft's definition. A DHCP server would be set up with the appropriate settings for a given network. Such settings would include a set of fundamental parameters such as the gateway, DNS, subnet masks, and a range of IP addresses. Using DHCP on a network means administrators don't need to configure these settings individually for each client on the network. The DHCP would automatically distribute them to the clients itself.

The DHCP server assigns a client an IP address taken from a predefined scope for a given amount of time. If an IP address is required for longer than the lease has been set for, the client must request an extension before the lease expires. If the client has not requested an extension on the lease time, the IP address will be considered free and can be assigned to another client. If the user wishes to change IP address then they can do so by typing "ipconfig /release", followed by "ipconfig /renew" in the command prompt. This will remove the current IP address and request a new one. Reservations can be defined on the DHCP server to allow certain clients to have their own IP address (this will be discussed a little later on). Addresses can be reserved for a MAC address or a host name so these clients will have a fixed IP address that is configured automatically. Most Internet Service Providers use DHCP to assign new IP addresses to client computers when a customer connects to the internet - this simplifies things at user level.

The above diagram diplays a simple structure consisting of a DHCP server and a number of client computers on a network.

The DHCP Server itself contains an IP Address Database which holds all the IP addresses available for distribution. If the client (a member of the network with a Windows 2000 Professional/XP operating system, for example) has "obtain an IP address automatically" enabled in TCP/IP settings, then it is able to receive an IP address from the DHCP server.

Setting up a DHCP Server

This will serve as a step-by-step guide on how to setup a DHCP server.

Installing the DHCP server is made quite easy in Windows 2003. By using the "Manage your server" wizard, you are able to enter the details you require and have the wizard set the basics for you. Open to "Manage your server" wizard, select the DHCP server option for the list of server roles and press Next.
You will be asked to enter the name and description of your scope.

Scope: A scope is a collection of IP addresses for computers on a subnet that use DHCP.

The next window will ask you to define the range of addresses that the scope will distribute across the network and the subnet mask for the IP address. Enter the appropriate details and click next.

You are shown a window in which you must add any exclusions to the range of IP addresses you specified in the previous window. If for example, the IP address 10.0.0.150 is that of the company router then you won't want the DHCP server to be able to distribute that address as well. In this example I have excluded a range of IP addresses, 10.0.0.100 to 10.0.0.110, and a single address, 10.0.0.150. In this case, eleven IP's will be reserved and not distributed amongst the network clients.

It is now time to set the lease duration for how long a client can use an IP address assigned to it from this scope. It is recommended to add longer leases for a fixed network (in the office for example) and shorter leases for remote connections or laptop computers. In this example I have set a lease duration of twelve hours since the network clients would be a fixed desktop computer in a local office and the usual working time is eight hours.

You are given a choice of whether or not you wish to configure the DHCP options for the scope now or later. If you choose Yes then the upcoming screenshots will be of use to you. Choosing No will allow you to configure these options at a later stage.

The router, or gateway, IP address may be entered in next. The client computers will then know which router to use.

In the following window, the DNS and domain name settings can be entered. The DNS server IP address will be distributed by the DHCP server and given to the client.

If you have WINS setup then here is where to enter the IP Address of the WINS server. You can just input the server name into the appropriate box and press "Resolve" to allow it to find the IP address itself.

The last step is to activate the scope - just press next when you see the window below. The DHCP server will not work unless you do this.

The DHCP server has now been installed with the basic settings in place. The next stage is to configure it to the needs of your network structure.

Configuring a DHCP server

Hereunder is a simple explanation of how to configure a DHCP server.

The address pool displays a list of IP ranges assigned for distribution and IP address exclusions. You are able to add an exclusion by right clicking the address pool text on the left hand side of the mmc window and selecting "new exclusion range". This will bring up a window (as seen below) which will allow you to enter an address range to be added. Entering only the start IP will add a single IP address.

DHCP servers permit you to reserve an IP address for a client. This means that the specific network client will have the same IP for as long as you wanted it to. To do this you will have to know the physical address (MAC) of each network card. Enter the reservation name, desired IP address, MAC address and description - choose whether you want to support DHCP or BOOTP and press add. The new reservation will be added to the list. As an example, I have reserved an IP address (10.0.0.115) for a client computer called Andrew.

If you right click scope options and press "configure options" you will be taken to a window in which you can configure more servers and their parameters. These settings will be distributed by the DHCP server along with the IP address. Server options act as a default for all the scopes in the DHCP server. However, scope options take preference over server options.

In my opinion, the DHCP server in Windows 2003 is excellent! It has been improved from the Windows 2000 version and is classified as essential for large networks. Imagine having to configure each and every client manually - it would take up a lot of time and require far more troubleshooting if a problem was to arise. Before touching any settings related to DHCP, it is best to make a plan of your network and think about the range of IPs to use for the computers.

Setting up & managing a file server in Windows 2003

A file server is a computer responsible for the storage and management of data in a central location. Network clients can access these files, therefore saving them from having to physically transfer data from one computer to another. Users are able to access files and applications at the same time. This will serve as a step-by-step guide on how to setup a file server in Windows 2003.

A file server is a computer responsible for the storage and management of data in a central location.
The specifications of a file server would normally consist of a large hard drive, a high CPU rate and decent amount of RAM. However, this may vary depending on the scale of how many requests the computer will be required to handle at once. Network clients can access these files, therefore saving them from having to physically transfer data from one computer to another. Users are able to access files and applications at the same time.

The administrator can configure the machine to be a dedicated fileserver; which would mean that the machine will only be used as a fileserver. Also, a non-dedicated fileserver; which would allow the fileserver to be used simultaneously as a workstation. File servers provide the ability to back up data with ease as everything is stored on one computer. Quotas can be set so that each user will have a certain amount of space on which he/she can save data.

Setting up a File Server

Navigate to the "Configure your server wizard" icon on the start menu and click it to open the configure your server application. Select the "File Server" role from the list and click next.

You will be asked whether or not you want to enable the indexing service (which allows people to search the contents of the file server). My recommendation is that you leave it off so as to better performance. However, this depends entirely on the way users would utilize your file server.

After this screen, click next again to run the "share a folder wizard". In the first screen, you are able to set which folder you wish to share. Type the location in the folder path or press browse to navigate to one.

In the next screen, specify the share name, description, and offline setting of the folder. The offline option allows you to specify if the contents of the folder will be available offline.

The last step is to set the permissions for the folder. This is a highly important part of the process as you will be specifying who is allowed to do what with the contents of each folder. The type of permissions you assign depends on the contents of the folder and, the person who is going to view it. As a general example, I have given administrators full, and everyone else read and write access to the public folder. This will allow people to view and edit documents or create a sub folder to store their personal files, for example.

Click Finish to confirm your actions and close the wizard. You can add more folders by opening the share a folder wizard from the file management console.

File Server Management

The file server management console acts as a central administration point for managing shared folders. The following is a list of all the features available to the file server administrator:

• Shares - displays the list of shares available to network clients
• Sessions - shows who is connected to what share
• Open Files - lists all the open files that the network clients are accessing
• Disk Defragmenter - allows you to analyze and defragment the hard drive
• Disk Management - lets you manage, partition, format and change the drive letter of hard disks

The shares section of the console also gives you the option to backup the contents of the file server. To do this you must click on "Backup File Server" on the right hand side of the window. This will bring up the backup wizard that will require you to make a choice of backing up or restoring files, what data is to be backed up and where the backup should be saved. Once all the choices have been made, the files will be backup up and saved to the location you specified.

Select "Send a console message" from the main window and you will be able to select a computer, or a number of computers, to send a message to. The recipient will receive a message box with whatever you have typed. This is useful if you want to send a quick message to users to tell them that the server will be down for maintenance, for example. Once you have selected the computers you want to send the message to, click OK.

The "Configure shadow copies" option can serve to be very useful. It allows you to keep a copy of a folder at different points in time. If there is an accidental deletion of the contents of a folder then it can be restored with this shadow copy. It also helps if the users want to view files they created in the past. Choose the volume of which you want to create a shadow copy, set the time at which you want the service to run and click OK. Alternatively, you can press "Create Now" to produce a shadow copy of the volume as it is at the present time.

If you right click on a share you can easily stop sharing that folder, view the contents of the folder by pressing Open or select Properties to bring up the window that will allow you to change permissions, set the user limit for the folder and change the description.

The rest of the options include "Refresh", which when clicked will refresh the list of shares, and "Add a shared folder", which brings up the wizard explained previously. This allows you to create and customize another shared folder.

The Sessions window displays which users are in a session and how long they have been connected. It also gives you the ability to disconnect the user from the session at any time by right clicking a certain user and pressing "Close session". You can also close all sessions by clicking the "Disconnect All Sessions" option in the main window. As you can see below, in this example, the administrator using a computer, Client02, has been connected to the session for one minute and 30 seconds, and has one file open.

The "Open Files" window shows who is connected to which file and allows you to disconnect all open files at any time.

Disk Defragmenter is a very useful tool which organizes files and in turn, makes file access faster. You can first analyze a partition and view the report to see whether or not degfragmentation is required. Press the Analyze button to start the analysis - if defrag is needed, it will give you the option to start defragmentation straight away. Should you wish not to analyze first, just press the Defragment button to start the process.

The Disk Management window allows you to manage disk partitions and CD-ROM drives and displays disk information in a list and graphical view. You can change drive letters, create and format a partition, and also set quotas and security permissions from the properties of each drive. The bottom half of the screen gives a graphical view of the drives and states their name, size, file system type, and status.

That concludes the File Server Management section of this article. We have taken a look at the features available in the file server management console and how to utilize them. The specific settings for each option depends on the type of system and the administrator's personal preferences.

With Windows 2003, the enterprise can benefit from the fact that employees are able to be more productive due to less downtime and easy retrieval of files and resources. As you have seen, the setup and configuration offered by the file server package in this operating system is quite user friendly and effective. The right configuration can provide stability, good performance and security to a company of any size.

NAT in Windows 2003: Setup and Configuration

This article will describe how to setup and configure NAT in Windows 2003. NAT, or Network Address Translation, is a widely used IP translation and mapping protocol that works on the network layer (level 3) of the OSI model. It is sometimes referred to as a routing protocol because of the way it allows packets from a private network to be routed to the Internet.

NAT acts as a middle man between the internal and external network; packets coming from the private network are handled by NAT and then transferred to their intended destination.

A single external address is used on the Internet so that the internal IP addresses are not shown. A table is created on the router that lists local and global addresses and uses it as a reference when translating IP addresses.

NAT can work in several ways:

Static NAT

An unregistered IP address is mapped to a registered IP address on a one-to-one basis - which is useful when a device needs to be accessed from outside the network.

Dynamic NAT

An unregistered IP address is mapped to a registered IP address from a group of registered IP addresses. For example, a computer 192.168.10.121 will translate to the first available IP in a range from 212.156.98.100 to 212.156.98.150.

Overloading

A form of dynamic NAT, it maps multiple unregistered IP addresses to a single registered IP address, but in this case uses different ports. For example, IP address 192.168.10.121 will be mapped to 212.56.128.122:port_number (212.56.128.122:1080).

Overlapping

This when addresses in the inside network overlap with addresses in the outside network - the IP addresses are registered on another network too. The router must maintain a lookup table of these addresses so that it can intercept them and replace them with registered unique IP addresses.

How NAT works

A table of information about each packet that passes through is maintained by NAT.

When a computer on the network attempts to connect to a website on the Internet:

• the header of the source IP address is changed and replaced with the IP address of the NAT computer on the way out
• the "destination" IP address is changed (based on the records in the table) back to the specific internal private class IP address in order to reach the computer on the local network on the way back in

Network Address Translation can be used as a basic firewall – the administrator is able to filter out packets to/from certain IP addresses and allow/disallow access to specified ports. It is also a means of saving IP addresses by having one IP address represent a group of computers.

Setting up NAT

To setup NAT you must start by opening the Configure your server wizard in administrative tools and selecting the RRAS/VPN Server role. Now press next and the RRAS setup wizard will open. The screen below shows the Internet Connection screen in which you must specify which type of connection to the Internet and whether or not you want the basic firewall feature to be enabled.

Press next to continue. The installation process will commence and services will be restarted, after which the finish screen will be displayed - showing what actions have taken place.

Configuring NAT

Configuration of NAT takes place from the Routing and Remote Access mmc found in the Administrative Tools folder in the Control Panel or on the start menu.

The screenshot below shows the routing and remote access mmc.

Select which interface you wish to configure and double click it. This will bring up the properties window giving you the option to change settings such as packet filtering and port blocking, as well as enabling/disabling certain features, such as the firewall.

The remote router (set up previously) properties box is shown below. The NAT/Basic Firewall tab is selected.

You are able to select the interface type – to specify what the network connection will be. In my example I have selected for the interface to be a public interface connected to the internet. NAT and the basic firewall option have also been enabled. The inbound and outbound buttons will open a window that will allow you restrict traffic based on IP address or protocol packet attributes. As per your instructions, certain TCP packets will be dropped before they reach the client computer. Thus, making the network safer and giving you more functionality. This is useful if, for example, you wanted to reject all packets coming from a blacklisted IP address or restrict internal users access to port 21 (ftp).

For further firewall configuration, go to the Services and Ports tab. Here you can select which services you would like to provide your users access to. You can also add more services by specifying details such as the incoming and outgoing port number.

The list of services shown in the above screenshot are preset. Press Add to bring up the window that will allow the creation of a new service or select an available service and press Edit to modify that service. You will be asked to specify the name, TCP and UDP port number and the IP address of the computer hosting that service.

If the services in the list aren’t enabled then any client computer on the Windows 2003 domain will not be able to access that specific service. For example, if the computer was configured as shown in the image above and a client computer tried to connect to an ftp site, he would be refused access. This section can prove to be very useful for any sized networks, but especially small ones.

That concludes this article. As you have seen, Network Address Translation is a useful feature that adds diversity and security to a network in a small to medium sized company. With the advent, and implementation, of IPv6 still in its beginning stages, we can expect to see NAT being used for many years to come.

DNS Stub Zones in Windows Server 2003

We would like to extend a warm welcome to Microsoft expert Mitch Tulloch as he presents his first article to the WindowsNetworking.com community. In this article we'll learn about stub zones, a new feature of DNS in Windows Server 2003. Stub zones can help reduce the amount of DNS traffic on your network by streamlining name resolution and zone replication. We'll examine how stub zones work, when you would use them, and how to set them up in this tutorial.

Stub zones are a new feature of DNS in Windows Server 2003 that can be used to streamline name resolution, especially in a split namespace scenario. They also help reduce the amount of DNS traffic on your network, making DNS more efficient especially over slow WAN links. This article will look in detail at what stub zones are, how they work, and when to use them. I'll also walk you through the process of creating a stub zone to facilitate name lookups between two separate forests. But first, a little background on DNS zones is necessary to see where stub zones fit into the overall picture.

Types of DNS Zones

A zone is a contiguous portion of DNS namespace managed by one or more name servers. Zones contain resource records that specify the name of the DNS server authoritative for the zone (SOA record), the names and IP addresses of all name servers in the zone (NS records), the names and IP addresses of other hosts (A records), aliases for hosts (CNAME records), and so on.

In the original implementation of DNS found in RFCs 1034 and 1035, two different types of zones were defined:

• Primary zones, which store their zone information in a writable text file on the name server.
• Secondary zones, which store their zone information in a read-only text file on the name server.

In the implementation of DNS on Windows NT, these two types of zones were referred to as standard zones. A typical scenario for a company that had a single Windows NT domain deployed would involve setting up two name servers on the network, one containing the standard primary zone (the primary name server for the domain) and the other containing the standard secondary zone (the secondary name server). Whenever a new host (for example, a file server) was added to the network, both these name servers had to be updated so clients could find the new host using DNS. To do this, the administrator would create a new A record on the primary name server since the only the primary zone could be modified. The primary name server would then notify the secondary that its records had changed, and the secondary would pull the updated zone information from the primary until it had an identical copy of the primary zone. From the perspective of the secondary name server, the primary name server represents the master name server for this zone.

The main problem with this arrangement was that if the primary name server went down, no changes could be made to the resource records since secondary name servers contained read-only zone information. Also, it meant that all the changes you made to DNS had to be performed on a single name server (the primary), which could be an inconvenience if the company spanned several locations.

Windows 2000 provided a solution to these issues by introducing Active Directory Integrated zones, which stored their zone information within Active Directory instead of text files. The advantages of this new type of zone included using Active Directory replication for zone transfers and allowing resource records to be added or modified on any domain controller running DNS. In other words, all Active Directory Integrated zones are always primary zones as they contain writable copies of the zone database.

Active Directory Integrated zones work well for most Windows 2000-based networks, but they do have some issues. One limitation is if you are dealing with two separate forests (disjointed namespace), a common scenario when companies are merging or form part of a conglomerate. For example, say Company A has close business ties with Company B and employees in Company A need access to resources on Company B's internal network. The usual way of providing them this access would be for the DNS administrator of Company A to add a standard secondary zone on each of Company A's name servers. These secondary zones would then point to name servers on Company B's network as their master name servers, and would obtain their resource records by zone transfers with Company B's name servers. While that works, it's overkill for several reasons. First, it generates a lot of zone transfer traffic between name servers in Company A and Company B, which can pose a problem if the companies are linked together by a slow WAN connection. Second, if Company B decides to decommission one of its name servers without telling the administrator of Company A, some of the secondary zones on Company A's name servers could suddenly find themselves without a master, and once their records expire the Company A clients that use them will no longer be able to access resources in Company B.

What Stub Zones Do

Enter stub zones to the rescue. A stub zone is like a secondary zone in that it obtains its resource records from other name servers (one or more master name servers). A stub zone is also read-only like a secondary zone, so administrators can't manually add, remove, or modify resource records on it. But the differences end here, as stub zones are quite different from secondary zones in a couple of significant ways.

First, while secondary zones contain copies of all the resource records in the corresponding zone on the master name server, stub zones contain only three kinds of resource records:

• A copy of the SOA record for the zone.
• Copies of NS records for all name servers authoritative for the zone.
• Copies of A records for all name servers authoritative for the zone.

That's it--no CNAME records, MX records, SRV records, or A records for other hosts in the zone. So while a secondary zone can be quite large for a big company's network, a stub zone is always very small, just a few records. This means replicating zone information from master to stub zone adds almost nil DNS traffic to your network as the records for name servers rarely change unless you decommission an old name server or deploy a new one. And to make replication even more efficient, stub zones don't use UDP as traditional DNS zone transfers do. Instead, stub zones use TCP, which supports much larger packet sizes than UDP. So while a typical zone transfer might involve many UDP packets flooding the network, stub zone transfer only involves a few packets at most. Also, while most DNS servers can be configured to prevent zone transfers to secondary zones from occurring, stub zones request only SOA, NS, and A records for name servers, all of which are provided without restriction by any name server since these records are essential for name resolution to function properly. Finally, since stub zones can be integrated within Active Directory (secondary zones can't), they can make use of Active Directory replication to propagate their information to all domain controllers on your network.

In our previous scenario, stub zones can be used instead of secondary zones to reduce the amount of zone transfer traffic over the WAN link connecting the two companies. To do this, the administrator for Company A would simply log on to one of the domain controllers, open the DNS console, and create a new stub zone that uses one or more of Company B's name servers as master name servers. By making this stub zone an Active Directory Integrated zone, the stub zone will then be automatically replicated to all other domain controllers on Company A's network. Now when a client on Company A's network wants to connect to a resource on Company B's network, the client issues a DNS query to the nearest Company A domain controller, which then forwards the query to one of Company B's name servers to resolve.

How to Create a Stub Zone

Let's see how it works in practice. In my lab I have two forests set up, one for Company A running Windows 2003 Server and named test2003.local, and the other for Company B running Windows 2000 and named test2000.local. The domain controller for the root domain of Company A is named SRV220 while the domain controllers for the root domain of Company B are named SRV210, SRV211 and SRV212. Sally is an employee of Company A and her desktop computer is named DESK231, and she needs to access a share named CATALOG located on SRV210 in Company B. To do this she clicks Start, selects Run, and types \\srv210.test2000.local\catalog and the result is an error:

This is because her command issues a DNS query against her name server SRV220 which has no information in its DNS database about test2000.local, the root domain of Company B:

To allow users in Company A to access resources in Company B, the administrator of Company A decides to create a stub zone for Company B's domain. To do this, right-click on Forward Lookup Zones in the figure above and select New Zone. This starts the New Zone Wizard:

Clicking Next brings up the Zone Type screen, and we'll choose Stub Zone here and select the checkbox to create an Active Directory Integrated stub zone:

Click Next and the Active Directory Zone Replication Scope screen is displayed, which we'll leave at its default setting for automatic replication of stub zone information to all domain controllers in the test2003.local domain.

Clicking Next displays the Zone Name screen, and here we type test2000.local as the name of the stub zone since this is the name of the target domain on Company B's network:

Clicking Next displays the Master DNS Servers screen, and we enter the IP address 172.16.11.210 for one of the name servers on Company B's network:

Clicking Next and then Finish runs the wizard and creates the new stub zone, which here is highlighted in the DNS console connected to SRV220 on Company A's network:

Note in the above figure that as expected the stub zone contains only an SOA record, an NS record for each name server in the domain, and an A record for each name server in the domain. Now when Sally clicks Start, selects Run, and types \\srv210.test2000.local\catalog a window opens up displaying the contents of the CATALOG share on SRV210 in the remote forest:

Summary

Stub zones are easy to create and can make name resolution between forests more efficient, but they have other uses as well. For example, stub zones can enable name servers to perform recursion without needing to query the Internet root name servers or internal corporate root servers, thus decreasing the number of hops between name servers and making name resolution more efficient. Another use of stub zones is to keep delegated zone information up to date and prevent lame delegations from wrecking name resolution within a forest, and that would make a good topic for a future article. Both of these are good topics for future articles, so stay tuned for more on stub zones later.

Installing DNS On Windows 2003

This tutorial will cover the installation of DNS on a Windows 2003 system. By reading through this tutorial you will learn about caveats that need to be noted when installing one of the most important services on a Windows network.

Key points will be highlighted that will help to make the installation of DNS on Windows 2003 effective. This article will have a security slant to it as security is a compelling part of any well built network. Planning of the DNS installation is beyond the scope of this article and will be covered in later articles.

The installation of DNS in itself is not at all complicated but mitigating aspects and considerations need to be addressed so that security is taken into account as well as planning and redundancy has been factored in to allow for normal operational downtime without disruption to the clients. Specific rules like where to place such a server and how to secure it needs to be taken into consideration and adequate planning will result in successful role out of the service.

TCP/IP uses an IP addresses to locate and connect to hosts, people are not partial to remembering numbers and prefer friendly names and thus the need for DNS (Domain Name Service). For example, users prefer the friendly name www.windowsecurity.com, instead of its IP address, 69.20.*.*. DNS is defined in RFCs 1034 and 1035, is used to provide a typical naming convention for locating IP-based computers.

Historically files located on the local machine were used these files were known as host files and need to be maintained and updated by an administrator on every machine so that the resolution of names could be easily facilitated. Imagine maintaining the hosts file for all of the internet domain names and sub domains today. Hence the birth of a distributed database that is around today called DNS, a wonderful service run by a myriad of ISP’s and internet authorities that facilitate the resolution of IP addresses into friendly names that users can type into their browsers or connect to resources with. For more information on the process refer to RFCs 1034 and 1035.

Windows 2003 DNS dependency.

If you are running Windows 2003 you will soon realize that a vital service that the active directory can not function without is DNS. The reason for this is that instead of using alternate methods like WINS (Windows Internet Naming Service) DNS is used as it is more versatile and platform independent. DNS is necessary as you already know to resolve names and the interoperation of active directory and other services and applications have come to rely if not take DNS for granted.

Securing your single point of failure.

DNS is very useful and necessary in all functional active directory networks for this reason it is recommended that the server computer where DNS is installed is secured and isolated from radical change. To insure that the server is always available be certain that no one makes changes to the server without testing and backing up the configuration. In most cases a successful backup strategy ensures that in the event of a minor mishap or disaster the configuration can be restored on an alternate system. Do not overlook DNS as complex configurations can be difficult to restore without documentation and prior knowledge of destroyed systems. It is always a good idea to mitigate your risk but splitting the DNS function onto two servers’ one primary and one secondary so that if the one goes down DNS has not lost availability. In terms of integrity you need to ensure that no one but authorized users have access and control over the DNS sever this is important as you do not want your resources abused and miss-configured by intruders that have other plans for you vital naming service. If you are in a high security environment it is essential that this server be locked down as it is an easy target for intruders that want to cause a denial of service on you active directory. It may be a good idea to only let LAN users that are part of the domain to query your DNS server to ensure confidentiality of your naming conventions and other sensitive information. By adding these additional layers to your DNS server you can be assured of.

DNS and firewalls.

DNS uses TCP and UDP port 53 for lookups and transfers. This needs to be opened on the firewall if you need to use your internal DNS for lookups. Note: this decision will be defined in the planning phase and should be carefully calculated. From a security perspective only publish services to the public domain if it is necessary. If you would like to administer the DNS server remotely you will need to open RCP port 135 only do this is it is necessary and if you have secured the server. If you are using ISA there are predefined protocol filters that have been define that you can enable.

Server preparation.

Most network professionals use DHCP when assigning dynamic IP addresses. In this exercise only use DHCP to assign the DNS server address dynamically to the client but do not assign the server a DHCP address, this will not only break your DNS configuration but will also render your DNS server non functional as the clients will be confused, and will not know where to find the DNS server as the address keeps changing.

Standard configuration

Please make sure that all of the Windows updates are done and the latest drivers and Rom packs have been loaded on the server and applied to the hardware this is essential as you do not want to be applying these changes at a later stage when the machine goes into production. Skipping this step will cause unnecessary down time in future. Please make sure that the static IP address is assigned to the server before beginning the installation process.

After the entire preamble we are now ready to start installing DNS on our newly configured and prepared server.

Ensure that you have Windows Server 2003 Std is installed and that a static IP address has been assigned. Figure 1.1 depicts how DNS should be configured and under the advanced TCP/IP settings. In the DNS settings you must point the server to itself for DNS resolution. If external internet names need to be resolved you can configure a forwarder so that the requests are sent to the DNS server of the ISP or an external DNS server. Selecting a DNS server that is consistently up is paramount as external name resolution rests on this resource.

Figure 1.1

Install Microsoft DNS Server

Click on Start, Control Panel, Add or Remove Programs and then on Add or Remove Windows Components. Then click on Components list, then click on Networking Services and then click Details, select the Domain Name System (DNS) check box, and then click OK. Follow the below figure 1.2 for guidance.

Figure 1.2

After installing DNS you will need to test if the installation was successful and if you are able to resolve names. Nslookup is a built-in utility that can be used to test if the service has been installed and configured correctly. Remember to test both internal and external names before concluding your tests. After typing Nslookup it connects to the configured server within your TCP/IP properties or if you run this command form a client it will connect to the DNS server handed out by DHCP. You will then be able to type in the name you want to lookup i.e. www.google.com or machine.localdomain.net it will then resolve the name to an IP address if this happens you have installed and configured DNS correctly.

C:\>nslookup
*** Default servers are not available
Default Server: UnKnown
Address: 127.0.0.1
help
Commands: (identifiers are shown in uppercase, [] means optional)

NAME	- print info about the host/domain NAME using default server
NAME1 NAME2	- as above, but use NAME2 as server
help or ?	- print info on common commands
set OPTION	- set an option
All	- print options, current server and host
[no]debug	- print debugging information
[no]d2	- print exhaustive debugging information
[no]defname	- append domain name to each query
[no]recurse	- ask for recursive answer to query
[no]search	- use domain search list
[no]vc	- always use a virtual circuit
domain=NAME	- set default domain name to NAME
srchlist=N1[/N2/.../N6]	- set domain to N1 and search list to N1,N2, etc.
root=NAME	- set root server to NAME
retry=X	- set number of retries to X
timeout=X	- set initial time-out interval to X seconds
type=X	- set query type (ex. A,ANY,CNAME,MX,NS,PTR,SOA,SRV)
querytype=X	- same as type
class=X	- set query class (ex. IN (Internet), ANY)
[no]msxfr	- use MS fast zone transfer
ixfrver=X	- current version to use in IXFR transfer request
server NAME	- set default server to NAME, using current default server
lserver NAME	- set default server to NAME, using initial server
finger [USER]	- finger the optional NAME at the current default host
root	- set current default server to the root
ls [opt] DOMAIN [> FILE]	- list addresses in DOMAIN (optional: output to FILE)
-a	- list canonical names and aliases
-d	- list all records
-t TYPE	- list records of the given type (e.g. A,CNAME,MX,NS,PTR etc.)
view FILE	- sort an 'ls' output file and view it with pg
exit	- exit the program.

If all is well when you type in nslookup in a command prompt you will be connected to the DNS configured either by DHCP or statically.

Summary

In this article I covered important stages of DNS installation and basic recommendations relating to security and architecture. It is important to understand these processes before installing DNS and to take the security recommendations into consideration before installing DNS. Remember that DNS is your central point of failure as it is the naming system that Windows uses.