In DHCP the client often needs to use to obtain the complete information it needs

Managing the Windows Server 2003 DHCP Server

☑

The DHCP MMC in Windows Server 2003 allows you to back up and restore the DHCP database without relying on command line utilities.

When a DHCP server is installed, the installation program adds two local administrative groups to the server, called DHCP Administrators and DHCP Users. DHCP Administrators have full administrative control over DHCP (but not over other aspects of the server), whereas DHCP Users have read-only rights to the DHCP configuration and scopes.

DHCP server statistics will alert you with different colored triangular icons when your scopes are getting close to and/or have been depleted of IP addresses.

DHCP

Dynamic Host Configuration Protocol (DHCP) is a protocol that will automatically assign TCP/IP addressing information to workstations over the network (see IETF draft standard RFC 2131, 2132, and 3397). The most common options set by DHCP are the network address, subnet mask, gateway, and DNS server address. There are many other options you can set with DHCP in including time server, domain name, and many others. One thing people often overlook is that DHCP is not just for Windows networks, there is a compatible protocol called Bootstrap Protocol (BOOTP) that does many of the same features as DHCP. When setting up DHCP on your network you should consider that DHCP uses broadcast packets and if you have any routers separating subnets, the DHCP server will only be accessible to the computers on that subnets as routers, as described earlier, do not pass broadcasts. If you need to pass DHCP information over networks separated by routers you can either setup a DHCP relay server or you can use the helper address feature on the Cisco routers. The helper address feature tells the router to “listen” for DHCP packets, and then the router repackages the packet into a unicast packet and sends it to the DHCP server on the other network and waits for the reply. It then repackages the packet to a broadcast and puts it back on the network for the client. If you are in an environment that has routers separating buildings DHCP packets would not cross the router as routers block broadcast traffic and DHCP is a broadcast protocol. To pass this traffic you would need a special service called a DHCP Relay server. This server listens for DHCP broadcasts and makes them a dedicated unicast packet and sends it to the DHCP server on the other side of the router and waits for the answer packet and turns it back into a broadcast.

Deploying DHCP

DHCP is installed by adding the DHCP role in Server Manager. The initial set up process will install the DHCP components and will take you through the initial configuration of the DHCP server. To add the DHCP server role, perform the following steps:

Open Server Manager from Start | Administrative Tools | Server Manager.

Click to highlight the Roles node in the left pane. Then click the Add Roles link in the middle pane. This will launch the Add Roles Wizard.

Click Next to begin the installation process.

Select DHCP Server from the list of available roles (see Figure 3.51). Then click Next.

You will be taken to the DHCP summary page. Click Next to continue.

The first configuration option will ask you to provide the domain name and the DNS Servers to provide to each client. These are the DNS Servers that each DHCP client will use for name resolution. Enter the IP address of two DNS Servers on your network, and then click Next.

If you are using WINS, you will need to specify the IP addresses of the primary and secondary WINS servers. If WINS is not used, leave the option WINS is not required for applications on this network selected. Then click Next.

You are now ready to set up a DHCP scope. Remember that a scope is the range of IP addresses you want to make available to DHCP clients. Enter the DHCP range as seen in Figure 3.52. At this stage, you can also set the subnet mask and default gateway to be used by DHCP clients. After setting the scope range and options, click OK. Then click Next.

If you are using IPv6, you can now add the DHCPv6 configuration information. For our example, we will disable stateless DHCP mode for the server. Then click Next.

You will now need to authorize the DHCP server in AD, assuming that you have AD deployed on your network. DHCP authorization ensures that only authorized DHCP servers can offer IP addresses to DHCP clients. Choose or enter credentials that have the ability to authorize DHCP servers (see Figure 3.53), then click Next.

You will now see the DHCP install summary screen. Verify whether the settings are correct. Then click Install. This process will now install, perform initial configuration, and authorize DHCP.

Once the installation is completed, you should see an installation success message. The server should now start to lease IP addresses to DHCP client computers.

The DHCP Management console will appear under the Roles node in Server Manager. You can go here to change configuration options, including changing lease settings or adding additional scopes.

Notes from the field

Dynamic Host Configuration Protocol

DHCP is used for automatically configuring devices that join a TCP/IP-based network. This configuration can include elements such as an IP address, subnet mask, DNS server addresses, a default gateway address, and other configuration information. A server set up to use DHCP and host the configuration information in a local data store provides this configuration information. DHCP uses UDP port 67 on the server side and UDP port 68 on the client side. DHCP also has two versions: DHCPv4 and DHCPv6 to support IPv4 and IPv6, respectively. These two versions, much like the two versions of IP, are very different and are therefore considered separate protocols and use separate ports. DHCPv6 uses UDP port 546 on the client side and UDP 547 on the server side.

The process for obtaining DHCP configuration information is pretty simple: Discover, Offer, Request, and Acknowledge (DORA). The DHCP client broadcasts a message called a DHCP discover message. The server will reply with a DHCP offer message that includes an offered IP address, subnet mask, and some other data. If the client agrees to accept the address, it will respond with a DHCP request message to let the server know that it will be using the offered address. Finally, the server responds with a DHCP acknowledge message that includes the time that the address lease is valid as well as any other information requested by the client.

There are two additional message types used with DHCP. The first is a DHCP information request which is sent by the DHCP client. This is effectively a request for additional configuration information that may not have been included in the initial DHCP offer message. There is also a DHCP release message that can be used by the client. This isn’t required as the DHCP lease will expire at its configured expiry time, but it can be used optionally prior to requesting a new address or new lease of the same address if there is a need.

Most enterprise applications are configured to use static IP addresses for the servers that host the application, but it is also possible for those servers to use a dynamic address with a DHCP reservation. A DHCP reservation will offer the same IP address lease to a system by using the NIC’s MAC address to identify it. Client systems, on the other hand, are usually configured to use DHCP without address reservations except under special circumstances. There are some potential issues that can arise with DHCP configuration that can cause the enterprise application to be unavailable or act oddly for the client system. We’ll discuss this further in the Network Troubleshooting section.

DHCP

It might seem odd to spend so much time in a chapter on DHCP discussing BOOTP and TFTP. But much of what DHCP does and the way it accomplishes its functions is similar to the operation of these two earlier protocols. DHCP involves a more complex exchange of messages between client and server, but the intention was always that servers could provide both BOOTP and DHCP functions with a minimum of recoding.

DHCP was once referenced in BOOTP RFCs 1533 and 1534, but as an “extension” of BOOTP capabilities. Currently, RFC 2131 describes DHCP and distinguishes it from BOOTP. Not only does a DHCP server allocate addresses to clients, but it also maintains parameters for individual clients and entire client groups, greatly enhancing the efficiency of the entire system. In general, DHCP is designed to:

Be a mechanism. No “policy” or ideas about IP address allocation schemes are assumed by DHCP. However, DHCP can be the mechanism on which such policies are built.

Do away with manual configuration. A user should always be able to simply plug their devices into the network and work. (The requirement to configure DHCP, if not the default, is beyond DHCP’s control.)

Handle many subnets from one server. DHCP employs the BOOTP relay agent concept, mostly implemented in routers, for this purpose.

Allow multiple servers. For redundancy and reliability, clients and servers must be able to deal with more than one DHCP server.

Coexist with statically addressed hosts. As mentioned, dynamically addressed servers are a challenge for DNS and the user in general. DHCP must allow these hosts to function properly.

Support BOOTP. DHCP can use BOOTP relay agents and must be able to service BOOTP clients.

Guarantee unique addresses. No address can ever be assigned to two clients at the same time.

Retain client information. The servers must retain all client parameters in case of failures or between shutdown and start-up.

If the addresses handed out by DHCP were permanent, there would be little difference between static assignment or the way that BOOTP operates. But the DHCP association between client and address is called a binding, or, more commonly, a lease. And like any lease, it must be renewed periodically or become available for assignment to a new client.

The pool of IP addresses handed out by the DHCP server is called a scope. A collection of scopes gathered for administrative purposes is known as a superscope.

Managing Automatic Addressing Using DHCP Services

Administrators use DHCP in medium to large computer networks to manage automatic assignment of IP addresses to DHCP clients. It is easy to manage DHCP servers using the GUI when you have just a few DHCP servers in the organization. However, when you must manage multiple DHCP servers spread across different locations of the organization and connected by slow wide area network (WAN) links, you may find that NETSH is a better tool for managing DHCP services than the usual GUI.

The NETSH DHCP prompt is located within the NETSH environment. To access the DHCP prompt, just type DHCP at the NETSH> prompt and press Enter. The following prompt is displayed:

Within the DHCP> prompt, several commands are available for managing DHCP servers. These are mainly categorized as follows:

NETSH DHCP

NETSH DHCP SERVER

NETSH DHCP SERVER SCOPE

NETSH DHCP SERVER MSCOPE

NETSH DHCP

The commands available from the DHCP> prompt are listed in the following sections.

Server

The Server command shifts the context of the DHCP> prompt to the specified DHCP server. The syntax of this command is:

You may specify the DHCP server by its name or by its IP address. When you use the name of the DHCP server, you must precede the name with double backslashes (\\).

Show Server

You use the Show Server command to obtain a list of DHCP servers that are authorized in Active Directory. The syntax of this command is:

There is no required parameter with this command.

Add Server

You use the Add Server command to add a new server to the list of authorized DHCP servers in Active Directory. The syntax of this command is:

The parameters of this command are:

▪

ServerDNS Specifies the DNS domain name of the DHCP server that you want to add to the list of authorized DHCP servers in Active Directory.

▪

ServerIP Specifies the IP address of the DHCP server that you want to add to the list of authorized DHCP servers in Active Directory.

The following example illustrates use of the Add Server command:

This command adds a DHCP server named DHCPServ1.books.syngress.com with an IP address of 192.168.0.10 as an authorized server in Active Directory.

Delete Server

You use the Delete Server command to delete a DHCP server from the list of authorized servers in Active Directory. The syntax of this command is:

The parameters of the Delete Server command are similar to those of the Add Server command. The following example illustrates use of the Delete Server command:

This command removes (deletes) a DHCP server named DHCPServ1.books.syngress.com with an IP address of 192.168.0.10 from the list of authorized servers in Active Directory.

Dump

The Dump command dumps the configuration of a specified DHCP server to the command prompt window or to a specified file. If you do not use any parameters with this command, the configuration of the DHCP server that is currently in focus is displayed in the command prompt window. The syntax of this command is:

Here are the parameters of this command:

▪

\\ServerName Specifies the name of a remote DHCP server. You must precede the name with double backslashes (\\).

▪

IPAddress Specifies the remote DHCP server by its IP address.

▪

Filename Specifies the name of the file where you want to direct the output of the command. The configuration of the specified DHCP server is saved in this file.

It is important to note that you can use either the name or the IP address of the remote DHCP server. You need not use both of these parameters.

Master Craftsman …

DHCP Servers

Saving the configuration of a DHCP server is useful when you need to diagnose problems with any DHCP servers in the network, Microsoft recommends that you reconcile all scopes on the specified DHCP server. This will ensure that if there are any inconsistencies with the scopes, they are removed. When the DHCP configuration is saved in a text file, the same file can be copied to another DHCP server to configure it. This not only saves you time in configuring a new DHCP server from scratch, but it also ensures that the configuration is correct and accurate.

For example, the following command dumps the configuration of a DHCP server to a text file named DHCPConf.dmp:

When you execute this command, you can copy the file to another DHCP server and use the EXEC command to copy this configuration to the destination DHCP server. You must not open the DHCP console before using the EXEC command. You must also delete all default server options, scope options, and any defined user or vendor classes. You use the EXEC command as follows on the DHCP server:

Once you execute this command, you can start the DHCP services on the destination server using the following command:

The changes in the configuration of the destination DHCP server take place after the DHCP service starts.

NETSH DHCP SERVER

You can narrow down the NETSH DHCP prompt to a single DHCP server by typing SERVER at the DHCP> prompt. The prompt changes as follows:

Within the DHCP SERVER prompt, there are several different subcommands that you can use to manage a single DHCP server. You can use these commands to view, configure, add, delete, import, or export the DHCP settings. The following sections discuss these commands.

Viewing Configuration Settings

The following commands are available for viewing DHCP server settings. Most of these commands are self-explanatory.

It is interesting to note that most of these commands do not require any parameters.

Configuring the DHCP Server

The following subcommands are available for configuring the DHCP server:

Besides the preceding commands, you can authorize a DHCP server in Active Directory by using the following command:

This command initiates the process pf authorizing the current DHCP server in Active Directory.

NETSH DHCP SERVER SCOPE

You can narrow down the NETSH DHCP SERVER prompt to a single DHCP scope by typing SCOPE at the DHCP SERVER> prompt. The prompt changes as follows:

Within the DHCP SERVER SCOPE prompt, there are several different subcommands that you can use to manage a single DHCP server scope. These commands are discussed in the following sections.

Viewing the Scope Configuration

The following subcommands are available for viewing the current configuration of a DHCP server's scopes:

It is interesting to note that most of these commands do not require any parameters.

Configuring a Scope

The following subcommands are available for configuring DHCP server scopes:

You can initiate the process of reconciling a DHCP server scope by using the following command:

When you execute this command, the DHCP server starts reconciling the configured scopes.

6 Dynamic Host Configuration Protocol (DHCP)

With the success of TCP/IP in the corporate community during the past several years, there has been a need for automated configuration of networking for desktop PCs and laptop computers. Most users neither know how to configure the TCP/IP parameters on their desktop computer nor desire to know how to do this. The need for automated network configuration of desktop computers has been met by the Dynamic Host Configuration Protocol (DHCP) [29]. With DHCP, the computer sends out a DHCP Request when it boots up, this is relayed to the DHCP server responsible for that LAN, and then the DHCP server sends a DHCP reply back to the requesting computer. This reply contains the IP address and other networking configuration needed by the requesting computer. The requesting computer then configures itself using the information contained in the DHCP reply message, sparing the user the effort of manual configuration.

DHCP

DHCP servers are used to configure Transmission Control Protocol/Internet Protocol (TCP/IP) parameters for a host as they connect to a network, including

IP address

Name servers

Configuring the routing, including the default route

Fast Facts

The main aspects of the DHCP you need to remember are as follows:

DHCP allocates IP addresses to hosts on a permanent or temporary basis.

Temporary IP addresses are said to be leased to a client by the server.

Leased IP addresses can be renewed or relinquished.

The list of leases is kept in dhcpd.leases, usually in /var/db.

DHCP maximizes the usage of IP addresses available by allocating addresses on an as-needed basis.

DHCP servers usually have fixed or static IP address.

Installing DHCP Using Server Core

DHCP is also a role that is supported in a Windows Server 2008 Core installation. DHCP installation is handled via the command line of the Server Core installation. However, management of the DHCP server (as well as the DHCP scopes) can be controlled from a remote Windows Server 2008 system. In this section, we will install the DHCP role and configure a DHCP scope using the Server Core command line. Let's begin by installing the role:

Sign in to your Windows Server 2008 Core Server system.

Install the DHCP bits. To do this, type in start /w ocsetup DHCPServerCore(Figure 4.6).

Start the DHCP service and set it to start automatically. To do this, type in sc config dhcpserver start= auto.

Type sc query dhcpserver. If the service is not running, start it by typing sc start dhcpserver. You can see the command syntax in Figure 4.7.

Next, we need to configure our DHCP server by adding the DHCP scope. To do this, we must first start the netshapplication. At the command prompt, type netsh.

At the netsh>prompt, type dhcp server.

Add the DHCP Scope at the dhcp server>prompt by typing in initiate auth.

Add the scope by typing in add scope 10.0.0.0 255.0.0.0 BackupScope. 10.0.0.0 indicates the network leased by the DHCP server, while 255.0.0.0 represents the subnet mask. BackupScope is the name we've given to the scope.

Type in scope 10.0.0.0. This allows us to begin adjusting the scope options.

Configure the start and end of the lease range. To set the start of the range, type set optionvalue 003 IPAddress 10.0.0.1.

To set the end of the range, type set optionvalue 006 IPAddress 10.0.0.50.

Enable the scope by typing in set state 1.

Type exitto close the netsh application. The preceding syntax can be seen in Figure 4.8.

Dynamic Host Configuration Protocol

DHCP allocates IP addresses in one of three ways:

Manual allocation: The device running DHCP (a server or router) has a table that pairs MAC addresses with IP addresses. Whenever a device powers up and enters the network, it requests an IP address from DHCP. DHCP looks up the MAC address in its table and issues the associated IP address. If the MAC address isn't in the table, the device doesn't get an IP address and therefore isn't allowed on the network. The setup of manual allocation is time consuming for a network administrator, but does provide a measure of security because only authorized devices can connect.

An alternative point of view is that it is less time consuming to configure a set of manual IP addresses in one central location (the DHCP server) than to go around and configure all of the clients with static IP addresses. By doing it with manual allocation, all the clients have to do is plug in and they will start working. Additionally, if a device is used in multiple environments (home/office/and so on), it is more difficult to use static settings on the client since they have to be changed each time the device moves to a new network.

Automatic allocation: A network administrator supplies a range of IP addresses to DHCP. DHCP then issues an unused IP address from this range the first time a device requests an address. The address is permanently assigned to the device and will not be reused on the network, even when the device powers down.

Dynamic allocation: A network administrator supplies a range of IP addresses to DHCP. DHCP then issues an unused IP address from this range to a device each time the device connects to the network. When the device disconnects—usually when it powers down–the IP address is returned to the pool of unused addresses to be assigned to another device.