Help with Network layout

[mac_shinobi]

Just a general question - not actually setting up a network etc but I just wanted to know

 

Basically how would you setup and connect the network so that it is secure and what would connect to what for redundancy etc that includes the below items

 

* Domain Controllers ( regardless of being PDC OR BDC although I know they have changed this recently ) so effectively print servers / file servers / email server(s) etc etc

* Proxy Server

* Firewall

* VPN Solution

* Internet Connection ( Router or BT Connection or whatever )

* Core Switches

* Edge Switches

 

Also why would you connect the above items in that manner or way ?

@Arthur , @seawolf , @SYNACK

[featured_spectre]

1. Domain Controller
   
2. Core Switches
   
3. Email Server
   
4. File Server
   
5. Print Server
   
6. Anti Virus Solution - Could be a UTM or Server
   
7. Internet Connection - Doesn't matter if fibre or copper, as long as connection is stable at speeds we asked for
   
8. Proxy Solution - Could be a UTM or Server
   
9. VPN Solution
   
10. Edge Switches
    
11. Edge Machines
    
12. Group Policies

 

Based on your list, and expanded a bit, that is how I would get the network started from scratch.

[mac_shinobi]

1. Domain Controller
   
2. Core Switches
   
3. Email Server
   
4. File Server
   
5. Print Server
   
6. Anti Virus Solution - Could be a UTM or Server
   
7. Internet Connection - Doesn't matter if fibre or copper, as long as connection is stable at speeds we asked for
   
8. Proxy Solution - Could be a UTM or Server
   
9. VPN Solution
   
10. Edge Switches
    
11. Edge Machines
    
12. Group Policies
    

 

Based on your list, and expanded a bit, that is how I would get the network started from scratch.

 

Any chance of a network diagram so I can see whats connected to what. Also what is a UTM as you have that abbreviation a few times

[featured_spectre]

UTM = Unified Threat Management

 

and no, no diagram, not allowed to send it out unfortunately.

[mac_shinobi]

UTM = Unified Threat Management

 

and no, no diagram, not allowed to send it out unfortunately.

 

Not asking about your network setup - I just mean a general one so I can see what connects to what and why you connect those devices in that manner etc etc

[Norphy]

regardless of being PDC OR BDC although I know they have changed this recently

 

Recently? There haven't been backup domain controllers in Windows domains since Windows 2000 was released...

[mac_shinobi]

Recently? There haven't been backup domain controllers in Windows domains since Windows 2000 was released...

 

More global catalog servers and also how you promote the server as can be a domain controller or whatever else depending on the options you select etc , just guessing here ...

[tmcd35]

More global catalog servers and also how you promote the server as can be a domain controller or whatever else depending on the options you select etc , just guessing here ...

 

I think, what you are driving at are FSMO roles...

[Norphy]

Trying to be a bit more useful now...

 

We have a pair of HP 8212 switches acting as our cores. Connected to both of those are HP 5400 edge switches. There are various VLANs on them which handle traffic for digital signage, servers, workstations, voice, CCTV, e-registration and cashless catering and our DMZ.

 

All of our servers are connected to the server VLAN. Any which require publishing onto the Internet are put into the DMZ VLAN as well. Inbetween our internet connection and the main network is a SonicWALL UTM which handles filtering, publishing, virus scanning etc. There are two SonicWALL devices for hardware redundancy.

 

We don't have a failover internet connection yet but Janet are apparently investigating this for all of their connected institutions.

 

You need to have at least one GC per domain, preferably two. Three DCs per domain is the recommended minimum. The Infrastructure master role can't be on the same DC as a GC.

Edited March 11, 2014 by Norphy

[pete]

The Infrastructure master role can't be on the same DC as a GC.

 

While the BPA may whine, it can be on a GC if it's a) a single domain (infrastructure master has nothing to do) or b) all your DCs are GCs in a single or multi-domain/forest setup.

 

See: FSMO placement and optimization on Active Directory domain controllers down near the bottom.

[mac_shinobi]

I could seriously use a network diagram so I can physically see how it connects together....

 

Also with regards to DHCP and DNS, how do they work together and keep each other updated so as not to have out of date info ie

 

ComputerOne - assigned ip address info via dhcp, does dhcp update dns to reflect that ComputerOne has been given the address 1.1.1.1

 

Versus

 

ComputerTwo - assigned ip address info via dhcp which is updated in dns to reflect it has 1.1.1.2

 

Also how does DHCP know to assign the computers in the Client VLAN the ip addresses within the Client IP Scope so if I had a dhcp scope in DHCP for the Client VLAN, how would you ensure that only the clients within the Client VLAN get these ip addresses ?

 

So for example if I had an ip range of 1.1.1.2 all the way to 1.1.1.254 excluding loop back addresses and any others that can't be used, how would you get the Client VLAN to only get this dhcp range assigned to that vlan ?

Edited March 11, 2014 by mac_shinobi

[tmcd35]

I think this is the current edition: http://www.amazon.co.uk/Exam-Ref-70-410-Installing-Configuring/dp/0735673160/ref=sr_1_4?s=books&ie=UTF8&qid=1394546754&sr=1-4

 

Sounds like what you want/need is to work through the first half dozen chapters in a VM environment.

[Norphy]

Also with regards to DHCP and DNS, how do they work together and keep each other updated so as not to have out of date info ie

 

ComputerOne - assigned ip address info via dhcp, does dhcp update dns to reflect that ComputerOne has been given the address 1.1.1.1

 

Versus

 

ComputerTwo - assigned ip address info via dhcp which is updated in dns to reflect it has 1.1.1.2

 

With a Windows DHCP server, you can set it to update DNS as it assigns new IP addresses. In addition, a Windows client will always update its IP address with the DNS server when it boots. You can also force an update manually by running ipconfig /registerdns

 

Also how does DHCP know to assign the computers in the Client VLAN the ip addresses within the Client IP Scope so if I had a dhcp scope in DHCP for the Client VLAN, how would you ensure that only the clients within the Client VLAN get these ip addresses ?

 

So for example if I had an ip range of 1.1.1.2 all the way to 1.1.1.254 excluding loop back addresses and any others that can't be used, how would you get the Client VLAN to only get this dhcp range assigned to that vlan ?

 

I don't profess to be an expert in this area but as I understand it, there is a "helper" which listens on your switch/router. It forwards the DHCP request onto the DHCP server. The DHCP server sees that that request came from an interface on the router from a specific range and allocates it an address accordingly. As long as you have an appropriate scope set up on your DHCP server, it just works.

[featured_spectre]

[ATTACH=CONFIG]23278[/ATTACH]

 

Not the best, but here you go

[tmcd35]

I don't profess to be an expert in this area but as I understand it, there is a "helper" which listens on your switch/router. It forwards the DHCP request onto the DHCP server. The DHCP server sees that that request came from an interface on the router from a specific range and allocates it an address accordingly. As long as you have an appropriate scope set up on your DHCP server, it just works.

 

When a new machine needs an IP address from DHCP it broadcasts a request packet across the network. All machines on the network will recieve this packet. Only the DHCP server will respond. A more indepth breakdown can be found on wikipedia: Dynamic Host Configuration Protocol - Wikipedia, the free encyclopedia

[localzuk]

When a new machine needs an IP address from DHCP it broadcasts a request packet across the network. All machines on the network will recieve this packet. Only the DHCP server will respond. A more indepth breakdown can be found on wikipedia: Dynamic Host Configuration Protocol - Wikipedia, the free encyclopedia

 

Slight modification - all devices in the same subnet will receive the packet. If you have multiple subnets, with routing between them, the router will forward those requests to the DHCP server as specified in its config (or not, depending on your setup). If you don't have routing between subnets, the packet will only reach devices in that subnet - so a DHCP server on a different subnet would not receive it.

[mac_shinobi]

I don't profess to be an expert in this area but as I understand it, there is a "helper" which listens on your switch/router. It forwards the DHCP request onto the DHCP server. The DHCP server sees that that request came from an interface on the router from a specific range and allocates it an address accordingly. As long as you have an appropriate scope set up on your DHCP server, it just works.

 

What is stopping the dhcp server from assigning an ip address from a different dhcp scope that is meant for a different VLAN / Subnet or whatever and what forces dhcp to only assign a particular VLAN or subnet with a specific ip address from that ip address range from the relevant dhcp scope and not an ip address from a different or another dhcp scope ??

[featured_spectre]

If you set the DHCP server to assign a scope to a set of machines within Active Directory, that is what it will do, it wont work outside of those constraints

[mac_shinobi]

If you set the DHCP server to assign a scope to a set of machines within Active Directory, that is what it will do, it wont work outside of those constraints

 

never done that before - any links / guides on how you would do this ?

[featured_spectre]

Step-by-Step: Configure DHCP Using Policy-based Assignment < all on technet. Everything you need. You really need to work on your google searches!

[localzuk]

If you set the DHCP server to assign a scope to a set of machines within Active Directory, that is what it will do, it wont work outside of those constraints

 

I've never heard of Active Directory having any control over DHCP IP address issuance before, but that may be down to my never having looked specifically for it or had a need. DHCP itself handles VLAN based DHCP assignment based on the subnet of the VLAN. That's the extent of it as far as I know.

 

However, from the linked article:

 

The DHCP server determines the scope to which a DHCP client belongs based on the gateway IP address of the relay agent or the interface of the DHCP server on which it receives the DHCP client packet. Once the server determines the client scope, the server evaluates the DHCP packet against the policies applicable for the scope in the processing order specified. The policies applicable at a scope are those configured at the scope and those inherited from the server. A single client request can match multiple policies.

Edited March 11, 2014 by localzuk

[featured_spectre]

you can set the policies to pick the machines within an OU for machines. I learnt this in college, so if I am remembering badly, then fair enough I am happy to stand corrected.

[detjo]

never done that before - any links / guides on how you would do this ?

[tmcd35]

you can set the policies to pick the machines within an OU for machines. I learnt this in college, so if I am remembering badly, then fair enough I am happy to stand corrected.

 

That description sounds an aweful lot like GPO's, which to the best of my knowledge have no effect on DHCP.

[mac_shinobi]

Step-by-Step: Configure DHCP Using Policy-based Assignment < all on technet. Everything you need. You really need to work on your google searches!

 

Not having done or dealt with it before I had no idea what it would have been called and hence what I needed to search for *shrugs*

 

Hence the question which you kindly answered as per above - Thanks