Routing to the internet...

[synaesthesia]

Sounds easy - it SHOULD be easy, but I'm probably trying to make it harder than it is - bear with me!

 

We have a largish network, 4 servers etc etc all running CC3.

We're looking to move onwards and I'm in the process of setting up the first physical server with 2008 R2 (after a successful virtual test period).

 

However, the installation of some of the gubbins (namely SCCM) requires an internet connection to download a chunk of stuff. So, we need it to connect to our gateway but NOT the rest of the network (don't need DHCP/DNS taking anything over!)

 

Obvious solution: vlan. Out the window, the switches don't support it.

Short of finding a house nearby we can borrow internet from (yes, it's an actual possible solution thanks to closeby staff members!) is there some blatantly obvious solution I'm missing? My networking skills are clearly lacking currently

 

As a blind example: (IP addresses are not real)

 

Normal CC3 network running on IP addresses 192.168.5.11 - 192.168.8.250

Gateway (router) sitting on 192.168.5.1. Can't touch this - it's LEA/EMBC controlled.

 

Have a separate NIC in the new test server specifically for the internet. I've tried the obvious like setting an IP out of the subnet but with the above gateway address, no dice.

 

I'm sure there's a simple solution other than home-internet burgalry and buying new switches but I think my brain has been succesfully frazzled by SCCM

[localzuk]

Surely a simple static IP address would do what you want?

[synaesthesia]

That's what I thought - just set IP to something else (i.e. 172.16.1.1) and 192.168.5.1 as the gateway and bobs my uncle, but that doesn't seem to do the trick.

[localzuk]

That's what I thought - just set IP to something else (i.e. 172.16.1.1) and 192.168.5.1 as the gateway and bobs my uncle, but that doesn't seem to do the trick.

 

You'd need to put it in the same range as your gateway - so just pinch an IP from your network and assign it. It means you're not using your network's DHCP/DNS etc... but are within the subnet for your router.

[synaesthesia]

I knew it'd be something simple. Quite right - even though it might see the network etc, I'll be dishing out DNS/DHCP on the other adapter with an entirely different range. Brainfreeze!

 

Cheers fella.

[mounters]

You could configure a RRAS server (on 2008+ it's under NPS) to sit between the networks, set your test network up as 10.0.0.x (or whatever) and on the RRAS you'd need 2 nics one 10.0.0.1 (lets say) and 192.168.5.x (what you've got free on current network).

[SpuffMonkey]

Do you need a solution like the one that was suggested to me here

 

http://www.edugeek.net/forums/how-do-you-do/72587-vmware-esxi-networking-question.html

 

I'm 75% of the way through doing it - but have been dragged off to do other stuff

[webman]

An internal router would be useful for complete separation of networks to allow full testing of your new servers and services without interference between the two networks.

 

One interface will be connected to the current CC3 LAN segment and have an IP in the 192.168.5.11 - .8.250 range. The other interface will have a separate range (e.g. 172.16.0.1) that is also configured the same as your test server.

 

On the router, configure the gateway to be 192.168.5.1. On your test network, configure the default gateway of client machines and the server to be 172.16.0.1 (the router interface on that subnet).

 

 

A router can be as simple as IPCop/Linux running on an old workstation box with 2 NICs, or as mounters says, RRAS could do it.

[sted]

or get a cheap virgin broadband type router so new server goes to that (on an appropriate internal ip set on router wan port goes to normal network

[synaesthesia]

Might have a look at doing just that (using a cheapy router - both me and NM have spares at home that will do the trick!) to use for this instance. Cheers, Webman - just really want to be a little safer than trusting what Windows says

Funnily enough we've just moved away from doing it via ESXi/VMWare Hypervisor as the reason for setting that up was to run it alongside a couple of other test networks to compare which way we wanted to go. Due to SCCM we've happily settled on the vanilla side of things and therefore killed off ESX

Quite liked the way that worked to be honest, but as it didn't have drivers to use the RAID I wanted to go fully physical as soon as we could.

 

Cheers

[MatthewL]

Why can you not just plug it in on the normal LAN where you plug in your PC's and let it get a DHCP address? If you have DHCP and DNS installed on it just disable it.

 

Am I missing something or not?

[GrumbleDook]

Aren't you operating a flat network nowadays? Why don't you use the Admin VLAN range? That will still go out to the Net (gets filtered at level 1 as standard) and gives you a test network to get it running, without affecting the live systems. You use the existing router (which has the Admin VLAN and Curriculum VLAN on) and it still allows you to do what you want with no extra expense. If you need the range just log into T2S and it is in the Site Information section.

[cpjitservices]

Static IP is the way to go in this instance like someone has said nick one from your network.

[oxide54]

err, stop.

 

if all you need is the sccm updates to install it, then download them on a different machine (the text below is from a blog - link at the bottom )

 

When installing System Center Configuration Manager (SCCM aka SMS v4), it is not always possible to give internet access to the server involved. I like to have everything I need beforehand whenever doing an install.

 

When SCCM setup launches, it tries to download the ConfigMgr.Manifest.cab from here. Overall it is best to allow SCCM to grab all the files it needs automatically because the ConfigMgr.Manifest.xml file inside the ConfigMgr.Manifest.cab file can be updated by Microsoft to point to new locations when these files are updated or moved.

 

With that said, here are the links contained in ConfigMgr.Manifest.XML as of 12-15-07 for the RTM release of SCCM 2007, broken into groups:

 

Microsoft Remote Differential Compression Library

(x86, x64, ia64)

 

Windows Update Agent

(x86, x64, ia64)

 

WMI

(x86, x64, ia64)

 

BITS

Windows 2000 - KB 842773

(ARA, CHS, CHT, CSY, DAN, DEU, ELL, ENU, ESN, FIN, FRA, HEB, HUN, ITA, JPN, KOR, NLD, NOR, PLK, PTB, PTG, RUS, SVE, TRK)

 

Windows 2003 - KB 923845

x86: (CHS, CHT, CSY, DEU, ENU, ESN, FRA, HUN, ITA, JPN, KOR, NLD, PLK, PTB, PTG, RUS, SVE, TRK)

x64: (CHS, CHT, DEU, ENU, ESN, FRA, ITA, JPN, KOR, PTB, RUS)

ia64: (DEU, ENU, FRA, JPN)

 

Windows XP - KB 923845

x86: (ARA, CHS, CHT, CSY, DAN, DEU, ELL, ENU, ESN, FIN, FRA, HEB, HUN, ITA, JPN, KOR, NLD, NOR, PLK, PTB, PTG, RUS, SVE, TRK)

 

Save all of those files into a directory, and simply point SCCM to that directory for the updates instead of attempting to download them all.

 

If you are looking for a text file that just has all of the HTTP links inside for use with a downloader program, you can right click and 'Save as' the text file here.

 

Download links for the 88 files that System Center Configuration Manager needs during install - Aaron Tiensivu's Blog

[synaesthesia]

oxide54: Yeah, could have done that but I'd rather have a continual connection for updates etc. I want this to be as close to the real thing as possible.

 

The problem has been solved anyway just with the separate NIC on static IP with DNS and DHCP on the new DC serving only the "test" range. Worked well enough (until when I had a little tidy up this morning and plugged the test cable into the live network... thankfully caught it in time!)

 

Grumbledook : Bugger. Really should have thought of that one! In fact, I might reconfigure it next week to do just that, just to be on the safe side Cheers fella - I knew it would be simple

[tom_newton]

If its just web downloads... isolate with a proxy and no route?

[synaesthesia]

No need now thanks to the 'Dook's words of wisdom - that will in fact be quite useful in future testing products

[GrumbleDook]

You could mention about it at the next meeting ... an idea so that others can have a 'test' network to help prepare for design, deployment, maintenance and change management ... just a thought.

[cpjitservices]

good idea to have a "test network".....

[synaesthesia]

Good idea - no doubt plenty of others have forgotten about the admin range.