This is the part 2 of the series of articles which explains complete setup of VPN in windows server environment.

Allow VPN connections to the server ( 25 connections for the setup)

1.    Open remote and routing mmc by start > administrative tools > routing and remote access.
2.    in the routing and remote access mmc, expand the section with server name, and then right click on “ports” and then click “properties”

3.    In the port properties dialog box. Double click “WAN Miniport (SSTP)”

4.    In the configure device – WAN miniport (SSTP) dialog box, assign a value of 25 in the Maximum ports box and click ok.

5.    In routing and remote access dialog box, click yes to continue

6.    In the port properties dialog box, double click WAN Miniport(PPTP), and in the configure device –WAN Miniport (PPTP) dialog box, assign the value of 25 in the maximum ports box and click ok.

7.    In the routing and remote access dialog box, click yes. Then repeat the step to do the same config for WAN Miniport (L2TP)

Configure Network Policy

It is import to apply the network policies to control the access. In this demo I will explain how to make custom network policy on the NPS.

1.    To open NPS mmc go to start > administrative tools > Network policy server

2.    In the mmc expand the “Policies”, right click on “Network Policies” and then click new.

3.    In the next windows type name for the policy in policy name box and in the “type of network access server” drop down list click “remote access server (VPN-Dialup) and then click yes.

4.    On the specify condition page, click add on the select condition dialog box, scroll down and double click on tunnel type.

5.    In tunnel type dialog box type L2TP,PPTP and SSTP click ok .

6.    Also can configure the users group who allowed for the VPN connection. This is a good controlling method and secures method rather than allowing every one for VPN.

7.    To do it again in condition page click add and then from the pop up select “users groups” and double click

8.    On the next window can select the groups’ needs to allow for the connection. Then click ok twice on open windows to continue.

9.    After define conditions, click next to continue.

10.    On the specify access permissions page, leave the default of access granted and click Next.

11.    On the configure authentication methods page, clear MS-CHAP and click yes as in this setup not using it.

12.    On the next page, under constrains, click day and time restrictions and in the detail panel select allow access only on these days and times and click edit.

13.    Using this method it’s possible to control when its open for VPN connections. In the day and time restriction box, click on the first blue rectangle in the left hand corner the represent Sunday midnight to 1am. Hold the mouse button and drag the cursor ot highlight all of Sundays. Click denied. Repeat this for Saturday. The idea of this is to prevent VPN dial in over the weekends. To complete click ok and then next.

14.    On the configuration setting page, under settings click encryption and in details window clear all settings except strongest encryption (MPPE 128-bit). This is the encryption standards which only allow. Click next then finish.

This will create the custom policy to apply for the vpn connections.

This article is part 1 for explaining the setup of the VPN on windows server environment. This demo is done using windows 2008 R2 but the theory will be same for windows 2012.

In this set of article i will be doing the following,

1. configure inbound and outbound VPN connections
2. configure remote access policies to control the access of various groups via RRAS
3. configure a RADIUS server to log all accounting
4. monitor remote access

To do the setup it needs the following,
•    A server with windows 2008 / R2 which is connected to the company domain
•    Two NIC configured for local network access and public access
•    IP address allocation
•    Authentication provider ( Network policy server, RADIUS )
•    DHCP relay agent
•    User account with domain administrator privileges.

In this setup I will be using Network Policy Server as the authentication provider. Before start on setup it’s important to know the use of it. According to Microsoft (http://technet.microsoft.com/en-us/library/cc732912.aspx)
Network Policy Server (NPS) allows you to create and enforce organization-wide network access policies for client health, connection request authentication, and connection request authorization. In addition, you can use NPS as a Remote Authentication Dial-In User Service (RADIUS) proxy to forward connection requests to a server running NPS or other RADIUS servers that you configure in remote RADIUS server groups.

NPS allows you to centrally configure and manage network access authentication, authorization, and client health policies with the following three features:

•    RADIUS server . NPS performs centralized authentication, authorization, and accounting for wireless, authenticating switch, remote access dial-up and virtual private network (VPN) connections. When you use NPS as a RADIUS server, you configure network access servers, such as wireless access points and VPN servers, as RADIUS clients in NPS. You also configure network policies that NPS uses to authorize connection requests, and you can configure RADIUS accounting so that NPS logs accounting information to log files on the local hard disk or in a Microsoft SQL Server database.

•    RADIUS proxy . When use NPS as a RADIUS proxy, can configure connection request policies that tell the NPS server which connection requests to forward to other RADIUS servers and to which RADIUS servers you want to forward connection requests. You can also configure NPS to forward accounting data to be logged by one or more computers in a remote RADIUS server group.

•    Network Access Protection (NAP) policy server . When configure NPS as a NAP policy server, NPS evaluates statements of health (SoH) sent by NAP-capable client computers that want to connect to the network. NPS also acts as a RADIUS server when configured with NAP, performing authentication and authorization for connection requests. You can configure NAP policies and settings in NPS, including system health validators (SHVs), health policy, and remediation server groups that allow client computers to update their configuration to become compliant with your organization's network policy.

We can configure NPS with any combination of the preceding features. For example, you can configure one NPS server to act as a NAP policy server using one or more enforcement methods, while also configuring the same NPS server as a RADIUS server for dial-up connections and as a RADIUS proxy to forward some connection requests to members of a remote RADIUS server group for authentication and authorization in another domain.

Let’s move in to the configuration as next step,
For the setup I log in to a server which is connected to the company network. It is running windows 2008 standard version.
 
Before we start for a selected server in domain we need to add 2 nic interfaces. One will be to serve for LAN and other NIC will have a public ip address.

For the server I already add 2 nic and configured the ip address as following,
For LAN Interface
Ip address : 192.168.20.2
Subnet : 255.255.255.0
Default Gateway : none
DNS servers : none

As we know in a same machine we cannot deal with different default gateways. There for we no need to put gateway here.

For Public Interface
Ip address : 10.0.0.2
Subnet : 255.255.255.0
Default Gateway : 10.0.0.1
DNS servers : 8.8.8.8 ( public dns from ISP )

This used public ip info is just for demo purposes and these are not real public ip from ISP. But in real setup you need to fill that info with the details provided by the ISP.

In the server I have renamed the 2 interfaces according to ip as “private” and “public” for easy identification.

Install Network Policy and Access Service role

1.    To start the server manager Start > administrative tools > Server Manager

2.    In the Server manager windows right click on the “Roles” and click on “Add Roles”

3.    Then add doles wizard will appears. Click next to continue.

4.    On the select server roles page, select “Network policy and access services” and click next.

5.    In “Network policy and access service introduction” page, click Next.

6.    On the select role service page, select the “network policy server” and “routing and remote access services” check boxes and click next.

7.    On the confirmation page click “Next” to continue.

8.    On the installation result page, verify the “installation succeeded” appears in the detail pane then click close to complete.

Configure VPN Server

1.    To start “Routing and Remote Access” mmc, click on start > administrative tools > routing and remote access.

2.    In the mmc, click on the server name, right click on it and from options click on “Configure and enable routing and remote access”

3.    Click next on welcome page to continue. On the configuration page, leave default “Remote access (dial-up or VPN) selected and click Next.

4.    On the remote access page, select the “VPN” check box and click next.

5.    On the VPN connection page, select the “Public” interface and then click next.

6.    On the IP address assignment page, select “From a specified range of addresses” and then click next.

7.    In the address range assignment page, click new and in the “start ip address” box, type the value of 10.0.0.5. in the “number of addresses” box type the value of 75 and click ok, then click next to continue.

8.    On the managing multiple remote access servers page, leave the default selection “No, use routing and remote access to authenticate connection requests” and click next, and then Finish.

9.    In the routing and remote access dialog box, click ok.

10.    In next dialog box about DHCP relay agent click Ok too.

When most business grows it mostly will expand in to different branches in different geographical locations. It may be expanding its sales to different areas even to different countries. It creates new situations to apply appropriate networking technology solutions which help for company operations. The branch offices will need to be part of the cooperate network to access company data and continue on operations. There can be sales peoples who conducts demonstrations from remote locations which also need to access cooperate network time to time. Since “virtual office” concept is growing there can be employees who works remotely which also need to be part of the cooperate network.

The old and traditional way of doing this setup is to use “Leased Lines”. In this solution each branch office, sales peoples, remote workers will connect to the cooperate network via dedicated communication links. The connection is almost will be physical connections using cable media and the link will be fully dedicated for communication between those selected points (ex- Cooperate office to Branch office). The connection will be secure and runs with high bandwidth.

Even though it’s reliable, high bandwidth secure lines there are some issue involves applying this solution for most of the modern day requirements. Let’s examine few of the issues in details.

Is there any other solution than lease line which can use without these types of issues? Yes it is we called it as VPN (Virtual Private Network). Its simply creates “virtual” private network similar to leased line over public network. So there is no physical leased line, but it creates secure tunnel between two locations over Internet. This we can also call as virtual leased line. Most of ISP, provides VPN solutions which will suite your requirement but you also can create your own VPN solutions based on VPN appliance or based on software such as windows routing and remote access.

Even Though its make connection over the internet it is secure tunnel which transfer only encrypted data. There are many security protocols that VPN can configure with.

•    IPSec ( IP Security )
•    L2TP ( Layer 2 tunneling Protocol )
•    PPTP ( Point to Point tunneling Protocol )
•    SSL/TLS ( Secure Socket Layer/Transport Layer Security)

First 3 methods are works on OSI network layer. When use this most of the time it will need a VPN client install on the host to connect to the VPN server or appliance.

The SSL/TSL is works on OSI Transport layer. So it will be working on industry standard SSL port 443 and no need to use custom ports for VPN connections. The connection setup from client end is easy as it can be perform via web browser.

One of the main advantage of VPN is the low implantation and operation cost. If you have public ip with proper internet connection you can simply setup your on VPN server and allow the clients to dial in to it. You do not need to spend money on additional hardware, services, and resources for it. The operation cost also will be very low or null. For ex Microsoft Remote Access solution is comes with the windows server operating system in built. To set it up all you need to do is add the role and configure it. It will not involve any license cost, monthly fees, maintains fees or services charges like we do have with leased connections. 

The other beauty of VPN is that it support for mobility. As we discussed it do not have any physical connection between the locations. If you have internet connection you can use VPN to connect to cooperate network from anywhere in the world. It can be via your mobile, smart phone, pad, laptop etc. This is very best solution for mobile sales peoples, management staff which travels on business matters. All they need is working internet connection. It doesn’t matter if you in hotel, road, airport, bus stop if you connected to VPN you will be part of corporate network.

One of another advantage of using VPN is it will not have dependency on service providers. There are certain situations such as cooperate site-to-site VPN solutions which may use via service provider but majority of the VPN connection solutions are not depend on the service provider. In leased line if you got connection from particular ISP you always have to depend on that service provider to get connected. If line has issues you have to wait till they fix it. But in VPN solutions all you need is working internet connection. It doesn’t matter which ISP you connects from. For ex- In home office let’s assume you using VPN connection to connect to office network. While you working, the DSL connection you using as primary internet connection starts to drop. But you have mobile internet connection from another service provider. You can simply plug in the dongle and connect to VPN via and continue your work. You will not need to change any VPN connection settings to do it.

If you take a leased line solution some time it may be a combination of different ISP, different technologies. There for to maintain/troubleshoot it will take time and complex routine. But on a VPN it’s easier to maintain and troubleshoot. Mostly it will be due to failure of internet connections. Other than that very rarely it involves any complex troubleshooting routine specially because no physical connection.

Considering all these facts it’s obviously VPN is the best solution to use for remote access.

There are different solutions such as Remote desktop Services, Terminal services, Citrix Solutions which can use for the remote access. All those have different pros and cons but here I only compare the leased line solution and the VPN solution.

There are situations where some pc, servers should have fixed ip always. One way to do is assign static ip to those devices. But since DHCP intend to go away from static mappings there is way we can reserve a IP address for a device using DHCP config. So when the particular computer or device request IP from DHCP server it will check with its IP reservation rules and issue the IP address define on the rule. So always this particular machine will get the same IP address.

This reservation is doing based on the MAC address which used by the computer which needs permanent ip. MAC is unique address so it wants make any conflict with any other computer in the network.

In the demo I will explain how to do a reservation and how it’s working.

As first step need find the MAC address of the client pc which needs a reservation. To find it log in to the computer and open command prompt > type ipconfig /all. In their it shows the MAC as below. Before do this make sure the PC is set to DHCP as described in previous section.

Now need to log in to the server where DHCP configured. Then open the DHCP console > expand IPV4 > expand the Scope required the config.

Then right click on reservation and select option “New reservation”

In next window can define the ip address which will be map to this reservation, the MAC address of the client pc and description. Also can select if its BOOTP reservation or DHCP reservation. In here I choose both. Once done click ok “add” to complete the reservation.

Then need to go back to client PC and type following commands in CMD

•    Ifconfig /release – This is to release the DHCP address it had
•    Ifconfig /renew – This is to get new ip from the DHCP server

Then it shows it’s got the IP address as set in the reservation.

In the DHCP server reservation section also will show it as the reservation is active.

Let’s see how we can configure DHCP server in a Windows Server Environment. For the demo I will be using Windows 2008 R2 Server.

To start first need to log in to the server with administrator privileges. Then start the “server Manager” by clicking on “Server Manager” icon on task bar. Then go to “Roles”

Then click on “Add Roles” option to open Add roles Wizard.

Then it will load the Roles Wizard and select the “DHCP Server” From the list and click next to continue.

Then it will give description about the role. Click next to continue.

Next window is asking to use which interface to serve DHCP clients. If server has multiple NIC with multiple IP you can add them also to serve DHCP clients.

In next window it will give opportunity to add DNS settings that should apply for DHCP clients.

Next window is to define the WINS server details.

In next window we can add the scope, the Starting IP, End IP of the DHCP range, subnet mask, default gateway, leased time etc.

In next Window it can configure to support IPv6 as well.

Then it will give the confirmation window before begin the install. Click on “Install”

Once installation finishes DHCP server interface can open from Start > Administrative Tools > DHCP

Using the DHCP it is possible to even configure multiple Scopes configurations to the network. In a network there can be different network segments. It is waste to setup different DHCP servers for each segment. Instead of that it is possible to create different Scopes to issue DHCP for them.

For any host to perform any communication it must have an IP address. When we take a network to each host need to have an ip address to function in network. When the number of hosts increases assigning IP addresses to them (manually) become issue. Especially when you move in to IPv6 the addresses are more complex as well. There for its better to have mechanism to assign IP addresses automatically when hosts are connects to network. As solution for this, Dynamic Host Configuration Protocol (DHCP) Service can use to issue ip address to connected computers and devices to the network automatically. All the configurations such as DNS server info, WINS Server Info etc also can automatically publish to the hosts.

There are lots of ways that you can configure DHCP Services. Most of the modern day Routers, Switches are comes with inbuilt DHCP server which can simply configure for network. Also we can configure operating system level DHCP servers on windows, Linux environments.

There are lots of benefits we can get for DHCP automatic IP addressing.

How DHCP Works?

As soon as DHCP client connect to the network it send a broadcast message to its subnet called as DHCP discover message to indicate to the DHCP servers there is a host that would like to get an IP address. The DHCP server in the subnet then replies to that message with a DHCP offer. DHCP offer includes IP address and associated configuration information. Then if DHCP client is ready to accept the offer, it send DHCP Request message to the corresponding DHCP server. Then DHCP server send DHCP acknowledge message to the DHCP client approving the lease along with the info such as default gateway, DNS server addresses, WINS server addresses. After client receive ack message it will completes the initialization of the IP address.

To start the configuration we need to install Distributed File System (DFS) roles on the servers. There is few reasons why I have choose DFS technology for given scenario.

High Availability – DFS provides the high availability for accessing shared files across the network. In network, the files will be shared across the network from different servers; different sub domains etc. if any of nodes which host shared folders is down it will affect company operations. But with use of DFS replication method it will replicate the files with backup servers automatically which will ensure the high availability.

Redundant – With DFS we can configure replications servers which will keep the copy of the files. Server 2008 R2 DFS service are been improved with faster replication across LAN, WAN. Not only that, DFS also support for the clustering which we can use for the fail over.
Let’s see how we can install DFS.

Let’s see how we can install DFS.

First step is to load up the server manager from start > administrative tools > server manager. Then in roles, right clicks and select add roles.

Then it will load up the add roles wizard. Click on next to continue.

From the List Select “File Services” and click on next.

Then it will give description about the file services. Click on next to continue.

In next window at role services selection select the Distributed File System and its service. Click on next to continue.

In next screen select the “create a namespace later using the DFS management snap-in” then click next to continue.

In next window it will give conformation about services and click on “install” to install the service.

Then it will process the installation.

To open up the DFS snap-in go to start > administrative tools > DFS Management

It will open up the DFS snap-in as following.

As the next step we need to configure the DFS service. This will be running on the child domain server (child domain server) “sales.sprint.local” as files need to be shared for the departments from their corresponding department servers.

Then it will open the DFS wizard. In first window it asks for the server which will host the namespace. According to setup it will be the server TEST2.sales.sprint.local. Put the server name and click on next.

In next window is to configure name for the share and its settings. Type the name you like to use for the share.

Click on “edit settings” in window. From the permissions select “all users have read and write permissions” (Because according to scenario all users should have permissions to the main shared folder)

Click ok in opened windows and then click on next to continue.

In next window it’s asking what type of namespace type to select. There are 2 types which DFS will be using. In window it gives brief description about each type. According to our requirement we better go with “Domain-based namespace” because it’s the option which will increase the availability.

Next window is to review the namespace setup. Click on “create” to create the namespace.

Once it’s created it will give the confirmation.

To test it out I typed \\sales.sprint.local on run and I got the list of shared folders including the DFS share we just created.

Now we have installed the DFS role on the server done basic configuration. if you have nay question regarding the setup, feel free to contact me on rebeladm@live.com

What is DFS?

The Distributed File System (DFS) is introduced by Microsoft Corporation with Windows NT operating system. The product is focused for addressing issues faces in File/Data sharing on networks environment.
After Windows NT, with every network operating systems that Microsoft had released were having DFS service by default. This service does not need any additional license apart from windows server operating system licenses.
To explain what is DFS in real world let’s look in to simple scenario.  Let’s say you are starting a business and you have 2 computers to help operating the business. It can be used for generate invoices, keep stocks details, research details etc. you may need to share these information between the two computers. So we can create simple network and share the files from one computer to another using file share techniques.
As business grows the company may add more and more computers in to the network and requirement of sharing data will increase. So still we can implement active directory environment to control the resources properly with advance security features. We can implement File Severs to share files in the network as required.
But what will happen if you opening different branches in different cities or countries? Or accruing new companies which have different active directory setups? Well still you need to share files between offices, locations but now there are many different issues we will be facing. The branches may have connected using slow leased lines or VPN links. If users need to access files which is shared on headquarters then need to use this low speed link to access them. It can take ages to get file due to the bandwidth. Imagine what will happen 100 of users trying to access same share? It will definitely effect on company operations. Also let’s say all the files are saved on one central file server in HQ. Server is using 100mb connection to connect with network. If in given time if it had to answer thousands of requests to copy data, update data will it be able to handle? It will probably max out its 100mb link and slow down all the request processing. Also what will happen if its host business critical info and it went down during working hours? So we do have availability and reliability issues also with typical file share. And of cause no way to load balance using different servers as there will be practical issues to keep every server with up to date replicated data.
So now we can see we cannot apply typical file sharing mechanism to every file sharing requirement so what we can do? Well that’s where the DFS comes to the picture. DFS is developed to address all these kind major issues associated with file/data sharing in advanced / complicated network.

Why we need DFS?

As we discussed above the typical file sharing methods do have issues applying in to complex/ advanced network setups. Let’s discuss about some of these common issues and why we should move in to advanced solution such as DFS.

 So with use of traditional system have many different limitations and issues. There for we need advance system to address these limitations and issues. DFS is the answer for it. In next section let’s see how DFS functions will help to address these.

DFS and It’s Features

As we know the DFS is to offer simplified access to shares with in a large/complex network by providing characteristics such as easy management  for administrator for their file server infrastructure, load balancing, replication, high availability etc.

Let’s look in to some of these features of DFS in details.

DFS Name Space

Let’s take a large network which is hosting file shares from 10 different servers. To access the shares, users have to use UNC paths such as \\ServerA\Share , \\ServerB\Share etc. to access the different shares they hosts. If this shares are from different child domains or domains it make more complex as users then need to use it with FQDN, for ex- \\serverA.sprint.local\Share . At the end the access methods for the shares make it more complex for the users. Not only that for administrators, they will need to spend more time on mapping the network shares to users, modifying the login scripts etc. also what will happen if server name or the ip address that used to connect to server is changed ? Then it will need to be reported to all the staff about those changes and modify existing shares etc. 

Also for a new employee, he/she can take longer time to get families with these complex file share access process. This also will impact with the user productivity as well as they may need to borrows different servers to find exact share because of complexity. So question is how we can fix this?

Well with DFS it has introduced a feature to use “Namespace” where you can map different folder targets in different servers to one particular share path. So you do not need to brows 10 servers to get the files you need. Instead of that you can access one namespace share. for ex- \\sprint.local\share

In above example that the main share name will be \\contoso\public and it have sub folders which is targeted to shares on different file sharing servers. The end users do not need to be worry about the different UNC paths of the file sharing servers any more. It’s a good security feature as well. When you access the share end user does not really know from where these files are severed from? It can be a server in HQ or from a branch in different city. Also lets say one of the file server crashed and with rebuilt it got a different FQDN or maybe you need to move it to a different child domain. That means the UNC path will be change to access it shares. If it’s been in normal procedure we need to inform all the employees about this change. But with DFS namespace no one even knows if there has been such change as its just matter of changing file targets in the back end.

There are two types of name space you can setup on DFS. Stand-alone name space is for non-domain environment. It will need one server to act as namespace server to server the name space to the users. Disadvantage is if this server down you will not be access the shares even file servers are up.

Domain based namespace is for active directory environment. The configuration will be saved on active directory and will not be relay on name space server.

Multiple Copies

Let’s assume you host some business critical data in a share on head office file sharing server. The branch offices in also will need to access the files in this share. Due to the slow links between HQ and the branch offices in different cities it will really slow down the access from branch offices to the data. But what if the same files can be server from share in branch office? It will definitely help on the performance.

Using DFS you can serve same data from different servers. Which means one folder share will have multiple targets which host same data. For ex- let’s say you have folder called \\sprint.local\share setup on using domain based DFS name space and it’s targeted the share on ServerA. But you can set to serve same data from ServerB in branch office. If users in branch try to access the \\sprint.local\share automatically they will be served from the copy hosted on ServerB which is in there branch office. Users will not see different where its serve from except for much better performance.

When you use the domain-based name space with this kind of multiple targets setup, when someone try to access share it automatically select what is the closest target he can access from. This works as the same way as active directory used to select the closest active directory server which users can serve with.

This is also important for the high availability of the data. If a share have multiple targets setup it’s doesn’t matter if one targets is goes down. The files will be still available from the targets which are online.

Replication

Well if we use multiple targets like above how really we keep same accurate data between all these shares? DFS do have solution for that. In DFS you can create replication group where you can define many settings such as who will be the replication members, replication topology, and replication schedule to control the bandwidth usage etc. so you really do not need to worry about copying the files manually to keep copies. Not only that even the replications can copy the ACL (Access Control List) changes as well. so if you apply access permissions on one share in replication group it can replicate in to other shares in the group. So as administrator you do not need to apply same access shares in every server.

 In the illustration it shows how the replication is happens. Once the file is updated with in the replication group it will check for the replication schedule and the replication settings and do the replication automatically.

This method we can use to build backup servers for disaster recovery as well. We can have backup server add to the replication and let it replicate the file changes according a schedule. Then if any disaster if primary server is down we can let backup server to server the file with minimum configuration change.

Load Balancing

This feature is very similar to the multiple copies scenario we discussed. Let’s assume you have shared called \\sprint.local\Share in DFS which is accessed by large number of clients. When the number of clients increases the load it will make on bandwidth and server resources will be high. To avoid this performance issues with DFS we can add different servers to host same data using replication and let them to serve the clients. The data on shares will be identical and the users will not notice where it is serve from. If we have 3 servers serverA, serverB, serverC which will host same data with this method one user will get same data from serverA while another user get same data from serverC. This will distribute the load among the hosts and improve the performance of the file sharing process.

Resource Management

With the DFS the management of the resources is much easy than regular file sharing process. Let’s assume you have a file share which is need to rebuild due to disk errors. If it’s in regular file sharing process you need to disable the shares, then move files over to different server and then apply the same sharing permissions. Then inform the users if any path changes. If you made any mistake with copying permissions then you will also get complains from users and you need to spend time fixing those. There for the process is very lengthy and complicated. But if it’s been DFS you can simply replicate the data and permissions to the new server and then add it as multiple targets and remove the old target from the list. So that way users not even notices and most of time there will be no downtime at all to the shares. This is big relief for administrators to manage the resources in very efficient manner.

DFS, Live in Action

In previous section I have explained the main features of the DFS and the use of it. But how really we can use these features in a network?

To explain it I have used a scenario of an international news networks called “ABC News Chanel”. It’s broadcasting their news worldwide. It does have 2 main regional offices in Asia, Africa and USA. Writers, reporters around the world will submit their reports, news to nearest regional office. The Art office is located on the Manchester city in UK and the cannel studio will be location on the Lancaster city UK. The cannel headquarter is location on London city in UK.

All the regional offices and city offices are connected with the headquarters to make one large network. They use many different ISPs, connection types to connect with the same network.

File Sharing Process

The company is using DFS services to manage its infrastructure file sharing requirements. The company does have DFS domain based namespace configured as \\abcnews.local\fileshares . All other share folders will be listed under this name space. Company headquarters have the main file share servers hosted and each regional offices, city offices do have their own file servers to help with the company operations.

To describe how they have setup the file sharing using DFS I will use simple practical scenario.

Let’s assume we do have reporter in sri lanka for the channel. He does have some news reports and video, audio files to send for the new channel to process with the news. So he will be connecting to the network of nearest regional office which is asia office located in india. He will be connecting from his laptop and will use VPN link to connect with the company network. Then he will be saving his files in to share called \\abcnews.local\fileshares\asia_office , this file shared is created by the IT department in HQ and mapped the “asia_office” folder targets to the file server located in the asia regional office. Even it’s used the company main DFS name space it’s connecting to a server in India office. Once he saves files the copy will be actually in regional office server. But for the process until it goes to news studio, reviewing panel in HQ need to access them, also art work office in Manchester need to access it for editing etc., but what will happen if they try to get it from asia regional office ? well it will be slow as these file transfers will go through the slow links between offices.to address this the same share will be replicate to the other city offices, headquarters so someone in art office or HQ try to access \\abcnews.local\fileshares\asia_office the content will be serve from their office file servers which will be faster. But the reporter or any other employer do not need to worry about different servers, UNC paths the process deals with; it is control by the DFS.

Once the news is approved by the HQ it can be copied to different shared folder and it will be access by art office. But it will also use the same mechanism used in above. At the end if someone trying to access a file shares, which is originated from different office automatically it will be serve by nearest replication server than going in to remote office file share.

Central Backup

Backup of data is critical for any business. But especially a company likes abcnews it’s more valued. When dealing with data in different regional offices, city offices the backup process will be more complex. If you go to backup data within the each office you need new hardware, licenses, as well as human resources to manage them. To simplify this instead of go for office level backup, all the file share data in offices will be replicated to backup servers in HQ. For this process will be using DFS replication mechanism. To use it will not need any additional cost for hardware, licenses etc. if need we can back up the replicated data in to tapes drives or NAS for more protection. But all these will happened only from HQ. If there is any data need to be restored we can simply replicate those files in to office shares. We always can control which way the replication happens. We can decide it’s from branch to HQ or HQ to Branch as per requirement.

High Availability 

As a news channel the availablity of the data which deliver through the network is operation critical. Delays of getting news, reports, will bring the company ratings down. As we know it operates the offices in different countries as well as in different cities. Those are connected to HQ through different ISP and different connection speeds.

Let’s assume from Canada a reporter needs to submit a news report to HQ. So as usual he connect using VPN link to regional office in India. But that time from India office to HQ the leased line connection is down. If you trying to save the files to a share \\abcnews.local\fileshares\asia_office and if this were directly served from HQ you will not be able to connect to it as link is down. But if this has been in a replication group even the link is down you will be redirect to the file share in Indian office. As a user you will not see the different. Once the uplink established again this data will be replicated with the other replicate member in the group. So DFS is ensuring the availability of the data.

Also as administrator some time you need to do change the servers with new hardware. If it’s been a just a common file server you need to make notice to users, then disable shares, move to new server and apply share permissions. Then map the new shares etc. a large network this is really time consuming and complex process. But with beauty of DFS you can simply remove the server from network and add the new server. Even that server gone down no one will notice it as the files still available in replicated servers. There for we can ensure high availability of data when use DFS service and its features.

In above I explained how the DFS service and features can applied to real business scenario. Again this is only used few major features of the DFS. But still there is lot features which can be used based on the scenario.

When we talk about cisco switches the "ip routing" and "default-gateway" is two common commands that we use for configure the routing info. But if you didn't use this 2 carefully it can cause some serious routing issues. You cannot use both of this in same time in any switches.

Use of default-gateway

To define a default gateway (router) when IP routing is disabled, use the ip default-gateway global configuration command. To disable this function, use the no form of this command.

ip default-gateway ip-address

ex : ip default-gateway 172.16.15.4

this command is used in layer 2 switches to define the default gateway of it.

In here we define what is the gateway for this range of ips since layer 2 switch donot have any routing capabilities itself.

Use of ip routing

Since the introduce of layer 3 switches it added the routing capabilities to the switch. Which means layer 3 switch also can act as router by default.

ip routing is not enabled by default in layer 3 switch so it will not find any routing details. To enable it all you need to do is goto configuration terminal and type

ip routing

but before do this you need to make sure that you do not have default-gateway setup on there. If you have enable ip routing while default-gateway configured you will lost access to the switch. Its more important if you connect remotely.

What are the issues if you have configured default-gateway in layer 3 switch?

If you have different class of ips configured on switch this will cause lot of issues. For example lets say in your layer 3 switch you have different class as main ip and different class for the ports. Then you have requirement to break it to vlans. Then you break it to sub nets and create new vlans and assign it to one of user pc or server. So in here you will only able to ping to the its gateway ip ( vlan interface ip ) and you will not be able to ping to any other. And also in server or pc end it will not be able to access internet or ping to any. Its because the switch do not getting any routing information about these. So to fix it you have to disable default-gateway with no default-gateway command and then enable ip routing

if any questions please feel free to ask me on rebeladm@live.com

Windows 7 and Windows Server 2008 R2 SP1 helps keep your PCs and servers on the latest support level. It also provides ongoing improvements to the Windows Operating System (OS), by including previous updates delivered over Windows Update as well as continuing incremental updates to the Windows 7 and Windows Server 2008 R2 platforms based on customer and partner feedback. This enables organizations to deploy a single set of updates.

Windows 7 and Windows Server 2008 R2 SP1 will help you:

• Keep your PCs supported and up-to-date
• Get ongoing updates to the Windows 7 platform
• Easily deploy cumulative updates at a single time
• Meet your users' demands for greater business mobility
• Provide a comprehensive set of virtualization innovations
• Provide an easier Service Pack deployment model for better IT efficiency

Setup prerequisites

The following conditions are prerequisites for the installation of SP1:

• Your current operating system must be the Release to Manufacturing (RTM) version of Windows 7 or Windows Server 2008 R2 (build 7600).
• Users updating through Windows Update/WSUS must install the Servicing Stack Update (SSU) that handles the installation and removal of software updates, language packs, and optional Windows features. This update is necessary to successfully install or uninstall the service pack; it also improves the performance and reliability of the service pack installation. This update is part of the standalone update package and will be offered as a separate package on Windows Update.

Service Pack 1 size

In order to make the improvements detailed in this document, various individual files and components have been updated. Also, the language-neutral design of Windows necessitates that the service pack be able to update any possible combination of the basic languages supported by Windows 7 with a single installer, so language files for the 36 basic languages are included in the standalone installer.

For System Administrators, there is a standalone installation package available. However, most home and small business users will receive SP1 through Windows Update. Windows Update utilizes an efficient transfer mechanism to download only the bytes that are needed, resulting in a download that ranges in size from 44 megabytes (MB) to 96 MB depending on the system architecture.

Changes specific to Windows Server 2008 R2

Dynamic Memory

Constraints on the allocation of physical memory represents one of the greatest challenges organizations face as they adopt new virtualization technology and consolidate their infrastructure. With Dynamic Memory, an enhancement to Hyper-V™ introduced in Windows Server 2008 R2 SP1, organizations can now make the most efficient use of available physical memory, allowing them to realize the greatest possible potential from their virtualization resources. Dynamic Memory allows for memory on a host machine to be pooled and dynamically distributed to virtual machines as necessary. Memory is dynamically added or removed based on current workloads, and is done so without service interruption.

Virtual machines running a wide variety of operating systems can use Dynamic Memory; for a complete list, see the "Dynamic Memory Evaluation Guide" at http://go.microsoft.com/fwlink/?LinkId=192444. The guide also discusses Dynamic Memory settings and usage in detail.

Microsoft RemoteFX

Businesses are increasingly looking to leverage the efficiency and cost savings that can come from a virtualized desktop infrastructure. With the addition of Microsoft RemoteFX in Windows Server 2008 R2 SP1, a new set of remote user experience capabilities that enable a media-rich user environment for virtual desktops, session-based desktops and remote applications is introduced. Harnessing the power of virtualized graphics resources, RemoteFX can be deployed to a range of thick and thin client devices, enabling cost-effective, local-like access to graphics-intensive applications and a broad array of end user peripherals, improving productivity of remote users.

RemoteFX can function independently from specific graphics stacks and supports any screen content, including today's most advanced applications and rich content (including Silverlight and Adobe Flash), ensuring that end users maintain a rich, local-like desktop experience even in a virtualized thin-client environment.

RemoteFX also adds mainstream USB device support to virtual desktop computing, including support for USB drives, cameras and PDAs connected to the client device. RemoteFX also provides a platform for hardware and software partners to enhance RemoteFX capabilities in a variety of possible host, client and network configurations.

To use RemoteFX, the virtualization server must be running Windows Server 2008 R2 with SP1, the virtual machine must be running Windows 7 Enterprise with SP1 or Windows 7 Ultimate with SP1, and the remote client computer must be running either Windows Server 2008 R2 with SP1 or Windows 7 with SP1. To connect to the virtual machine, the remote client computer requires an updated version of Remote Desktop Services (included in the service pack for all editions of Windows 7).

Enhancements to scalability and high availability when using DirectAccess

DirectAccess is a new feature in the Windows 7 and Windows Server 2008 R2 operating systems that gives users the experience of being seamlessly connected to their corporate network any time they have Internet access. In Windows Server 2008 R2 SP1, improvements have been made to enhance scalability and high availability when using DirectAccess, through the addition of support for 6to4 and ISATAP addresses when using DirectAccess in conjunction with Network Load Balancing (NLB).

Support for Managed Service Accounts (MSAs) in secure branch office scenarios

SP1 enables enhanced support for managed service accounts (MSAs) to be used on domain-member services located in perimeter networks (also known as DMZs or extranets).

Support for increased volume of authentication traffic on domain controllers connected to high-latency networks

As a greater volume of IT infrastructure migrates to cloud-based services, there is a need for higher thresholds of authentication traffic to domain controllers located on high-latency networks (such as the public Internet). SP1 allows for more granular control of the maximum number of possible concurrent connections to a domain controller, enabling a greater degree of performance tuning for service providers.

Enhancements to Failover Clustering with Storage

SP1 enables enhanced support for how Failover Clustering works with storage that is not visible for all cluster nodes. In SP1, improvements have been made to the Cluster Validation and multiple Failover Cluster Manager wizards to allow workloads to use disks that are shared between a subset of cluster nodes.

Changes specific to Windows 7

Additional support for communication with third-party federation services

Additional support has been added to allow Windows 7 clients to effectively communicate with third-party identity federation services (those supporting the WS-Federation passive profile protocol). This change enhances platform interoperability, and improves the ability to communicate identity and authentication information between organizations.

Improved HDMI audio device performance

A small percentage of users have reported issues in which the connection between computers running Windows 7 and HDMI audio devices can be lost after system reboots. Updates have been incorporated into SP1 to ensure that connections between Windows 7 computers and HDMI audio devices are consistently maintained.

Corrected behavior when printing mixed-orientation XPS documents

Prior to the release of SP1, some customers have reported difficulty when printing mixed-orientation XPS documents (documents containing pages in both portrait and landscape orientation) using the XPS Viewer, resulting in all pages being printed entirely in either portrait or landscape mode. This issue has been addressed in SP1, allowing users to correctly print mixed-orientation documents using the XPS Viewer.