book

Windows Server 2003 Network Administration

by Craig Hunt, Roberta Bragg

September 2005

Beginner

696 pages

23h 47m

English

O'Reilly Media, Inc.

Read now

Unlock full access

Windows Server 2003 Network Administration
Dedication
Preface
Who Should Read This BookWhat’s in This BookConventions Used in This BookUsing Code ExamplesWe’d Like to Hear from YouSafari EnabledAcknowledgments
1. Overview of TCP/IP
1.1. TCP/IP and the Internet1.1.1. TCP/IP Features1.1.2. Protocol Standards1.2. A Data Communications Model1.3. TCP/IP Protocol Architecture1.4. Network Access Layer1.5. Internet Layer1.5.1. Internet Protocol1.5.1.1. The datagram1.5.1.2. Routing datagrams1.5.1.3. Fragmenting datagrams1.5.1.4. Passing datagrams to the Transport Layer1.5.2. Internet Control Message Protocol1.5.3. IP Security1.6. Transport Layer1.6.1. User Datagram Protocol1.6.2. Transmission Control Protocol1.6.3. Transport Layer Security1.7. Application Layer1.8. Summary
2. Delivering the Data
2.1. Addressing, Routing, and Multiplexing2.2. The IP Address2.2.1. Address Structure2.2.2. Subnets2.2.3. The Natural Mask2.2.4. CIDR Blocks and Route Aggregation2.2.5. Private Network Numbers2.2.6. IPv62.2.6.1. The lack of demand for IPv62.3. Internet Routing Architecture2.4. The Routing Table2.5. Address Resolution2.6. Protocols, Ports, and Sockets2.6.1. Protocol Numbers2.6.2. Port Numbers2.6.3. Sockets2.7. Summary
3. Network Services
3.1. Names and Addresses3.2. The HOSTS File3.3. LMHOSTS3.4. Domain Name System3.4.1. The Domain Hierarchy3.4.2. Creating Domains and Subdomains3.4.3. Domain Names3.4.4. DNS Resolver and Server3.5. Windows Internet Name Service3.5.1. WINS Name Registration and Name Resolution3.5.1.1. Registering, renewing, and releasing NetBIOS names3.5.1.2. Resolving a NetBIOS name3.6. SMB and CIFS3.7. Mail Services3.7.1. Simple Mail Transfer Protocol3.7.2. Post Office Protocol3.7.3. Internet Message Access Protocol3.7.4. Multipurpose Internet Mail Extensions3.8. Dynamic Host Configuration Protocol3.8.1. How DHCP Works3.9. Dynamic DNS3.10. Active Directory Basics3.10.1. Active Directory Replication Basics3.10.2. Active Directory Database Basics3.10.3. Domain Controllers3.10.4. Authentication, Authorization, and Trusts3.10.5. Group Policy Basics3.11. Summary
4. Basic TCP/IP Configuration
4.1. Network Device Configuration4.1.1. Adapter Configuration4.1.2. Installing and Removing Network Components4.2. General TCP/IP Configuration4.2.1. Manually Defining the IP Address4.2.1.1. Selecting an IP address block4.2.2. Basic DNS Configuration4.3. Adding More Configuration Details4.3.1. Adding IP Addresses4.3.2. Adding Gateways4.3.3. The DNS Tab4.3.4. The WINS Tab4.3.5. The Options Tab4.4. Summary
5. Managing DHCP Services
5.1. Basic Microsoft DHCP Concepts5.1.1. DHCP Options5.1.2. DHCP Scopes5.2. Planning for DHCP5.2.1. Redundancy Issues5.3. Installing the DHCP Server5.3.1. Configuring a DHCP Scope5.4. Using the DHCP Console5.4.1. Adding a Server5.4.2. Adding a Scope or a Superscope5.4.3. Configuring DHCP Options5.4.4. Using Option Classes5.4.4.1. Working with user classes5.4.4.2. Working with vendor classes5.4.4.3. Defining new options and setting defaults5.4.5. Creating a Reservation5.5. DHCP Server Administration5.5.1. Authorizing5.5.2. Activating5.5.3. Detecting Conflicts5.5.4. Selecting the Interface5.5.5. Backup and Restore5.5.6. Integrating with DNS5.5.7. Logging5.6. Creating a MADCAP Server5.7. Summary
6. Creating a DNS Server
6.1. Domains Versus Zones6.2. The Microsoft DNS Server6.3. Planning a DNS Server Installation6.4. Installing the DNS Server6.5. Initial Configuration6.6. The DNS Files6.6.1. The cache.dns File6.6.2. The Forward Lookup Zone File6.6.2.1. Customizing SOA parameters6.6.2.2. Defining a list of name servers6.6.3. The Reverse Lookup File6.7. The DNS Console6.7.1. Defining Records for a Forward Lookup Zone6.7.2. Working with Subdomains6.7.2.1. Delegating a domain6.7.3. Managing a Reverse Lookup Zone6.7.3.1. Delegating a reverse zone6.7.4. Understanding Stub Zones6.7.5. Other Zone Management Features6.7.5.1. Managing zone transfers6.7.5.2. Configuring DNS Notify6.7.5.3. Integrating a zone and WINS6.7.6. Server Properties6.7.6.1. Advanced tab6.7.6.2. Scavenging6.7.6.3. Forwarders6.7.6.4. Logging and monitoring6.8. Using nslookup6.9. Summary
7. Using AD to Support Network Administration
7.1. Moving from Workgroups to Domain Environments7.1.1. Using dcpromo7.1.1.1. Creating a forest7.1.1.2. Creating a new tree7.1.1.3. Adding a child domain7.1.1.4. Creating an additional DC7.1.2. Confirming DNS Registration of DC Information7.1.3. Configuring Sites7.1.3.1. Creating, configuring, and modifying sites7.1.4. Moving Operations Master Roles7.1.5. Back Up AD7.2. TCP/IP for AD Transport, Access, and Support7.2.1. AD/DNS Dependencies7.2.2. How AD Uses DNS7.2.2.1. How DCs are located7.2.2.2. How site information is used during logon7.2.2.3. How DNS is used for AD replication7.2.3. Configuring DNS for AD7.2.3.1. Configuring the server7.2.3.2. Configuring domain records7.2.3.3. Configuring DNS delegation7.2.3.4. Configuring AD-integrated DNS zones7.2.3.5. Configuring and using secure dynamic DNS7.2.4. Using Windows Server 2003 AD Application Partitions for DNS Zone Information7.2.4.1. Using application partitions7.2.4.2. Migrating from Windows 2000 to Windows Server 20037.2.5. Configuring the Windows Time Service7.2.5.1. Synchronizing with an external time source7.2.5.2. Synchronize with a hardware clock7.2.6. Integrating DHCP with AD7.2.7. NetBIOS and WINS in an AD Domain7.2.7.1. Integrating WINS in a DNS environment7.3. Using Group Policy to Manage Network Protocols7.3.1. Dependency of Group Policy on DNS7.3.2. Managing TCP/IP Configuration Using Group Policy7.3.3. Managing DNS Client Configuration Using Group Policy7.3.4. Managing the Windows Time Service Using Group Policy7.3.5. Managing SNMP Using Group Policy7.3.6. Managing WINS, RRAS, and IAS Servers Using Group Policy7.4. Summary

8. Controlling Remote Communications with Microsoft Routing and Remote Access Service
8.1. Routing Services8.1.1. IP Multicast Support8.1.1.1. Understanding multicast components8.1.1.2. Adding the IGMP services to RRAS8.1.1.3. Configuring multicast boundaries8.1.1.4. Configuring multicast heartbeats8.1.1.5. Querying multicast router information8.1.2. Configuring the DHCP Relay Agent8.1.3. Configuring RIP Version 2 for IP8.1.3.1. Configuring general RIP properties8.1.3.2. Configuring Silent RIP mode8.1.3.3. Configuring RIP security properties8.1.3.4. Configuring RIP neighbors routing properties8.1.3.5. Configuring advanced RIP routing properties8.1.4. Configuring Open Shortest Path First (OSPF)8.1.4.1. Subdividing the network into OSPF areas8.1.4.2. Identifying ASBRs8.1.4.3. Configuring network type8.1.4.4. Identifying virtual links and backbone areas8.1.4.5. Configuring security for OSPF8.1.5. Network Address Translation (NAT)8.1.5.1. Enabling and configuring NAT8.1.5.2. Creating and configuring NAT interfaces8.1.5.3. Creating a Demand Dial interface for dial-up connections8.1.5.4. Adding a default static route8.1.5.5. Enabling routing on ports8.1.5.6. Securing a NAT server8.1.5.7. Allowing inbound connections8.1.6. Logging RRAS Routing Events8.2. Protocol Filtering (Basic Firewall Services)8.3. Remote Access Planning and Deployment8.3.1. Hardware Provisioning8.3.2. Authentication Choices8.3.3. Reversible Encryption8.3.4. Data Encryption8.3.4.1. Encryption types8.3.4.2. Choosing MPPE or IPSec encryption8.3.4.3. Encryption strength selection for VPNs8.3.5. Choosing a VPN Protocol8.3.5.1. PPTP considerations8.3.5.2. L2TP/IPSec considerations8.3.5.3. IPSec in tunnel mode considerations8.3.6. PPP Extensions8.3.7. IP Addressing and DHCP Integration8.3.8. Domain Functional Level Issues8.3.9. The Remote Access Connection Process8.3.10. Dial-in User Constraints8.3.11. Remote Access Policies8.3.11.1. Remote access policy restrictions8.3.11.2. Profile constraints8.3.11.3. Configuring remote access policies8.4. Configuring Dial-up or VPN Access8.5. Advanced Virtual Private Network (VPN) Process and Configuration8.5.1. Using L2TP/IPSec VPNs with NAT and NAT-T8.5.2. Configuring and Using RRAS Demand-Dial VPN8.5.3. Configuring Dial-in Properties8.5.4. Using a Shared Key for a L2TP/IPSec VPN8.5.5. Configuring Firewalls for VPN8.6. Configuring Clients to Use Remote Access8.7. Configuring Logging and Accounting (Auditing) for Remote Access8.8. Summary
9. Protecting Hosts with Windows Host Firewalls
9.1. Firewall Basics9.2. Internet Connection Sharing9.2.1. Enabling ICS9.2.2. Enabling Internet Access to Local Services9.2.3. Using a Network Bridge with ICS9.2.4. Securing ICS9.2.5. Managing ICS via Group Policy9.3. Windows Firewall9.3.1. Internet Connection Firewall (ICF)9.3.2. Service Pack Firewall Modifications9.3.2.1. Modifications9.3.2.1.1. Security Center9.3.2.1.2. Startup Security9.3.2.2. Modifying firewall behavior using the Windows Firewall INF file and unattend.txt9.3.2.2.1. Modifying firewall settings using the Control Panel9.3.2.2.2. Modifying alerting and notification using the registry9.3.2.2.3. Modifying firewall behavior using Group Policy9.3.2.2.4. Modifying firewall behavior using Netsh9.3.2.2.5. More modifications9.3.2.3. Windows Server 2003 SP19.4. Routing and Remote Access Basic Firewall9.5. Protocol Filters9.5.1. TCP/IP Filters9.5.2. Routing and Remote Access Protocol Filters9.5.3. Filtering Using IPSec9.6. Which Firewall Services Should You Use?9.7. Summary
10. Centralizing Authentication and Authorization with Internet Authentication Server
10.1. The RADIUS Protocol10.1.1. Authentication, Authorization, and Accounting RADIUS Processes10.1.1.1. Authentication10.1.1.2. Authorization10.1.1.3. Accounting10.1.2. RADIUS Messages10.2. Installing and Configuring IAS10.2.1. Installing IAS10.2.2. Configuring IAS for Remote Access10.2.2.1. Configuring a connection request policy10.2.2.2. Configuring RADIUS clients for the IAS server10.2.2.3. Configuring RRAS servers as RADIUS clients10.2.2.4. Configuring auditing and logging10.2.2.4.1. Log format and creation10.2.2.4.2. Log contents10.2.2.4.3. SQL server logging10.2.2.5. Configuring Remote Access policies10.2.2.6. Configuring additional ports10.2.2.7. Configuring account lockout10.3. Configuring IAS as a RADIUS Proxy10.3.1. Configuring a RADIUS Server Group10.3.2. Configuring a Connection Request Policy10.4. Securing Communications Between RRAS and IAS10.4.1. Shared Secret10.4.2. Message-Authenticator Attribute10.4.3. IPSec10.5. Configuring IAS for Use with VLANs10.5.1. Creating a Remote Access Policy for VLANs10.6. Securing Wireless Access with IAS10.6.1. Understanding EAP and PEAP10.6.2. Understanding the 802.1x Authentication Process10.6.3. Implementing 802.1x Authentication10.6.3.1. Configuring IAS to support 802.1x authentication for wireless clients10.6.3.1.1. Configuring a Remote Access policy for wireless10.6.3.2. Understanding and fulfilling certificate requirements for EAP and PEAP10.6.3.3. Using a Windows CA server certificate10.6.3.4. Using a third-party certificate10.6.3.4.1. Obtaining and installing a Verisign certificate10.6.3.4.2. Manually installing the WLAN certificate10.6.3.4.3. Verifying the certificate is installed10.6.3.4.4. Configuring proxy settings10.6.3.5. Configuring the Windows XP wireless client to use 802.1x authentication10.6.4. Understanding and Using WPA10.7. Using Backup and Restore (Importing IAS Configuration)10.8. Providing Load Balancing for Multiple RAS Servers10.9. Using IAS to Protect the Network from Bad Computers10.9.1. Network Access Quarantine Control10.9.1.1. Understanding network access quarantine control10.9.1.2. Implementing network access quarantine control10.9.2. Network Access Protection10.10. Summary
11. Protecting Network Communications with Internet Protocol Security
11.1. IPSec Basics11.1.1. Security Advantages of IPSec11.1.1.1. Blocking, permitting, and securing communications11.1.1.2. Defense in depth11.1.1.3. IPSec tunnels11.1.1.4. Flexibility11.1.2. Differences Between AH and ESP11.1.3. Process and Procedure11.1.3.1. Defining the type of communication11.1.3.2. Blocking and permitting11.1.3.3. Securing or negotiating11.1.3.3.1. Phase I: IKE Mode, or Main Mode11.1.3.3.2. Phase II, or Quick Mode11.2. Specifics of the Windows Implementation11.2.1. The IPSec Policy Agent Service11.2.2. The IPSec Driver11.2.3. New in Windows Server 200311.2.3.1. Disable default exemptions11.2.3.2. IPSec NAT traversal11.2.4. Default IPSec Policies11.3. Configuring a Windows IPSec Policy11.3.1. Reviewing Configuration Requirements11.3.2. Using the IPSec Policy Wizard to Create a Policy11.3.2.1. Creating an MMC console11.3.2.2. Create a blocking rule11.3.3. Assigning the Policy11.3.4. Testing the Policy11.3.5. Creating Additional Rules11.3.5.1. Create a permit rule11.3.5.2. Changing the permit rule to secure11.3.5.3. Creating an IPSec policy on ComputerB11.3.6. Setting Up the IPSec Monitor and Testing the Policy11.3.7. Writing Policies Using netsh11.3.8. Using Group Policy to Implement IPSec11.3.9. Monitoring and Troubleshooting IPSec11.3.9.1. Using netsh to monitor IPSec11.3.9.2. Using the IP Security Monitor to monitor IPSec11.4. Extending IPSec Operations11.4.1. Use Persistent Policies11.4.2. Configure IPSec Driver Modes11.4.2.1. Startup mode11.4.2.2. Operational mode11.4.2.3. Diagnostic mode11.5. Designing IPSec Policies to Meet Secure Communications Needs11.6. Hardening IPSecurity Policies11.6.1. Hardening Authentication11.6.2. Hardening Security Methods11.7. Summary
12. Configuring Internet and Intranet Web Services with IIS
12.1. Server Preparation and IIS Installation12.1.1. Install and Prepare Windows Server 200312.1.1.1. Documenting the server configuration12.1.1.2. Hardening of dedicated web server services12.1.2. Installing IIS12.2. Installing and Configuring Web Servers and Sites12.2.1. Creating a Web Site12.2.2. Managing IIS Permissions12.2.3. Configuring User Authentication12.2.4. Configuring Web Site Properties12.2.4.1. Configuring the IP address used for the server12.2.4.2. Configuring access12.2.4.3. Setting MIME12.2.4.4. Configuring NTFS permissions12.2.4.5. Configuring logging12.2.4.6. Adding IIS components and services12.2.4.7. Enabling and configuring extensions12.2.5. Reviewing Web Server Security12.2.6. Editing the Metabase12.2.7. Using IIS Backup and Recovery12.2.8. Configuring SSL12.2.8.1. Requesting a certificate12.2.8.2. Installing the certificate12.2.8.3. Configuring the web site to require SSL12.2.8.4. Backing up and restoring certificates12.2.9. Configuring FTP12.2.9.1. Creating an FTP site12.2.9.2. Configuring FTP authentication12.3. IIS Mail Services12.3.1. Configuring Email Services12.3.2. Using a Mail Gateway with the SMTP Virtual Server12.3.3. Monitoring SMTP12.4. Installing and Running IIS Applications12.4.1. Determining Session State Requirements12.4.2. Using Web Site and Application Isolation12.4.2.1. Isolation by disk and/or subdirectory12.4.2.2. Isolation via unique worker processes12.4.2.3. Security context and impersonation12.4.3. Choosing a Process Isolation Mode12.4.4. Managing Application Pools and Worker Processes12.4.4.1. Creating and configuring application pools12.4.4.2. Monitoring the health of application pools12.4.4.3. Recycling worker processes12.5. Summary
13. Network Security Administration
13.1. Security Administration Framework13.2. Windows Security Posture13.2.1. Permissions and Privileges13.2.1.1. Privileges and permissions not explicitly granted are denied13.2.1.2. Deny permissions may or may not override allow13.2.2. Anonymous Access and Null Sessions Are Possible13.2.3. Administrators Are All-Powerful13.2.4. Delegation of Authority13.2.4.1. Multiple administrative groups13.2.4.2. Granular permissions and rights assignment13.2.4.3. Delegation of control13.2.5. Role Separation13.2.6. Centralized Administration with Group Policy13.2.7. Security Templates for Security Configuration13.2.8. Domains Are Not Security Boundaries13.3. Configuring Advanced Network Security Features13.3.1. Storage and Use of EFS-Encrypted Files on Network Servers Using WebDAV13.3.2. Integration of Certificate Services into Windows Networking13.3.2.1. Configuring domains to use certificate services13.3.2.2. Obtaining certificates for DCs and servers13.3.2.3. Configuring SMTP transport for AD replication13.3.2.4. Securing LDAP communications13.3.3. SMB Signing13.4. Summary
14. Troubleshooting TCP/IP
14.1. Approaching a Problem14.1.1. Troubleshooting Hints14.2. Diagnostic Tools14.3. Testing Basic Connectivity14.3.1. The ping Command14.3.2. Using portqry14.4. Troubleshooting Network Access14.4.1. Troubleshooting with the ipconfig Command14.4.2. Troubleshooting with the arp Command14.4.2.1. ARP problem case study14.4.3. Checking the Interface with netstat14.4.3.1. Network hardware problems14.5. Checking Routing14.5.1. Tracing Routes14.6. Checking Name Service14.6.1. Some Systems Work, Others Don’t14.6.1.1. The data is here and the server can’t find it14.7. Analyzing Protocol Problems14.7.1. Network Monitor14.8. Protocol Case Study14.9. Summary
A. DHCP Options
B. DHCP Audit Log Identifiers
C. DNS Resource Records
C.1. Basic Resource RecordsC.1.1. Start of Authority RecordC.1.2. Name Server RecordC.1.3. Address RecordC.1.4. Mail Exchanger RecordC.1.5. Canonical Name RecordC.1.6. Domain Name Pointer RecordC.1.7. Service Location (SRV)C.2. Less Commonly Used Resource RecordsC.2.1. AFS Database (AFSDB)C.2.2. ATM Address (ATMA)C.2.3. Host Information (HINFO)C.2.4. IPV6 Host (AAAA)C.2.5. ISDNC.2.6. Mail Group (MG)C.2.7. Mailbox (MB)C.2.8. Mailbox Information (MINFO)C.2.9. Next Domain (NXT)C.2.10. Public Key (KEY)C.2.11. Rename Mailbox (MR)C.2.12. Responsible Person (RP)C.2.13. Route Through (RT)C.2.14. Signature (SIG)C.2.15. Text (TXT)C.2.16. Well Known Services (WKS)C.2.17. X.25C.3. The Boot File
Index
About the Authors
Colophon
Copyright

Content preview from Windows Server 2003 Network Administration

Chapter 9. Protecting Hosts with Windows Host Firewalls

It is no longer enough to provide firewall services at an organization’s network perimeter. Each server and desktop computer that resides inside network boundaries requires its own security protection. In addition, when corporate laptops are plugged into the Internet from employee homes or hotel rooms, they become part of the perimeter of the corporate network. One way to protect hosts is by implementing a firewall on each individual host.

Firewall services are native to Windows XP and Windows Server 2003. While this book focuses on Windows Server 2003, it is important to have Windows XP information so that you can manage Windows XP clients in a Windows Server 2003 forest. This chapter examines Windows Server 2003 firewall services, including a personal firewall, TCP/IP protocol filters, a basic firewall as part of Routing and Remote Access Services (RRAS), and additional port filtering capabilities as part of the configuration of RRAS and its remote access policies. IP Security (IPSec) policies, also included in Windows Server 2003 firewall services, are discussed in Chapter 11.

Service Pack 2 (SP2) for Windows XP and Service Pack 1 (SP1) for Windows Server 2003 improve native firewall services by renaming and adding additional capability to the host-based Windows Firewall and by enabling it by default on Windows XP SP2 computers.

To begin our discussion of Internet connection firewalls, let’s review some firewall basics.

Firewall ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Windows NT TCP/IP Network Administration

Publisher Resources

ISBN: 0596008007Errata Page

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Windows Server 2003 Network Administration

by Craig Hunt, Roberta Bragg

Chapter 9. Protecting Hosts with Windows Host Firewalls

Firewall ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.