Getting Started with Windows Server Networking [Getting Started]

1 Hour Remaining

Getting Started with Windows Server Networking

This hands-on lab has been designed to help you acquire and verify the baseline skills and knowledge you need
to successfully complete the Windows Server Networking challenge series.

Introduction
In this lab, you will configure a Windows® Server core network. First, you will verify IPv4 connectivity and
DNS resolution, and then you will establish Dynamic Host Configuration Protocol (DHCP) failover. Next, you
will configure a Domain Name System (DNS) secondary zone, and then you will configure Web Application
Proxy (WAP). Finally, you will configure a virtual private network (VPN) connection, and then you will
configure a Distributed File System (DFS) namespace and DFS replication.

Understand your environment

You will be using a network that has three servers and a workstation. DC1 is a domain controller that has
Active Directory® Domain Services (AD DS), DNS, and Certificate Services installed. APP1 is a member
server that has IIS installed. W10-Admin is a workstation that is running Windows 10. You will configure the
RRAS as a Web Application Proxy and a Remote Access server.

Verify IPv4 connectivity and review installed

services
In this task, you will verify IP connectivity, and then you will review the services installed on the servers.

1. Sign in to DC1 as Contoso\Administrator using Passw0rd! as the password.

Select the Type text icon to enter the associated text into the virtual machine.

2. On the taskbar, select Server Manager.

3. In the navigation pane, verify that the Active Directory Certificate Services (AD CS), Active Directory
Domain Services (AD DS), Active Directory Federation Services (AD FS), Domain Name System
(DNS), and File and Storage Services roles are installed on DC1.

Sensitivity Label: General

 Active Directory Certificate Services is used to manage and issue certificates to users and
computers. AD DS is the role that makes this server a domain controller. AD FS is used to create
trust relationships with other organizations. The DNS service resolves computer names to IP
addresses. File and Storage Services makes this server a file server.

4. In Server Manager, on the Tools menu, select Active Directory Users and Computers.

5. Select the Domain Controllers organizational unit (OU), and then verify that DC1 is listed a domain
controller for the contoso.com domain.

Sensitivity Label: General

6. Expand the Corp OU, select Users, right-click Ben Smith, and then select Properties.
7. On the Account tab, verify that the User logon name is BenS.

8. On the Member Of tab, verify that Ben Smith is a member of the Domain Admins group.

Sensitivity Label: General

 You will use the user Ben Smith in later tasks to test various remote connections.

9. Close the Ben Smith Properties window, and then minimize Active Directory Users and Computers.
10. In Server Manager, on the Tools menu, select DNS.
11. Expand Forward Lookup Zones > contoso.com, and then review the IP addresses of the hosts in this
DNS zone.

DNS resolves computer names to their IP addresses. It also allows clients to locate server
services on the network — for example, domain controllers — so that clients can submit
authentication requests.

12. Close DNS Manager.

13. On the taskbar, select Search Windows, and then enter PowerShell.
14. Right-click Windows PowerShell, and then select Run as administrator.

Windows PowerShell is a command-line interface tool which is useful for bulk administration
and for automating tasks.

15. Run the following command to test IPv4 connectivity to App1:

Test-NetConnection App1.contoso.com

16. Verify that the ping succeeds.

17. Run the following command to test IPv4 connectivity to RRAS:

Test-NetConnection RRAS.contoso.com

18. Run the following command to test IPv4 connectivity to W10-Admin:

Sensitivity Label: General

 Test-NetConnection W10-Admin.contoso.com

19. Close Windows PowerShell.

20. Switch to W10-Admin, and then sign in as Contoso\BenS using Passw0rd! as the password.
21. On the taskbar, select Microsoft Edge, and then go to App1.contoso.com to verify connectivity to the
App1 server.

By successfully connecting to the IIS webpage, you are verifying that DNS resolved the URL to
the correct IP address, that there is IP connectivity to the webpage, and that the web server is
operational and responding.

22. Close Microsoft Edge.

23. Switch to RRAS, and then sign in as Contoso\Administrator using Passw0rd! as the password.
24. On the taskbar, select Server Manger, and then select Local Server.
25. Verify that this server has an interface that has an IP address of 192.168.10.254 on the internal network,
and one interface that has an IP address of 131.107.57.254 on the external (internet) network.

In an upcoming task, you will configure the RRAS server as a Web Application Proxy (WAP)
server and a Remote Access server. WAP servers are typically located on a perimeter network —
between the external firewall connected the internet and an internal firewall protecting the
internal network. A WAP server receives web requests, verifies credentials, and then allows
access to internal web resources. A Remote Access server allows encrypted virtual private
network (VPN) access from remote clients to the internal network.

Establish DHCP failover

In this task, you will establish Dynamic Host Configuration Protocol (DHCP) resiliency. First, you will install
DHCP services on two servers, and then you will configure DHCP failover.

1. Switch to DC1.
2. In Server Manager, select Add roles and features.

Sensitivity Label: General

3. In the Add Roles and Features Wizard, select Next three times to advance to the Select server roles
page.
4. On the Select server roles page, select the DHCP Server check box, and then select Add Features.
5. Select Next three times, and then select Install.

By installing the DHCP role on this server, you can use it to assign IP addresses to clients
dynamically.

6. When the installation is complete, select Close.

7. In Server Manager, on the menu bar, select the Notifications flag, and then select Complete DHCP
configuration.

8. Select Next to accept the creation of DHCP administrative groups, select Commit to authorize the
DHCP server in Active Directory, and then select Close.

You may need to maximize the wizard to see the Next and Commit buttons.

The DHCP Administrative group can be used for delegation — members of DHCP
Administrators group can make changes to the DHCP configuration — whereas members of the
DHCP Users group have read access for viewing statistics on the DHCP server. The DHCP
server is also authorized by Active Directory, which helps prevent unauthorized or rogue DHCP
servers on the network.

more...

9. In Server Manager, on the Tools menu, select DHCP.

10. Expand dc1.contoso.com > IPv4, right-click IPv4, and then select New Scope.

Sensitivity Label: General

11. Select Next, in Name, enter ContosoScope, and then select Next.
12. In Start IP address, enter 192.168.10.100, in End IP address, enter 192.168.10.150, and then ensure that
the Subnet mask is 255.255.255.0.
13. Advance through the wizard to the Router (Default Gateway) page.
14. On the Router (Default Gateway) page, in IP address, enter 192.168.10.254, select Add, and then select
Next.
15. On the Domain Name and DNS Servers page, ensure that the Parent domain is set to contoso.com,
ensure that the IP address 192.168.10.1 is displayed, and then select Next twice.
16. On the Activate Scope page, select Next to activate the scope now, and then select Finish.

A DHCP scope is a range of IP addresses that the server will assign to clients on the network.
The default gateway is the router that will route clients to other networks, and the DNS server
will resolve computer names to IP addresses.

17. Switch to APP1, and then sign in as Contoso\Administrator using Passw0rd! as the password.
18. On the taskbar, select Server Manager.
19. In Server Manager, select Add roles and features.
20. In the Add Roles and Features Wizard, select Next three times to advance to the Select server roles
page.
21. On the Select server roles page, select the DHCP Server check box, and then select Add Features.
22. Select Next three times, and then select Install.

You are installing the DHCP server role on this server to create a failover so that, if one server
fails, the scope can fail over to the other server, thereby maintaining the service availability.

23. When the installation is complete, select Close.

24. In Server Manager, select the Notifications flag, and then select Complete DHCP configuration.

Sensitivity Label: General

25. Select Next to accept the creation of DHCP administrative groups, select Commit to authorize the
DHCP server in Active Directory, and then select Close.
26. Switch to DC1.
27. In the DHCP console, right-click IPv4, and then select Configure Failover.
28. Select Next to accept the scope that will replicate.
29. Select Add Server, in This server, enter App1, select OK, and then select Next.
30. On the Create a new failover relationship page, in Maximum Client Lead Time, change the value to 10
minutes, select the State Switchover Interval check box, change the value to 10 minutes, and then in
Shared Secret, enter Passw0rd!.

Sensitivity Label: General

You are setting up the DHCP failover in load balance mode where both servers will each have
about 50 percent of the addresses and can both assign IP addresses to clients. The servers
communicate to each and replicate the addresses that have been assigned.

o The state switchover interval is set to 10 minutes. This is the amount of time a server will
wait to receive communication from another server, after which the uncommunicative
server will be assumed to be down.
o The maximum client lead time is the time after which one server can take complete
control of the scope.
o The shared secret prevents imposter DHCP servers from trying to connect and replicate
IP information.

Sensitivity Label: General

 more...

31. Review the remaining default properties, select Next, select Finish, and then select Close.
32. Switch to APP1, and then in Server Manager, on the Tools menu, select DHCP.
33. Expand app1.contoso.com, select IPv4, and then verify that the ContosoScope has replicated.

34. Right-click ContosoScope, select Display Statistics, and then verify that approximately 50 percent of
the addresses in the scope have been assigned to APP1.
35. Select Close, and then close the DHCP console window.

The servers are now configured for failover. This makes the DHCP service highly available as
well as improving performance because both servers are actively responding to client requests.

Install DNS and configure a secondary zone

In this task, you will install DNS, and then you will configure a secondary zone for contoso.com on APP1.

1. On APP1, in Server Manager, on the Dashboard, select Add roles and features.
2. Select Next three times to advance to the Select server roles page.
3. On the Select server roles page, select the DNS Server check box, and then select Add Features.
4. Select Next three times, and then select Install.

DNS is already installed on DC1, which is an authoritative primary DNS server for the
contoso.com zone. You are installing DNS on App1 so that you can create a secondary zone on
App1 for better DNS availability.

5. When the installation is complete, select Close.

6. Switch to DC1, and then in Server Manager, on the Tools menu, select DNS.
7. Expand Forward Lookup Zones > contoso.com, right-click contoso.com, and then select Properties.
8. On the Name Servers tab, select Add, in Server fully qualified domain name (FQDN), enter
App1.Contoso.com, and then select Resolve.
9. Ignore the IP Address warning, and then select OK to add App1.Contoso.com as a name server.

By listing App1 as a name server, you are making it authoritative for the contoso.com zone so it
will be able to respond to DNS client requests to resolve computer names in contoso.com to the
correct IP addresses.

10. On the Zone Transfers tab, select the Allow zone transfers check box, and then select Only to servers
listed on the Name Servers tab.

Sensitivity Label: General

11. Select Notify, select Click here to add, enter App1.Contoso.com, and then press Enter.
12. Delete any IPv6 entries, wait for the IPv4 address to be validated, and then select OK twice.

Allowing a zone transfer to App1 is a security setting because you are defining which servers are
allowed to receive a copy of the DNS zone information.

The Notify option is a performance benefit because DNS changes are made to the primary zone
on DC1, and then the secondary DNS server will be notified so that App1 will immediately
replicate the new DNS resource records.

13. Close DNS Manager.

14. Switch to APP1, and then in Server Manager, on the Tools menu, select DNS.
15. In the Console Tree, select and then expand App1, right-click Forward Lookup Zones, and then select
New Zone.

16. In the New Zone Wizard, select Next, select Secondary zone, and then select Next.
17. In Zone name, enter Contoso.com, and then select Next.
18. In Master Servers, enter DC1.contoso.com, and then press Enter.

Sensitivity Label: General

 19. Select and delete any IPv6 entries, select Next, and then select Finish.

The replication process is called Incremental Zone Transfer (IXFR). This process only replicates
changes.

20. In DNS Manager, in the Console Tree, expand Forward Lookup Zones, select Contoso.com, and then
verify that you see the Contoso.com resource records replicated.

If you don't see the zone transfer, right-click Contoso.com, select Transfer from Master, and
then select Refresh.

21. Close DNS Manager.

App1 as a secondary DNS server can now respond to DNS client requests which creates
resiliency and performance benefits because now there are two DNS servers.

Install Web Application Proxy

Sensitivity Label: General
In this task, you will install Web Application Proxy (WAP) to allow external users to access internal web
services.

1. Switch to RRAS, and then if needed, sign in as Contoso\Administrator using Passw0rd! as the password.
2. In Server Manager, on the Tools menu, select DNS.
3. Expand Forward Lookup Zones, right-click Contoso.com, and then select New Host (A or AAAA).

4. In Name, enter adfs, in IP address, enter 192.168.10.1, and then select Add Host.

5. In the DNS message box, select OK.

6. In Name, enter App1, in IP address, enter 131.107.57.254, select Add Host, and then in the DNS
message box, select OK.
7. In the New Host window, select Done.

Sensitivity Label: General

 In this lab, RRAS is also a DNS server that represents a public DNS server on the internet, so it
has a public IP address for the host record for adfs.contoso.com. When you move the W10-
Admin workstation to the outside network of RRAS in an upcoming task, it will be able to
resolve adfs.contoso.com to the external interface of RRAS.

RRAS is also going to be a WAP server which does need to communicate to AD FS for its setup,
so you are creating an adfs host record to resolve to 192.168.10.1, which is the IP address of
DC1 where AD FS is installed. This DNS server also needs to resolve a web application to the
external IP address of RRAS — 131.107.57.254.

8. Switch to Server Manager, in the navigation pane, select Dashboard, and then on the Dashboard,
select Add roles and features.
9. Select Next three times to advance to the Select server roles page.
10. On the Select server roles page, select the Remote Access check box.
11. Select Next three times to advance to the Select role services page.
12. On the Select role services page, select the DirectAccess and VPN (RAS) check box, and then select
Add Features.
13. Select the Web Application Proxy check box, select Next three times, and then select Install.

You will use WAP in this task. You will use VPN in the next task.

14. Wait for the installation to finish, and then select Close.
15. In Server Manager, on the Tools menu, select Remote Access Management.
16. Select Web Application Proxy, and then select Run the Web Application Proxy Configuration
Wizard.

17. On the Welcome page, select Next.

18. In Federation service name, enter adfs.contoso.com, in User name, enter Contoso\Administrator, in
Password, enter Passw0rd!, and then select Next.

You need an AD FS server in order to configure WAP because WAP is a proxy for AD FS as
well as a proxy for web services.

19. In the Select a certificate to be used by the AD FS proxy drop-down list, select adfs.contoso.com, and
then select Next.

This adfs.contoso.com certificate was requested from Active Directory Certificate Services as
part of the lab setup. WAP needs this certificate to proxy client requests to AD FS.

20. Select Configure, and then when the configuration is complete, select Close.
21. In the Tasks pane, select Publish.

Sensitivity Label: General

 22. On the Welcome page, select Next.
23. Select Pass-through, and then select Next.

When creating publishing rules, on the Preauthentication page, you can select either AD FS or
pass-through authentication. AD FS authentication requires validation by the AD FS server.
Pass-through authentication uses the backend server — App1 — to validate the user's credentials
and tell the proxy to allow the connection through.

24. On the Publishing Settings page, in Name, enter ContosoWebApp, in External URL, enter
http://app1.contoso.com

The URL http://app1.contoso.com will also be entered as the Backend server URL.

25. Select Next, select Publish, and then select Close.

26. Close the Remote Access Management Console window.
27. Switch to W10-Admin.
28. On the desktop, double-click the MoveToExternalNetwork script, and then when prompted by User
Account Control, select Yes.

This script disables the network interface that would connect it to the internal network, and then
enables the interface on the external network. This simulates the client connecting from the
internet.

29. On the taskbar, select Microsoft Edge, and then go to http://app1.contoso.com to verify that you can
access the IIS Home Page by using WAP, and then close Microsoft Edge.

You have now verified that the public DNS service running on RRAS has resolved the URL of
the web service to the WAP external IP address. The publishing rule proxies the request to the
web server to validate the user's credentials, and then acts as a proxy for the connection to the
web server.

Configure a VPN server for remote clients

In this task, you will configure a VPN server to allow remote clients to connect securely across the internet and
access internal resources.

1. Switch to RRAS, and then in Server Manager, on the Tools menu, select Routing and Remote Access.
2. Right-click RRAS (local), and then select Configure and Enable Routing and Remote Access.

Sensitivity Label: General

 You installed the Remote Access role on RRAS in the previous task. Now you will configure
RRAS as a VPN server. VPNs allow clients on a private IP network to connect securely over the
internet and communicate to resources on private IP networks by creating a tunnel. This is also
known as encapsulation. The private IP addresses are encapsulated in public IP addresses which
allows routing across the internet.

3. On the Welcome page, select Next.

4. On the Configuration page, ensure that Remote access (dial-up or VPN) is selected, and then select
Next.
5. Select the VPN check box, and then select Next.

On the Remote Access page, if the VPN option is unavailable, select Cancel, and then try again.

6. On the VPN Connection page, select the 131.107.57.254 interface, and then select Next.

This is the interface that connects to the internet.

7. On the IP Address Assignment page, ensure that Automatically is selected, and then select Next.

Automatic IP address assignment uses DHCP.

8. On the Managing Multiple Remote Access Servers page, select Next, and then select Finish.
9. In the Routing and Remote Access warning message box, select OK.

You are going to use the internal DHCP server to allocate IP addresses to the VPN clients that
are connecting to RRAS. The DHCP message that appears at the end of the Routing and Remote
Access configuration is a standard message stating that if the DHCP server is on the other side of
a router, you need to configure a DHCP relay agent to take the DHCP broadcast traffic and send
it as a unicast request to the remote DHCP server. This isn't the case in this lab, since you have
two DHCP servers on the network to which RRAS is connected.

10. Right-click RRAS (local), and then select Properties.

11. On the IPv4 tab, verify that Ethernet 2 is the adapter used to obtain DHCP addresses, and then select
OK.

This should be the internal interface.

12. In Server Manager, on the Tools menu, select Network Policy Server.
13. Expand Policies, right-click Network Policies, and then select New.
14. In Policy name, enter AdminsPolicy, in Type of network access server, select Remote Access
Server(VPN-Dial up), and then select Next.
15. On the Specify Conditions page, select Add.
16. Select User Groups, and then select Add.
17. Select Add Groups, enter Domain Admins, and then select OK.
18. Select OK to add the group, and then on the Specify Conditions page, select Next.
19. On the Specify Access Permissions page, ensure that Access granted is selected, and then select Next.
20. Select Next on all remaining pages in the wizard to accept the remaining default values, and then select
Finish.

Sensitivity Label: General

 You are creating a policy in which members of the Domain Admins group — which includes the
user Ben Smith — will be allowed to access the RRAS server by using VPN.

21. Switch to W10-Admin.

22. Open Control Panel, and then in View by, select Small icons.
23. Select Network and Sharing Center, and then select Set up a new connection or network.
24. Select Connect to a workplace, and then select Next.
25. Select Use my Internet connection (VPN), and then select I'll set up an Internet Connection later.
26. In Internet address, enter 131.107.57.254, in Destination name, enter ContosoVPN, and then select
Create.
27. Select Change adapter settings.

28. Right-click ContosoVPN, and then select Properties.

29. On the Security tab, in Data encryption, select Require encryption (disconnect if server declines), in
Authentication, select Allow these protocols, ensure that Microsoft CHAP Version 2 is selected, and
then select OK.

Sensitivity Label: General

 Microsoft-Challenge Handshake Authentication Protocol (MS-CHAP v2) is a secure
authentication protocol in which a challenge is sent by the VPN server, and then if the client
enters the correct password, the appropriate response to the challenge is returned to the VPN
server.

more...

30. Right-click ContosoVPN, and then select Connect/Disconnect.

31. Select ContosoVPN, and then select Connect.
32. In User name, enter Contoso\BenS, in Password, enter Passw0rd!, and then select OK.
33. Open File Explorer, and then in the Address bar, enter \\dc1.contoso.com\c$ to verify that you can
access DC1.

If an error occurs, you may need to reboot RRAS.

You have configured a VPN to allow the client to access internal resources on a private network.

Sensitivity Label: General

Configure DFS
In this task, you will configure a Distributed File System (DFS). First, you will configure a DFS namespace,
and then you will configure DFS replication.

DFS allows you to create highly available data by replicating the data to multiple servers. This also increases
performance since multiple servers can now respond to clients.

1. Switch to DC1.
2. In Server Manager, on the Dashboard, select Add Roles and Features.
3. Select Next three times to advance to the Select server roles page.
4. On the Select server roles page, expand File and Storage Services, expand File and iSCSI Services,
select the DFS Namespaces check box, select the Add Features check box, and then select the DFS
Replication check box.
5. Select Next twice, and then select Install.
6. When the installation is finished, select Close.

The DFS Namespaces role service allows you to create a DFS root in a hierarchical file system
that will include folders that are replicated to multiple servers by using DFS Replication.

7. Switch to APP1, and then repeat the previous four steps.

Both DC1 and App1 will host the DFS namespace for resiliency in case one server is down. Both
servers will also replicate data folders for high availability of data.

8. Switch to DC1, and then in Server Manager, on the Tools menu, select DFS Management.
9. Right-click Namespaces, and then select New Namespace.
10. On the Namespace Server page, in Server, enter DC1, and then select Next.
11. On the Namespace Name and Settings page, in Name, enter ContosoDocs, and then select Next.
12. On the Namespace Type page, ensure that Domain-based namespace is selected, and then select Next.
13. Review the settings, select Create, and then select Close.

DC1 is now hosting the DFS namespace. This is a domain-based namespace which can be hosted
by member servers in this domain.

14. Expand Namespaces, right-click \\contoso.com\ContosoDocs, and then select Add Namespace
Server.

Sensitivity Label: General

15. In Namespace server, enter App1, and then select OK.
16. Select the \\contoso.com\ContosoDocs namespace, and then on the Namespace Servers tab, verify that
APP1 and DC1 are listed as namespace servers.

APP1 is now also hosting the DFS namespace. This creates high availability in case one server is
down. It also provides performance improvements, since both servers can respond to client
requests. Clients connect to the namespace by using \\contoso.com\ContosoDocs, and the
namespace server they are connecting to is transparent. If the namespace servers were in two
different geographical locations, then clients would connect to the local server.

17. Right-click the ContosoDocs namespace, and then select New Folder.
18. In Name, enter MarketingDocs, and then select Add.

19. Select Browse, and then select New Shared Folder.

Sensitivity Label: General

20. In Share name, enter MarketingDocs, in Local path of shared folder, enter C:\MarketingDocs, select All
users have read and write permissions, and then select OK.

Sensitivity Label: General

21. In the Warning message box, select Yes, in Browse for Shared Folders, select OK, and then in Add
Folder Target, select OK.

You are also using DC1 as a file server that will hold data that will be replicated for high
availability.

22. In the New Folder window, select Add.

Sensitivity Label: General

23. In Path to folder target, enter App1, select Browse, and then select New Shared Folder.
24. In Share name, enter MarketingDocs, in Local path of shared folder, enter C:\MarketingDocs, select All
users have read and write permissions, and then select OK.
25. In the Warning message box, select Yes, in Browse for Shared Folders, select OK, and then in Add
Folder Target, select OK.

Now App1 will also have a copy of the data that will be replicated in the next step.

26. Verify that \DC1\MarketingDocs and \App1\MarketingDocs are both listed as Folder targets for the
MarketingDocs DFS folder, and then select OK.

Sensitivity Label: General

27. When prompted to create a replication group, select Yes.

The replication group controls how the data is replicated to the multiple servers in the group.

28. On the Replication Group and Replicated Folder Name page, accept the default name, and then select
Next.
29. On the Replication Eligibility page, select Next.
30. On the Primary member page, in Primary member, select DC1, and then select Next.

You configure one server — in this case DC1 — as the primary member, so during the initial
replication, the primary server will copy all of its data over to the other member of the replication
group. After replication is complete, bi-directional replication will start.

31. On the Topology page, ensure that Full mesh is selected, and then select Next.
32. On the Replication Group Schedule and Bandwidth page select Next, review the settings, and then select
Create.
33. On the Confirmation page, select Close, and then in the Replication Delay message box, select OK.
34. Open File Explorer, and then connect to \\contoso.com\ContosoDocs.
35. Open MarketingDocs, then create a new text document named MarketingData.txt.

Sensitivity Label: General

 When clients connect to this domain-based namespace, and both servers are in the same
geographical location, client traffic will be load balanced to the DFS servers.

36. In File Explorer, verify that both \\DC1\marketingdocs and \\app1\marketingdocs have a copy of the file.

It may take a few minutes to initialize the replication. This shows that DFS replication is
working for this replication group, and that you now have resiliency and performance benefits.

Summary
Congratulations, you have completed the Getting Started with Windows Server Networking lab.

You have accomplished the following:

 Verified IPv4 connectivity and DNS resolution.

 Reviewed installed services.
 Established DHCP failover.
 Configured a DNS secondary zone.
 Configured a Web Application Proxy.
 Configured a VPN connection.
 Configured DFS.

Ending your lab

To ensure your lab is recorded as complete, select Submit or End below. Exiting [X] the lab will result in an
incomplete status.

Once you select Submit or End, you will not be able to return to this Challenge Lab.

Sensitivity Label: General