Hello, Cloud Gurus,
and welcome back for this lesson.
We're going to take a look
at installing Dynamic Host Configuration Protocol,
more commonly referred to as DHCP server on Windows Server.
Let's take a look at what we're going to cover.
First up, we'll introduce DHCP,
then we'll take a look at how DHCP works.
We'll explore DHCP Relay.
We'll take a look at DHCP scopes.
We'll cover off high availability scenarios.
And then we'll finish up with a demo
where we'll deploy a DHCP server and failover scope.
Let's get started.
Now, all clients on a network need a unique IP address
to identify their client.
DHCP enables the distribution
of IP configuration information,
including IP addresses,
DNS servers, gateways, and related options.
And this information is distributed from DHCP servers
to DHCP clients.
And DHCP ensures all clients
have valid IP configuration information,
and it reduces the chance of conflicting IP addresses.
And DHCP also helps reduce administrative effort
by enabling centralized administration,
using things like relays and high availability
to ensure the reliable distribution of IP addresses.
Now, let's take a look at how DHCP works.
Let's say we have a Windows client and a Windows server,
and those 2 devices are connected to the same subnet.
Now, by default, Windows is configured to use DHCP
for IP configuration and address assignment.
And this is the case
for both the Windows client and the Windows server.
If you don't have a DHCP server on your network,
both computers will assign themselves
an automatic IP address
referred to as automatic private IP addressing or APIPA.
And this ensures
that these devices will be able to communicate
with other devices on the network.
And the automatic IP address is assigned
from the range 169.254.0.0 to 169.254.255.255.
And by default,
both of these devices will continue to attempt
to discover a DHCP server.
If you deploy the DHCP Server role on the Windows server,
it becomes a DHCP server,
and the Windows client will continue
to send its DHCP discovery packets.
The newly deployed DHCP server will respond
with a DHCP offer packet,
which contains a potential IP address for the client,
and if there are multiple DHCP servers,
all the DHCP servers would send offers to the client.
The client will select the first offer it receives
and send a DHCP request packet
that contains the server identity that sent the offer.
And this tells all the other DHCP servers on the network
which offer the client has accepted.
The server will then store the client IP address information
in its database, using the Mac address
as the unique identifier for the client,
and then it will respond with a DHCP acknowledge packet.
And the IP address is then leased
to the client for the duration configured on the server.
And this 4-step communication process is referred
to as DORA: discover, offer, request, acknowledge.
And when the DHCP lease on the client,
which is 50% of the lease time,
the client will automatically attempt to renew the lease.
Now, normally a corporate network is not that simple.
Usually you'll have multiple subnets
in a single site to segregate your network
and create a communication and security boundary
between different devices like servers and clients.
And you'll also have subnets in remote sites
and these remote locations will likely be connected together
creating a wide area network,
and you'll usually have routers providing this connectivity.
Now, you can deploy a DHCP server in each subnet,
but the administrative overhead will be considerable
and you won't be protected
if that DHP server in that site fails.
So provided the links between your sites are reliable.
For example, if you have a primary and a backup link,
it's fairly common in my experience
to centralize your DHCP servers.
But that DORA process we just spoke about
only works within a subnet because it's based on broadcasts,
and broadcasts only broadcast within a subnet,
and a subnet is sometimes referred to as a broadcast domain.
So how can we get those network packets
to our central DHCP servers?
Well, you can install what's known as a DHCP relay.
Your rounders can often act as a relay
or you can deploy a Window server to act as a relay,
but your pair of central DHCP servers will not just work;
you'll need to configure them to be highly available
so they don't issue duplicate addresses.
But before we can discuss high availability,
we need to take a closer look
at how DHCP servers allocate IP addresses.
DHCP servers provide IP addresses from DHCP scopes.
A DHCP server can host multiple scopes.
The source IP address the discovery packet was received on
determines the scope the DHCP server will use.
When you create a DHCP scope,
you'll provide a name for your scope
and you'll also provide an IP address range
and subnet mask,
which defines the range of IP addresses
to allocate to DHCP clients.
You also specify a lease duration,
which is the amount of time
a client can lease an IP address for from that scope.
And the scope also defines DHCP options
like DNS servers and router IP addresses.
You can also set some DHCP options per server
if they are shared across all scopes on the server.
For example, a value like your DNS servers might be common
across all of your DHCP scopes.
And you can also configure exclusions,
which are addresses that will not be allocated
from the address range.
When you configure the scope,
you might use the entire subnet as the range,
and then you might exclude some addresses
for things like printers and servers.
Using an exclusion
provides the flexibility to adjust the range
of addresses without deleting and recreating the scope.
And you can also create reservations
that bind a specific IP address
to a specific client Mac address.
And this ensures
that that client will always receive the same IP address.
Now, when you have DHCP deployed on your network
providing IP addresses to your clients,
it becomes a critical piece of network infrastructure.
It's no less important than the network itself.
So it's common to see DHCP deployed on-premises
using some sort of capability
that provides high availability.
And there are a few options to do this
and all of them provide automatic redundancy.
Let's take a look at them.
The first most complicated
and expensive option is to deploy a failover cluster.
This involves deploying 2 identical servers,
connecting them to shared storage
and multiple networks,
and deploying a Window server failover cluster.
With the failover cluster,
only one server is active at any time.
And in the event of a failure,
the DHCP server service failover
to another server in the cluster,
and this option provides continuity
of IP address leases in the event of a server failure.
The second, and up until recently,
the most common, high availability option for DHCP
was to use split scopes.
With a split scope, you can configure about 70%
of the addresses to be available to be leased
on your first DHCP server by excluding the other 30%
and then you do the opposite on your secondary server.
And you also might configure a delay
on the server with only 30% of the addresses
so it's less likely to issue IP address leases.
And then your first server will issue IP addresses
and in the event of a failure,
the secondary server
will take over leasing the IP addresses.
Now, split scopes don't provide IP address continuity
in the event of a failure.
and can't be used if you're using a high number
of addresses from your scope.
But DHCP split scopes is fairly easy to configure.
The third and latest option is to use DHCP failover.
DHCP failover works by configuring 2 Windows servers
to configure a DHCP scope,
including all of the configuration of the scope
and the leases.
The key difference between DHCP failover
and split scopes is
that the leases are shared in DHCP failover.
So IP address continuity is provided
in the event of a failure with DHCP failover.
And by default, DHCP failover is active-active
with both servers providing leases.
What this means for you is that in your career,
you're likely to come across a variety of these deployments,
due to the age of some corporate networks.
But if you are deploying a new,
highly available DHCP server deployment,
you should opt for DHCP failover.
All right, let's take a look at a demo
of deploying DHCP server and a failover scope.
We have an existing network with a domain controller,
and in larger networks that have higher levels
of security requirements,
it's recommended not to deploy the DHCP Server role
on your domain controllers.
So we're going to use our administrative server
ADM01 to install the DHP Server role
on our 2 new DHCP servers, CORP-BNE-DHCP01
and CORP-BNE-DHCP02
And we'll also install the management tools
on CORP-BNE-ADM01
Now, DHCP servers in an Active Directory domain need
to be authorized before they can host DHCP scopes
and issue IP addresses.
So we'll authorize our DHCP servers in Active Directory.
And you need to be a member of Enterprise Admins
to authorize our DHCP server.
Then we'll configure a DHCP failover scope
between our 2 DHCP servers
for a new workstation subnet
where our DHCP clients will be connected.
And then finally, we'll activate the scope.
Let's take a look.
All right, so here we are logged
onto our administrative server.
Let's go ahead and install the DHCP Server role
on our 2 DHCP servers.
To do that we'll use
the install Windows feature PowerShell cmdlet.
But what I'm going to do is
I'm going to pipe the server names
to the Foreach-Object PowerShell cmdlet.
We'll go ahead and run that.
And this is one of the beauties
of PowerShell is being able to install a Windows feature
on multiple servers at the same time.
This will just take a moment to complete.
So we'll come back when this is done.
All right, the DHCP server is now installed
on each of those 2 servers.
Let's go ahead
and install the remote server administration tools
for DHCP on our local server.
And we'll use Install-WindowsFeature again,
and we'll just specify that
we want to install the remote server administration tools
for DHCP.
We'll go ahead and run that.
This will just take a moment to complete.
So we'll come back when this is done.
Now, let's go ahead and launch the DHCP management console.
So to do that,
we'll click Start.
We'll navigate to Administrative Tools
and then we'll launch the DHCP management console.
Now, let's add some servers into this console.
So I'll right-click the DHCP node.
We'll add server and we'll add our 2 DHCP servers
and then we'll just expand the servers
in the left-hand pane.
And now we'll right-click each of our servers
and authorize them in Active Directory.
So we'll authorize our first server
and then we'll go ahead and authorize our second server.
All right, now let's go ahead and select the IPv4 node
on our first server,
and we'll right-click IPv4, and we'll select a New Scope.
And we'll go ahead and select Next on the welcome screen
and we're going to go ahead and create our workstation scope
and then click Next.
And we're going to use the IP address range
of 10.1.70.1 to 10.1.70.254.
Now, the reason we're starting at 1 is
because zero is the network address
so we can't use that for DHCP clients.
And 255 is the broadcast address
so we can't use that for DHCP clients.
And we're going to set the subnet mask to 24,
which is 255.255.255.0.
And then we'll go ahead and click Next.
And we're not going to add any exclusions or delays;
we'll look at that in an upcoming lesson.
So we'll go ahead and click Next.
And we're going to leave the default Lease Duration
of 8 days.
So we'll go ahead and click Next.
And we're going to go ahead
and skip DHCP options because we're going to configure
that in an upcoming lesson as well,
and then I'll click Next.
And then we can go ahead and click Finish.
Now, let's go ahead and configure failover for this scope.
So we'll right-click our scope
and select Configure Failover.
And the wizard's
automatically selected the only scope we have available
on our DHCP server at the moment.
So we can go ahead and click Next.
and now we need to add our partner failover server.
We're going to use CORP-BNE-DHCP02,
and then we'll go ahead and click Next.
And we're going to go ahead and change the relationship name
just so it doesn't have the IP address of the start here.
And this client lead time allows DHCP clients
to extend their DHCP lease
by up to 1 hour with their current DHCP server
and the 1 hour value is recommended in production.
So we'll go ahead and leave that.
Now, for the modes we can use load balancing
or we can use hot standby.
I prefer load balancing
because both servers will be active
and we can guarantee that both servers will work
in a failover situation,
and we'll leave the servers to share the load at 50% each.
And we're going to enable the state switchover interval
and leave it at the default of 60 minutes,
and this enables automatic failover.
Now, we can go ahead and enable a shared secret
and then we can go ahead and click Next
then we can go ahead and click Finish.
And now that's been configured,
so we can go ahead and click Close.
And now we can go ahead
and activate our scope to make it active.
So I'll right-click our scope,
and then we'll select Activate.
Our DHP scope has now been configured
and has been configured to use failover
between our 2 DHCP servers.
Now, let's wrap up with a bit
of a summary of what we've covered in this lesson.
So what have we covered?
DHCP servers lease IP addresses to DHCP clients,
and DHCP servers also provide DHCP configuration options
like the DNS server and the gateway or router IP addresses.
And a DHCP server must be authorized to lease IP addresses
in an active directory domain environment.
And only Enterprise Admins can authorize DHCP servers.
And a DHCP relay can be used
to forward DHCP discovery requests to DHCP servers
in a separate subnet.
And you can configure DHCP scopes
with 2 servers using DHCP failover
to provide high availability.
All right, that concludes this lesson.
Thanks for being with me.
I hope you found it useful,
and I look forward to seeing you on the next lesson.