Hello, Cloud Gurus,
and welcome back for this 2-part lesson
on implementing IP Address Management or IPAM.
Let's take a look at what we're going to cover.
First up, I'll introduce IPAM,
then we'll take a look at how IPAM works
and then we'll explore what's required
to get IPAM up and running,
and then we'll wrap up by taking a look
at some of the great security features in IPAM.
Now, I do apologize in advance for the amount of times
I'm going to say IPAM in this lesson.
Oh, there I go again.
For as long as I can remember,
IT pros have managed their IP addresses
using a range of different tools,
and the most common IP address management tool I've seen
has been the trustee Microsoft Excel spreadsheet.
Unfortunately, the Excel spreadsheet relies on humans
keeping their records up to date
and there is always the factor of human error.
I can recall at least a few times throughout my career
where I've been told to ping an IP address
before allocating a static IP address to a new server.
IPAM was introduced in Windows Server 2012
to solve this exact problem.
IPAM is a Windows Server feature used to discover, monitor,
and audit the IP address space
used on your corporate network.
And IPAM integrates with Windows Server DNS
and the DHCP Server roles to provide these capabilities.
And it does this by importing your DNS zones
and your DHCP scopes and all of the associated data.
You can also manage static IP address assignments,
those that are not managed by DHCP servers
in your organization, using IPAM;
for example, those IPs that are used by routers, printers,
and network switches.
And once all of your servers are discovered
and all the data is imported,
you can monitor your IP address space,
your DNS servers and their zones,
and your DHCP servers and their scopes.
And with the role-based access control capabilities of IPAM,
you can delegate access to manage these resources
within your organization.
Let's take a look at a fairly typical medium-sized network.
You might have a head office with some DHCP and DNS servers
and this head office will have a number of subnets
and it'll also have a number of network devices
that have static IP addresses assigned,
things like routers, switches, and printers.
And you might also have a regional office
and it will also have a number of subnets.
And this office also might have DHCP servers,
DNS servers, and some network devices.
And you also might have a branch office
with DHCP and DNS servers
and its own subnets and network devices.
And this network could have more branches
or more regional offices, or even be stretched globally
and have hybrid deployments in Azure or multiple clouds.
And by default, there is no central location to store
all of the manual configuration of these IP addresses.
To help bring these IP address spaces
including the subnets and IP addresses under management,
you can deploy an IPAM server.
You can deploy IPAM centrally like what's shown here,
or for larger networks, you can deploy IPAM decentrally.
For example, you could deploy an IPAM server
per country or per region,
but just be aware that the data doesn't roll up
from the regional IPAM servers to the central IPAM server.
And IPAM can help document your IP address usage
by discovering your DHCP and DNS servers across your network
and bringing all of the configuration data and logs
into your IPAM server.
Now, your IPAM deployment will start with the deployment
of the IPAM server Windows Server feature.
Note that if you're installing this through Server Manager,
it's a feature and not a role.
The name used to install this feature
in PowerShell is just IPAM.
Your IPAM server should not be a domain controller
or a DHCP server, but the IPAM server can run Server Core.
You'll also deploy a database
as part of the server provisioning process.
You can use a Windows Internal Database or SQL Server
and SQL Server can be deployed on the IPAM server
or a separate server.
For most deployments,
you'll use the Windows Internal Database.
But for very large deployments, you can opt to use SQL.
And IPAM is managed through Server Manager
and you can use the IPAM server as an IPAM client
by installing the management tools
when you install the IPAM feature,
but you can only manage an IPAM server from itself
if it's not running Server Core,
but it's more likely you'll manage IPAM
from an administrative workstation or a server.
You can install the IPAM client feature to manage IPAM
and then you can discover your servers.
You can set a discovery scope by selecting the forest
and the domains you'd like to discover,
and your servers will need to be configured for discovery
to be successful.
You can configure the servers manually,
or you can use group policy
using the Invoke-IpamGpoProvisiong cmdlet
and include the domain, prefix for the GPO names,
and the IPAM server name.
And then you need to verify the connectivity
to the discovered servers
and bring those discovered servers under management
by enabling the management of those servers
through the IPAM client.
Now, we're all big fans
of the principle of lease privilege, right?
Of course, we are.
It's good to know that IPAM has powerful
role-based access control built in.
There are 3 key components
to IPAM role-based access control.
First, there is the definition of what someone can do.
In IPAM, this is referred to as a role,
and the permissions are fairly granular.
For example, you could limit someone
to just editing DHCP scopes.
And then there is the where they can perform the operation.
And in IPAM, this is referred to as an access scope.
By default, all of your servers and resources
are in the global scope, but you can create your own scopes
to control access more granularly.
And then you combine these 2 components together
in an access policy
and grant access to either an individual user or a group.
And there are a number of built-in groups that can be used
to grant access to IPAM capabilities.
And at first glance, they have some rather confusing names,
so let's take a look at them.
The first is the IPAM Administrators group.
And as you would expect, this includes full access to IPAM.
The next is the ASM Administrators group
and ASM stands for Address Space Management,
so this means users that have this role
can manage the address spaces in IPAM,
but they cannot manage the servers.
To manage the servers, you need to be a member
of the IPAM MSM Administrators group.
And MSM stands for Multi-Server Management.
And the final built-in group to be aware of is IPAM Users.
And this provides read access to all of IPAM
with the exception of audit data.
It's worth pointing out
that the ASM and MSM administrator permissions
include all of the permissions of the IPAM Users group,
so you don't need to add someone to both the Users group
and the Administrators group to grant them read access.
All right, now let's take a look
at some of the key takeaways from this lesson.
An IPAM server discovers and stores IP address
and server management data
and the IPAM client is part of Server Manager
and it's used to manage IPAM
and this can be the IPAM server or another client,
which might be Windows Server or a Windows client machine.
And the IPAM server can use
either the Windows Internal Database or SQL Server.
And most deployments will only require
the Windows Internal Database.
But if you do require SQL,
remember that the SQL Server database
can be hosted on the IPAM server or on a separate server.
And IPAM role-based access control
has 3 main components.
Roles and scopes are combined into access policies
and access policies are linked to users or groups
to provide access.
And also make sure you remember those
ASM or Address Space Management
or MSM or Multi-Server Management acronyms for the exam
as they'll likely make for great exam questions.
All right, that concludes this lesson.
Thanks for being with me.
I hope you found this useful
and I look forward to seeing you on the next lesson.