Hello, Cloud Gurus, and welcome back for Part 2
where we're going to get hands on
implementing IP Address Management.
In this lesson, we're just going to go through a demo
of deploying and managing IPAM.
Let's jump in.
In this demo we're going to deploy an IPAM server
on a new server named CORP-BNE-IPAM01,
and then we will deploy the IPAM client
to our administrative server CORP-BNE-ADM01,
and then we will complete the server discovery process
and bring our DNS and DHCP servers into management.
This includes our domain controller
and our 2 DHCP servers.
And then we'll wrap up with a review
of IPAM role-based access control.
Let's take a look.
All right, so here we are on our administrative server
and I've gone ahead and added our new IPAM server
into Server Manager.
Let's go ahead and install the IPAM feature
on our IPAM server.
So we'll go ahead and right-click our server
and then select Add Roles and Features.
We'll click Next on the welcome screen,
Next again for a role-based or feature-based installation.
We use our IPAM server so we'll go Next,
and we're not installing a Server role,
so we'll go ahead and select Next.
We are installing a feature and we're installing IPAM.
So we'll go ahead and select
IP Address Management Server here.
We'll add the required features
and we'll go ahead and click Next.
And then we can go ahead and click Install.
Now while that's installing in the background
let's go ahead and install the IPAM client
on our administrative server.
So we'll do that locally.
We'll just launch PowerShell
and we'll use the Install-WindowsFeature PowerShell cmdlet
and specify that we want to install the IPAM-Client-Feature.
Go ahead and press Enter.
All right, these 2 installs
will just take a moment to complete,
so we'll come back when these are done.
All right, the IPAM Client Feature
has now been installed locally,
so we can go ahead and close this.
And the IPAM feature has been installed on our IPAM server.
So we can go ahead and close this.
Server Manager is used to manage IPAM
so we'll go ahead and select the IPAM node
in Server Manager.
All right, and the first step
is to connect to our IPAM server.
So we'll go ahead and connect now.
We'll select our IPAM server.
We'll go ahead and click OK.
We'll just take a moment for that to connect.
Now we can go ahead and provision the IPAM server.
So we'll select the next step in the process.
We'll go ahead and select Next on the welcome screen
and for our small deployment we're okay
to use the Windows Internal Database,
but we could use a SQL server if we wanted to.
And we'll go ahead and select Next.
And we're going to use Group Policy
to provision our servers,
so let's provide a GPO name prefix
and we're going to use the prefix of IPAM
and then we're going to need to use
the invoke-IpamGpoProvisioning PowerShell cmdlet
once we're finished here.
So we'll go ahead and click Next.
And then we can go ahead and click Apply
to finish provisioning our IPAM server.
This will just take a moment to complete,
so we'll come back when this is done.
All right, now we need to provision our Group Policy Objects
and to do that, we'll use PowerShell.
So we'll go ahead and Close the IPAM provisioning wizard
and then we'll launch PowerShell
and we'll provision the Group Policy Objects
using the Invoke-IpamGpoProvisioning PowerShell cmdlet.
We'll specify the Domain
and we'll specify the GPO prefix name
that we used during the provisioning wizard.
And we'll also specify the IPAM server
fully-qualified domain name.
And it's just asking us to confirm.
So we'll go ahead and select Yes to confirm that.
And we'll get asked to confirm a few more times.
All right, now let's confirm
that our GPO provisioning was successful.
To do that,
we'll use both the Group Policy management console
and Active Directory Users and Computers.
We'll go ahead and close PowerShell.
We'll go ahead
and launch the Group Policy Management console.
We'll go ahead and Refresh this.
All right, and we can see that we have
our IPAM Group Policy Objects created
and linked to the domain.
If we go ahead and select the IPAM_DNS GPO,
we can see that there's no values in Security Filtering
and the Security Filtering on this GPO is populated
when we add managed servers into IPAM.
So this is expected.
The last thing we want to confirm
is that there is an IPAM user group in our domain
and it has the IPAM server in that group.
So to do that,
we'll launch Active Directory Users and Computers,
and we'll navigate into Users
and we have an IPAM User Group
and we'll select Members
and make sure our IPAM server is in this group,
which it is, so we can go ahead and click OK.
And then close Active Directory Users and Computers.
Then let's go ahead and configure server discovery.
So we'll go ahead and select option 3
and we're going to select Get Forests.
Now the background process has been started
to fetch the forests.
So we'll go ahead and click OK
and then we're going to need to relaunch this wizard,
so we'll click Close
and then we'll click Configure Server Discovery again,
and we've got our single domain in this forest.
So we'll go ahead and select Add,
and then we can go ahead and select OK.
And then we can go ahead and Start Server Discovery.
And we're going to need to wait for about 5 minutes
for server discovery to complete.
So we'll pause the video here and we'll come back
when that's done.
All right, let's go ahead and see
which servers have been discovered
and then we can bring those servers
into management using IPAM.
So we'll go ahead and select step 5.
All right, we can see
that our domain controller has been discovered,
but I've been a little bit impatient
and our DHCP servers haven't been discovered yet
so let's go ahead and add those manually.
We'll go and select Tasks, and then we'll select Add Server.
And then we'll add our 2 DHCP servers.
And we'll select those servers to be Managed.
And we'll go ahead and click OK.
And we'll repeat the process for DHCP02.
And then we'll also set our domain controller to be managed.
We'll go ahead and click OK.
And now we need to update group policy on our servers.
So to do that we'll use PowerShell.
Go ahead and launch PowerShell.
And we'll use the Get-ADComputer PowerShell cmdlet
and we'll specify a filter that includes any servers
that have the name DHCP or DC for domain controller.
And then we'll select the name of those servers.
And then we'll invoke a remote GP update
using the Invoke-GPUpdate PowerShell cmdlet
and specify that it should occur immediately
by setting a random delay in minutes to zero.
All right, it'll take a moment for Group Policy to update
on these servers,
and then we'll be able to confirm IPAM access
to these servers.
So we'll take a bit of a break
and we'll come back in just a moment.
Now I'm not sure why,
but having deployed IPAM a few times now,
I found IPAM deployment using Group Policy
to always be a little bit flakey.
So if you end up with servers that have blocked access,
like DHCP02 here, there are some links I've provided
in the Resources section
that you can use to verify the settings
that should have been configured by Group Policy
and you can check if they're configured as expected.
You might need to update some group memberships
or registry settings if they are not applied successfully
by Group Policy.
Once you've verified all of the settings,
you can right-click the server
and select Refresh Server Access Status.
And then once that task is completed
you can go ahead and refresh Server Manager
and the IPAM access will be unblocked.
Now once all of your servers are added,
configured as managed, and unblocked,
you can navigate back to the Overview page
and select Retrieve Data.
All right, that'll take a moment to run in the background
so let's take a look at what IPAM has to offer.
IPAM organizes your IP addresses in a hierarchy
starting with IP address blocks.
Then you can carve out IP address ranges
to allocate IP addresses to your network devices.
And you can see our DHCP scopes imported here
from our servers.
And you can also group your IP address ranges
into range groups to group them logically,
for example, by region.
And data will be automatically imported
from the managed Windows servers
and you can also add data manually.
Now this entire IP address space section of IPAM
is designed to do away with your Excel spreadsheets
so you can manage your IP address space more effectively.
And you can also manage and monitor
your DNS and DHCP servers,
for example, configuring things like DHCP server
and DNS server options.
You can also manage your DHCP scopes
across all of your DHCP servers,
and you can manage your DNS zones
across all of your DNS servers and monitor their status.
And with access control you get access to the roles,
the access scopes, and you can combine those two
with access policies to grant access
to your DNS, DHCP servers,
and your IP address space using IPAM.
All right, that concludes this demo.
Let's wrap up with a bit of a summary
of what we've covered in this lesson.
All right, so what have we covered?
IPAM will discover your servers
and then you can use
the Invoke-IpamGpoProvisioning cmdlet
to create configuration GPOs
to automatically configure your discovered servers.
And when you configure a server as managed,
Security Filtering is used
to apply Group Policy settings to that server
and permissions are assigned to the IPAM server
using a group in Active Directory,
so make sure your IPAM server remains in that group.
All right, that concludes this lesson.
Thanks for being with me.
I hope you found this useful
and I look forward to seeing you on the next lesson.