Static [Public] IP vs. DHCP Assigned IP [Router IP Allocation] on Server 2012 R2 Setup
I am deploying a new server specifically for creating and managing VM's with Hyper-V. My testing environment includes a Dell T620 server with 3 each 1 Tb drives configured for Raid 5. My server has 2 Nics. I am installing Server 2012 R2 along with AD
& Hyper-V Roles. I have a block of public IP's from my provider. My first question is related to how I configure a Nic to use a public IP. One option is to use DHCP to have an internal IP assigned and then once the IP is assigned, I log into my router
and configure IP Address Allocation to assign the public IP network details to the DHCP assigned IP. I have used this method on a T610 testing server that uses the VMware ESXi Hypervisor with success. Option 2 is to actually input the public IP network details.
I also have to ask the same question as to which method is better when it comes to the Switch. If any of the experienced engineers want to throw in additional advice or tips, that would be appreciated. My initial deployment has gone well but I feel like I
can make it easier and more secure. Thanks in advance for the support.
Gregory Woodruff
St. Louis, Missouri
LuckyWoody.com
1. For servers static IP addresses are used.
2. It is a good habit to use one nic for communication and one for management.
3. DC should be single home server (otherwise you may have problems)
4. Use split brain configuration for DNS if you really need it. Otherwise private subnet is used.
5. Use firewall to prevent bad guys to enter your infrastructure.
6. Use DHCP server for client computers only.
7. DHCP on router is not used for AD clients, because these clients needs information on resouce records (to find DC).
HTH
Milos
Similar Messages
-
Routing and Remote Access Server 2012 r2 Help
Hi all, I just setup a new 2012 R2 server with DHCP, DNS and Routing and Remote Access. When a user logs in to the VPN the DHCP is assigning the wrong IP address. My DHCP Scope is 10.0.10.100 to 10.0.10.199 but it's setting it to 169.254.X.X.
How do I fix this.169.254.x.x are APIPA addresses which are allocated when the guest cannot see the DHCP server/allocator. Basically there is something wrong with your RRAS setup.
You should never run a remote access server on a DC. It will give you all sorts of name resolution problems. As soon as a client connects, the server acquires an additional IP for the VPN connection and the DC is multihomed. That has been a problem
since NT days and still is.
Bill -
Hello,
I run a small business network with five physical servers: three Dell servers running Windows Server 2008 R2, one custom build running 2008, and another custom build running 2012 with Domain Controller Role (same hardware for both custom builds).
The Dell servers are all running the Hyper-V role and each has a number of 2008 VMs. I also have a 2012 VM with the Domain Controller Role on one of the Hyper-V servers and another VM with a completely base install of 2012.
All servers are plugged into a Cisco SG300-52 switch which is uplinked to a Cisco 881 router which is connected to a cable TWC provided Ubee cable modem. I have no VLANs setup. I do have the Firewall on the router configured
to inspect most traffic.
Here is my problem: I cannot connect to most of the internet on ANY 2012 server (and all exhibit the exact same behavior), but I have NO problems connecting to the internet from 2008 servers. Here is what I already know:
1.) I can ping the outside world just fine so ICMP is passing to any external host.
2.) Two of the 2012 servers are DCs running DNS services and they can connect to the internet just fine for DNS requests because they are doing a perfectly good job of providing DNS services to my network.
3.) Here's where it gets really weird: I can browse in internet explorer to Bing.com and it works. I can also go to a couple other Microsoft websites (though they are very slow). If I click on any link in Bing, however, it doesn't
work and gives me a page not available error. If I connect to a non-MS website like Google or my company website, I get page not available.
4.) I have tried to telnet to port 80 at Bing and it works. I have tried to telnet to port 80 at google.com and it won't connect. The 2008 servers have no issue telneting to either bing or google on port 80 and none of my client
PCs on the network do either.
5.) Windows Update will not connect and neither will any other update service such as AVG (I have AVG Antivirus installed WITHOUT firewall on two of the three servers. The base 2012 VM has no software installed and no roles...I built it
just to see if it could connect after a fresh install and it still cannot.)
6.) The network connection does not indicate limited connectivity (probably because ICMP appears to be passing successfully)
7.) If I connect the server directly to the modem it has full internet access.
8.) All internal LAN connectivity is perfectly fine and runs at full speed.
9.) I have scoured the internet trying to find other examples of this particular kind of connectivity issue on 2012 and I have found two TechNet articles that are similar, but they both had the same resolution: changing the router
worked, but no one knows why. (I would have included the links, but apparently I cannot do that yet)
My question is this: What is different about Windows Server 2012 networking that would render it unable to communicate through a router that Windows Server 2008 has no problems with? I ask because, unlike in these two articles where they were
running personal networking equipment they could easily upgrade, I'm running a Cisco 881 with what should be virtually limitless configuration options and I have no desire to replace it. I have to assume the issue is somehow related to the firewall configuration,
which I could fix easily, but I don't know what to change. If anyone knows what changed in 2012 and why I would be able to browse to bing and other MS sites but no where else, please pass them along. Thanks.This is the IP Config for the 2012 DC:
Windows IP Configuration
Host Name . . . . . . . . . . . . : COMPANYDC02
Primary Dns Suffix . . . . . . . : company.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : company.local
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) 82574L Gigabit Network Connection
Physical Address. . . . . . . . . : 00-25-90-DC-EF-D5
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::81d5:53cf:bd07:14ed%12(Preferred)
IPv4 Address. . . . . . . . . . . : 10.10.10.202(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.10.10.1
DHCPv6 IAID . . . . . . . . . . . : 301999504
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1A-96-D5-C3-00-25-90-DC-EF-D5
DNS Servers . . . . . . . . . . . : 10.10.10.202
10.10.10.221
NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.{9929D989-8E88-4096-A1CB-61F1DB173FA3}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Teredo Tunneling Pseudo-Interface:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Teredo Tunneling Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
This is the IP Config for the fresh install 2012 VM:
Windows IP Configuration
Host Name . . . . . . . . . . . . : WIN-800299O7ES6
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : company.local
Ethernet adapter Ethernet:
Connection-specific DNS Suffix . : company.local
Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
Physical Address. . . . . . . . . : 00-15-5D-0A-5C-02
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 10.10.10.49(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Saturday, August 23, 2014 10:23:01 PM
Lease Expires . . . . . . . . . . : Wednesday, August 27, 2014 10:23:01 PM
Default Gateway . . . . . . . . . : 10.10.10.1
DHCP Server . . . . . . . . . . . : 10.10.10.1
DNS Servers . . . . . . . . . . . : 10.10.10.220
10.10.10.221
NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.company.local:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : company.local
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
NOTE: 10.10.10.220 and 10.10.10.221 are the other domain controllers on my network. One of them is 2012 and one of them is 2008. They are both functioning correctly for providing DNS services. The 2012 Virtual DC, however, still has
the internet connectivity issue that this whole post was about in the first place.
NOTE2: When I logged on to COMPANYDC02 this morning, it told me that I had new Windows Updates that needed to be downloaded. Confused, I checked the most recent time WU had checked for updates at it had successfully checked for updates last night
at 10pm. Of course, it failed when trying to download them, but it appears that once in a while, a connection gets through successfully... -
RV220W with BT Infinity and Static Public IP address
I've recently had BT Infinity installed with 5 static Public IP addresses.
Needless to say, the supplied BT Hub isn't really up to business standards - so it's been replaced with an RV220W router.
The router connects (via the supplied BT Openreach modem) via PPPoE and is allocated a dynamic IP Address.
Using one2one NAT I've tested that our static public ip addresses are reaching the router.
the RV220W router will be acting as a VPN endpoint as well as passing through certain services to servers.
I can configure the services to pass through using one2one NAT and individual static IP addresses, but the router doesn't use one of the static IP addresses for it's own - so I can't seem use a static IP address for the VPN endpoints.
Help please!Fixed ...
After a bit of fiddling around (reading out of date manuals! Cisco can't you at least update your manuals!)
The answer is in Firewall -> Access Rules
Add rule
Connection Type - Inbound WAN > LAN
Action - Always Allow
Service - Any
Source IP - Any
Send to Local Server (DNAT IP) -
Use Other WAN (Internet) Address - Enable
WAN (Internet) Destination IP -
It's also possible to fix the outbound IP address using rules:
Connection Type - Outbound Lan > WAN
Action - Always Allow (or you can schedule it)
Service - Any (or you can allow specific services)
Source IP - Any
Destination IP - Any
Use this SNAT IP Address - Enable
SNAT IP - -
Routing Functionality in MS SQL SERVER 2012
I am using postgreSQL for one of my project which use pgrouting functionality to access routing,
but i like to port the data base to MS SQL SERVER 2012,Data got ported successfully but still am facing a problem is Routing
is there any way to use ROUTING in MS SQL Server 2012?@Tracy Cai
i Gone through the book Pro Spacial and i found A* algorithm for routing which is given below but it producing so many errors,really am new to SQL Server, how i need to run the below code
[Microsoft.SqlServer.Server.SqlProcedure]
public static void GeographyAStar(SqlInt32 StartID, SqlInt32 GoalID)
* INITIALISATION
// The "Open List" contains the nodes that have yet to be assessed
List<AStarNode> OpenList = new List<AStarNode>();
// The "Closed List" contains the nodes that have already been assessed
// Implemented as a Dictionary<> to enable quick lookup of nodes
Dictionary<int, AStarNode> ClosedList = new Dictionary<int, AStarNode>();
using (SqlConnection conn = new SqlConnection("context connection=true;"))
conn.Open();
// Retrieve the location of the StartID
using (SqlCommand cmdGetStartNode = new SqlCommand("SELECT geog4326 FROM Nodes WHERE
NodeID = @id", conn))
SqlParameter param = new SqlParameter("@id", SqlDbType.Int);
param.Value = StartID;
cmdGetStartNode.Parameters.Add(param);
object startNode = cmdGetStartNode.ExecuteScalar();
if (startNode != null)
startGeom = (SqlGeography)(startNode);
else
throw new Exception("Couldn't find start node with ID " + StartID.ToString());
// Retrieve the location of the GoalID;
using (SqlCommand cmdGetEndNode = new SqlCommand("SELECT geog4326 FROM Nodes WHERE
NodeID = @id", conn))
SqlParameter endparam = new SqlParameter("@id", SqlDbType.Int);
endparam.Value = GoalID;
cmdGetEndNode.Parameters.Add(endparam);
object endNode = cmdGetEndNode.ExecuteScalar();
if (endNode != null)
endGeom = (SqlGeography)(endNode);
else
throw new Exception("Couldn't find end node with ID " + GoalID.ToString());
conn.Close();
// To start with, the only point we know about is the start node
AStarNode StartNode = new AStarNode(
(int)StartID, // ID of this node
-1, // Start node has no parent
0, // g - the distance travelled so far to get to this node
(double)startGeom.STDistance(endGeom) // h - estimated remaining distance to the goal
// Add the start node to the open list
OpenList.Add(StartNode);
* TRAVERSAL THROUGH THE NETWORK
// So long as there are open nodes to assess
while (OpenList.Count > 0)
// Sort the list of open nodes by ascending f score
OpenList.Sort(delegate(AStarNode p1, AStarNode p2)
{ return p1.f.CompareTo(p2.f); });
// Consider the open node with lowest f score
AStarNode NodeCurrent = OpenList[0];
* GOAL FOUND
if (NodeCurrent.NodeID == GoalID)
// Reconstruct the route to get here
List<SqlGeography> route = new List<SqlGeography>();
int parentID = NodeCurrent.ParentID;
// Keep looking back through nodes until we get to the start (parent -1)
while (parentID != -1)
conn.Open();
using (SqlCommand cmdSelectEdge = new SqlCommand("GetEdgeBetweenNodes", conn))
// Retrieve the edge from this node to its parent
cmdSelectEdge.CommandType = CommandType.StoredProcedure;
SqlParameter fromOSODRparam = new SqlParameter("@NodeID1", SqlDbType.Int);
SqlParameter toOSODRparam = new SqlParameter("@NodeID2", SqlDbType.Int);
fromOSODRparam.Value = NodeCurrent.ParentID;
toOSODRparam.Value = NodeCurrent.NodeID;
cmdSelectEdge.Parameters.Add(fromOSODRparam);
cmdSelectEdge.Parameters.Add(toOSODRparam);
object edge = cmdSelectEdge.ExecuteScalar();
SqlGeography edgeGeom;
if (edge != null)
edgeGeom = (SqlGeography)(edge);
route.Add(edgeGeom);
conn.Close();
NodeCurrent = ClosedList[parentID];
parentID = NodeCurrent.ParentID;
// Send the results back to the client
SqlMetaData ResultMetaData = new SqlMetaData(
"Route", SqlDbType.Udt, typeof(SqlGeography)
SqlDataRecord Record = new SqlDataRecord(ResultMetaData);
SqlContext.Pipe.SendResultsStart(Record);
// Loop through route segments in reverse order
for (int k = route.Count - 1; k >= 0; k--)
Record.SetValue(0, route[k]);
SqlContext.Pipe.SendResultsRow(Record);
SqlContext.Pipe.SendResultsEnd();
return;
} // End if (NodeCurrent.NodeID == GoalID)
* GOAL NOT YET FOUND - IDENTIFY ALL NODES ACCESSIBLE FROM CURRENT NODE
List<AStarNode> Successors = new List<AStarNode>();
conn.Open();
using (SqlCommand cmdSelectSuccessors = new SqlCommand("GetNodesAccessibleFromNode",
conn))
// Identify all nodes accessible from the current node
cmdSelectSuccessors.CommandType = CommandType.StoredProcedure;
SqlParameter CurrentNodeOSODRparam = new SqlParameter("@NodeID", SqlDbType.Int);
CurrentNodeOSODRparam.Value = NodeCurrent.NodeID;
cmdSelectSuccessors.Parameters.Add(CurrentNodeOSODRparam);
using (SqlDataReader dr = cmdSelectSuccessors.ExecuteReader())
while (dr.Read())
// Create a node for this potential successor
AStarNode SuccessorNode = new AStarNode(
dr.GetInt32(0), // NodeID
NodeCurrent.NodeID, // Successor node is a child of the current node
NodeCurrent.g + dr.GetDouble(1), // Distance from current node to successor
(double)(((SqlGeography)dr.GetValue(2)).STDistance(endGeom))
// Add the end of the list of successors
Successors.Add(SuccessorNode);
conn.Close();
* Examine list of possible nodes to go next
foreach (AStarNode NodeSuccessor in Successors)
// Keep track of whether we have already found this node
bool found = false;
// If this node is already on the closed list, don't examine further
if (ClosedList.ContainsKey(NodeSuccessor.NodeID))
found = true;
// If we didn't find the node on the closed list, look for it on the open list
if (!found)
for (int j = 0; j < OpenList.Count; j++)
if (OpenList[j].NodeID == NodeSuccessor.NodeID)
found = true;
// If this is a cheaper way to get there
if (OpenList[j].h > NodeSuccessor.h)
// Update the route on the open list
OpenList[j] = NodeSuccessor;
break;
// If not on either list, add to the open list
if (!found)
OpenList.Add(NodeSuccessor);
// Once all successors have been examined, weve finished with the current node
// so move it to the closed list
OpenList.Remove(NodeCurrent);
ClosedList.Add(NodeCurrent.NodeID, NodeCurrent);
} // end while (OpenList.Count > 0)
SqlContext.Pipe.Send("No route could be found!");
return; -
DHCP Failover in Windows 2008 R2 and Windows 2012 R2 Environment
Hi Everyone,
We are trying to implement DHCP failover in our environment. Our IT Infrastructure consists of 4 – windows server 2008 R2 servers and 7 – Windows Server 2012 servers; 1 Main Office with 2 – DC’s and 9 branch/remote offices with one DNS server in every remote
office. All the DNS servers have 2 scopes defined on them for VOICE and Data with different Subnets.
What would be the best method to implement failover in 2008 R2 – Windows Failover Cluster or Split scope? And how to implement DHCP Failover in Windows Server 2012 R2?
Please let me know if you need more information.
Thank you for your help!
-kNHi,
if you can choose between 2008 R2 and 2012 R2 than go with 2012 R2 it is easy to create a DHCP failover there. Actually that is one of the new features of Windows 2012.
With Server 2012 you setup your fist DHCP server with the scopes you want to setup. Than you install the second 2012 server with DHCP role and authorized. If you have done this you going back to your first server, where you already configured your scopes.
Now right click onto the scope you want to setup for failover and select 'Configure Failover'. You can than set it up as kind of split scope (Load balance Mode) or as real fail over setup (Hot Standby). In Load balance Mode you can configure the balance of
IP addresses between the both servers, like primary has 60% IP addresses and secondary has 40%.
With Server 2008 R2 the easiest configuration is split scope. But here it depends how many IP leases you will max have and if you can absorb if one of the server is going down. Lets say you have 50 DHCP leases max, than sure, set it up as split scope. But
if you have 200 DHCP clients, than I would go with failover cluster. At the end it depends on your environment.
Sven -
Suse 9 oracle 10g installation DHCP-assigned public IP addresses problem
Hi,
I got below error when I have tried to install Oracle 10gR2.
I have checked # hostname, it is Ok. I setup network to use static Ip.
I checked /etc/hosts. Does oracle get hostname another file?
How can I solve my problem.
Thanks.
Recommendation: Oracle supports installations on systems with
DHCP-assigned public IP addresses. However, the primary network
interface on the system should be configured with a static IP
address in order for the Oracle Software to function properly.
See the Installation Guide for more details on installing the
software on systems configured with DHCP.Hostname command should return the fully qualified hostname as shown below:
% hostname
hostname.domainname -
Static ip works dhcp Assigned IP not work
environment:
1. D-link 7100 router provide internet service. DHCP enabled from 192.168.0.140 to 192.168.0.240
2. A DC setup to provide DNS and DHCP, server IP192.168.0.10. DHCP enabled from 192.168.0.20 to 192.168.0.100
3. a normal switch connect the router and DC.
3. Client by default will get IP from DHCP (DC server) .
problem:
some computer got the IP from DHCP server but can't ping through the router, but if you change to manual Ip address it will work, or after restart the router also works.
so any ideas? thanks a lot.
MisnotmI agree it's the DNS address is part of the issue.
Another thing is if the clients are Windows 7 or newer, then you have the NLA to deal with, and even if it may have a correct ipconfig, it may configure the network as unknown.
I've seen this with two separate IT companies that have called me with issues regarding this. If you use the server's DHCP and disable DHCP on the router, as suggested previously in this thread, the issue will disappear.
Here's more on the NLA and how it work.
Network Location Awareness (NLA) and how it relates to Windows Firewall Profiles
http://blogs.technet.com/b/networking/archive/2010/09/08/network-location-awareness-nla-and-how-it-relates-to-windows-firewall-profiles.aspx
Ace Fekay
MVP, MCT, MCSE 2012, MCITP EA & MCTS Windows 2008/R2, Exchange 2013, 2010 EA & 2007, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Complete List of Technical Blogs: http://www.delawarecountycomputerconsulting.com/technicalblogs.php
This posting is provided AS-IS with no warranties or guarantees and confers no rights. -
I have time capsule and I am unable to connect to the internet using static public IP
I have been using my Time Capsule on my company network for some time.
Recently I removed the time capsule and connected the TC Wan port directly to the firewall. We have got block of static IPs provided to us from our ISP.
Im confused in filling up the internet tap on the Airport Utility (Lion Version)
If Im using a static public IP to connect to the internet should I use
Static, DHCP or PPoe?
IP Address: is this the IP address of the public IP address given to Us from ISP?
Subnetmask. ..no problem
Router Address: what should I type here: IP address of my firewall or my ISP's GateWay IP?
DNS servrs are clear...
Please guide me.Normally you would just set this up with dhcp to the firewall.. if the firewall is setup correctly it will simply pass you one of the block of static IP addresses.. if it doesn't or get a NAT address you should be able to allocate a static IP to the TC in the firewall to its MAC address.
I am not sure that the static IP will work if you just type it in.
If you want to have a go..
If Im using a static public IP to connect to the internet should I use
Static, DHCP or PPoe?
Try static only if dhcp doesn't work because the firewall is not setup.
IP Address: is this the IP address of the public IP address given to Us from ISP?
Yes, a free IP from the block.
Router Address: what should I type here: IP address of my firewall or my ISP's GateWay IP?
Either should work if the firewall is setup correctly.. otherwise just try ISP gateway. -
My old D-Link router had a table where I could tell the DHCP server to assign specific IPs based on the MAC address of the device. I can't find a place in the WRT54G to do this. Do I have to go to each device and assign a fixed IP at the device? I like to keep the DHCP server active for setting up new devices and visitors. By using DHCP in my devices I don't have to reconfigure when I travel. With the old D-Link this worked find. It appears this could be a problem with the WRT54G. Am I missing something? Thanks, Bob
You are correct. The WRT54G does not support the "DHCP reservation" feature. However, several of the newer Linksys wireless n routers support this feature.
With the WRT54G, you can manually assign your computers a fixed LAN IP address. You can also have a fixed address on some computers, while others take their address from the WRT54G's DHCP server. Generally, unless you have a specific need for a fixed LAN IP address (for example, some online games require this for port forwarding to work properly), you should use a DHCP assigned address.
Linksys has some specific rules about assigning fixed LAN IP addresses. They are different from the D-Link.
Rules for using fixed LAN IP addresses on Linksys routers:
With Linksys routers, a fixed (static) LAN IP addresses must be assigned in the device that is using the address. So you need to enter the fixed address in the computer or printer, not in the router.
When using a Linksys router, any fixed LAN IP address must be outside the DHCP server range (typically 192.168.1.100 thru 192.168.1.149), and it cannot end in 0, 1, or 255.
Therefore any fixed LAN IP address would normally need to be in the range of
192.168.1.2 thru 192.168.1.99 or
192.168.1.150 thru 192.168.1.254
assuming you are still using the default DHCP server range.
Also, in the computer, when you set up a static LAN IP address, you would need to set the "Subnet mask" to 255.255.255.0 and the "Default Gateway" to 192.168.1.1 and "DNS server" to 192.168.1.1
It is also important that no two devices on your network be set to the same static LAN IP address. -
802.1x and DHCP assigned addresses
I've done a lot of reading on this but I am still confused. I'm not a Microsoft guru so I don't really know waht is going on with login scripts, or cached user/pass.
Scenario 1
==========
I have 802.1x implemented and Joe the contractor comes into the office and plugs in his laptop. He is a guest. I allow guests to have access to a guest VLAN. How can Joe automatically get an IP address, or does he have to do ipconfig /renew?
Scenario 2
==========
What is the behind the scenes process that takes place for my corporate users that login to a domain....how do they get DHCP assigned addresses?
ThanksI assume from what you have written 'Joe' doesn't have an 802.1x supplicant on his PC? Therefore the switchport eapol frames are ignored by the PC and after a timeout the port is placed in the guest vlan. You need to make sure DHCP is enabled for the guest vlan - either add the appropriate entried to the protecting ACL or add a scope on the router? Depending on the timeouts you may have some delay issues here; I would test this before you roll it out.
For clients with 802.1x supplicants what happens is the PC effectively thinks it is disconnected from the network until the supplicant has authenticated. Once it has authenticated the PC thinks the network adapter is then connected and it will attempt to lease an IP address by broadcasting a DHCP request.
There are however a few 802.1x supplicants and I am not sure how they all integrate with the host O/S. I know the built-in Microsoft one operates as I have described.
HTH
Andy -
I have a problem that is driving me batty.
I have a Mac Mini Server acting as a gateway to the Internet. The cable modem is connected to the built in Ethernet, and the local net is configured with a USB Ethernet. I am running DHCP on the local network, and all of the clients get IP's from the server with no problem. Sometimes an random IP appears to get blocked from accessing the network (can get the file servers on the local net, and cannot reach the Internet.) We can manually assign a different IP, and it might start working, but it might not. We just keep picking until we find one that works. Rebooting the server will fix the problem as well.
I see no indication of a problem in any of the logs on the server.
This setup has worked with no problem in the past, but I must have done something to the configuration as some point.
Any help will be appreciated!
Mark.The proper way to set up your system is to set up the server's DNS as your primary DNS, entering into it all of your local devices and support, and use your ISP's DNS as forwarding DNS's. For help in doing this follow Mr. Hoffman's instructions.
Use your ISP's modem in bridge mode to provide you with a static IP. Use the server's DHCP system to provide all internal addresses, otherwise you won't have dynamically updated DNS information at the server level.
User your airport extreme as an AP. Set it up to use an internal static address as it's WAN address and shut down it's DHCP server allowing anything connected to it to receive it's IP address from the server. If you can't do that, then set up the Airport to provide DHCP with a reduced subset of addresses for only wireless devices. Let the server's DHCP provide all wire-based equipment addresses.
Turn off the wireless on the mac mini server and run wired from your ISP's modem. Before you do, however, you need to enter a static address into the TCP/IP section, including mask and gateway. This will avoid VPN and other service issues caused by having it turned on and receiving a DHCP address (at server can not, by nature, be a DHCP device).
To do remote desktop from the internet, you would connect through the WAN address provided to the server by your ISP, but you will need to open the firewall ports on the server. If you have the money, and want to most protection, you should invest in a firewall box like a SonicWall and insert this between your modem and the rest of your system. The SonicWall will provide faster, tighter attack protection and allows you to tie external service access down as tight as you want.
Hope this helps. -
Static ip still getting dhcp'd [SOLVED]
I've got a media server running arch, and the networking/daemons section of rc.conf is below. My router doesn't support dhcp reservations. I still need to use dhcp because I'm not the only person on this network.
The address I've chosen is outside the router's dhcp address pool (2-100). My router still assigns an ip via dhcp, such as 192.168.2.2. It's been like this for weeks, and I've spent hours searching for a solution. It is quite possible that my router is just a piece of crap, but I don't know the nitty gritty of how this stuff works.
The netmask was found in some file on the server while it was already connected via dhcp, and the broadcast address was found using an online calculator for it. Btw, how much of this do I need to fill in myself and how much is automatic?
# NETWORKING
HOSTNAME="mcserver"
interface=eth0
address=192.168.2.101
netmask=255.255.248.0
broadcast=192.168.7.255
gateway=192.168.2.1
NETWORK_PERSIST="yes"
# DAEMONS
DAEMONS=(syslog-ng network @crond dbus @cpufreq @alsa @samba @sshd)
EDIT: Okay, seconds after posting this, I recall I found the netmask on the router's homepage, and realized that that was the settings for the actual internet. Looked at lan settings and it's 255.255.255.0. rc.conf has been ammended. Recalculating broadcast to 192.168.2.255. Restarting networking. And I think it worked. Rebooting everything.
Okay, yes, everything works now. *huge sigh of relief* Amazing how such a little detail can cause so much frustration.
Oddly, the router still assigns an ip via dhcp, but both the .101 and .2 work for ssh, etc.
The router is a Belkin N150 with up-to-date firmware. Lack of dhcp reservation made this a lot harder than it had to be, but this still wasn't the router's fault as I was thinking.
I'm going to mark this as solved, but seeing as I solved it myself almost immediately, admins may wish to delete. I don't mind.
Last edited by stevepoppers (2012-05-26 23:37:02)Good to hear you managed to solve it.
As a small sidenote, it's quite strange that you would still get a dhcp address as well. The way dhcp works, your router shouldn't be assigning a lease unless your client specifically requests one, which leads me to believe you still have something configured somewhere which is doing a dhcp request.
Double check that you don't have any scripts, netcfg profiles,... running which could be responsible for this. -
SRP547W multi Static Public ip
Peace be upon you and Allah's mercy
Hi ,,
my Networks contain three devices (BPX, DVR, PC) need to fixed IP, do you router supports the Cisco SRP547W Static Public ip.Hi,
I'm not sure that I follow your question completely, but the SRP547 should support the scenario you describe.
Use NAT port forwarding or Software DMZ features to allow remote devices access to your internal hosts.
It is not possible to configure multiple public IP address on the WAN interface, but these may be mapped using Software DMZ.
Hope that helps,
Andy -
Report on Characteristics assigned to Routing Counter
Hi Guys,
Does anybody have information on reporting against Characteristics assigned to Routing Counter
I don't think it is possible in SQ01.
I need to provide programmer with logic to build custom report
I am not sure how to link Routing tables to Characteristic tableshi
i am not able to trace which characteristics are changed....
may i know where the characteristics are stored for class 001
Maybe you are looking for
-
Family Share Organizer, no Request to Purchase notification
Hey guys, I have recently enabled the family sharing for my family, which includes my two daughters, and claimed myself as the organizer. Now that the Request to Purchase feature is enabled for my daughters, my wife will receive the notification on
-
Morning when posting one vendor, it credits one G/L and debits the other. how do i clear them? Regards
-
I have looked everywhere for this but cannot locate "From the Store menu, choose Authorize This Computer. (In earlier versions of iTunes, access this option from the Advanced Menu" Please help!! I have been on every iTunes store menu and cannot
-
Only one CPU core high sys usage when create database instance via dbca
when using dbca to create database instance JUST ONLY ONE CPU core high sys usage how to troubleshoot it see this: top - 09:28:19 up 55 days, 20:38, 10 users, load average: 1.00, 1.08, 1.31 Tasks: 1231 total, 2 running, 1228 sleeping, 0 stopped,
-
What is the best way to manage duplicate files?
What is the best way to find and manage all my duplicate files? I have a Mac Mini late 2010, Mac OSX 10.6.8.