Lesson 1: New DHCP Functionality

DHCP centralizes and simplifies Internet Protocol (IP) address management on Transmission Control Protocol/Internet Protocol (TCP/IP)-based networks. Windows 2000 includes an enhanced implementation of DHCP that provides additional tools that are designed to reduce the complexity of configuring and administering TCP/IP network clients. Enhancements to DHCP in Windows 2000 include the following:

• Unauthorized DHCP server detection. On a Windows 2000 Server network using the directory services based on Active Directory technology, unauthorized DHCP servers are prevented from creating address assignment conflicts. A DHCP server object stored in Active Directory directory services contains the IP addresses of authorized DHCP servers on the network. When a DHCP server attempts to start up, Active Directory directory services are queried and the server's IP address is compared to the list of authorized DHCP server IP addresses. If no match is found, the DHCP service is automatically shut down.
• Integration of DHCP with DNS. When DHCP assigns an IP address to a client, the service can also register the IP address with DNS name servers that support the DNS dynamic update protocol. This can help to reduce the administrative effort required to manage DNS name servers.
• Expanded scope support. DHCP adds support for superscopes and multicast scopes, which you can use to streamline your ongoing administration of IP configurations.
• Support for option classes. DHCP supports the option classes, which you use to separate and distribute appropriate options for clients with similar or special configuration needs.
• Automatic assignment of IP addresses. DHCP clients running Windows 2000 can automatically assign a temporary IP configuration if a DHCP server is unavailable to provide one. Addresses are self-assigned from a network address range that is reserved for private TCP/IP usage and is not used on the Internet.
• Enhanced monitoring and statistical reporting. New System Monitoring counters added to Windows 2000 Server monitor DHCP server performance. The DHCP console included in Windows 2000 also provides a graphical display of statistical data to help you monitor system status, such as the number of available addresses versus the number of depleted addresses or the number of leases being processed per second.

In previous versions of Windows NT, the implementations of DHCP allowed any user to create DHCP servers on the network. These unauthorized DHCP servers often caused conflicts in IP address assignments. In Windows 2000, before a DHCP server can issue leases to DHCP clients, it must be authorized in the Active Directory directory services. Only members of the Enterprise Admins group, which exists in the root domain of the forest, can authorize a DHCP server in Active Directory directory services. Since unauthorized DHCP servers cannot issue leases to DHCP clients, the new implementation of DHCP that ships with Windows 2000 reduces IP address conflicts and the amount of time you spend on DHCP administration.

When a DHCP server that is a member of a domain starts, it contacts a domain controller to determine if it is authorized to operate on the network. If the DHCP server is authorized, the service starts properly. If the DHCP server is not authorized, the service logs an error in the system log.

When a DHCP server that is a member of a workgroup starts, it sends a broadcast message. If the DHCP server receives a response from a DHCP server in a domain, it assumes that it is unauthorized on the network. If the DHCP server receives a response only from workgroup DHCP servers, it determines that it can operate normally. As a result, a network can include multiple operational DHCP servers if all of them are in a workgroup.

To authorize a DHCP server, you would do the following:

1. Log on to the domain with an account that is a member of the Enterprise Admins group.
2. On the Start menu, point to Programs, point to Administrative Tools, and then click DHCP.
3. In the console tree, right-click DHCP, and then click Manage Authorized Servers.
4. In the Manage Authorized Servers dialog box, click the name of the DHCP server that you wish to authorize and click Authorize.
5. In the Authorize DHCP Server dialog box, enter the name or IP address of the DHCP server to authorize, and then click OK.
6. In the DHCP dialog box, click Yes to confirm the authorization.

In Windows 2000, you can configure the DHCP servers and the DNS servers to allow dynamic update of the DNS name servers. This is commonly referred to as Dynamic DNS (DDNS). With DDNS enabled, when DHCP assigns an IP address to a client, the service can also register the IP address with DNS name servers that support the DNS dynamic update protocol. In addition, when the IP address of the client changes, DHCP can automatically update the DNS name server.

You must configure the DHCP server to perform dynamic updates. Otherwise, the ability to perform DNS dynamic updates is disabled. You configure DHCP to enable dynamic update of DNS name servers on the DNS tab of the Properties dialog box for a DHCP server (see Figure 10.1). On the DNS tab, select Automatically Update DHCP Client Information In DNS.

When you configure DHCP to enable dynamic update of DNS name servers, you also must specify one of the following options:

• Update DNS Only If DHCP Client Requests. Specifies to update forward and reverse DNS lookup zones based on the type of request that the client makes during the lease process. This is selected by default. If this option is selected, the DHCP client updates the A (host address) resource record and the DHCP server updates the PTR (Pointer) resource record.
• Always Update DNS. Specifies to update forward and reverse DNS lookup zones when a client acquires a lease, regardless of the type of lease request. If this option is selected, the DHCP server updates the A and PTR resource records regardless of the DHCP client's request.

Figure 10.1 Configuring DHCP to automatically update client information in DNS name servers

There are two additional options you may also configure:

• Discard Forward (Name-To-Address) Lookups When Lease Expires. Specifies whether or not the DHCP server discards forward DNS lookups for clients when the lease expires.
• Enable Updates For DNS Clients That Do Not Support Dynamic Update. Specifies whether the DHCP server sends dynamic updates to the DNS server for any DHCP clients that do not directly support dynamic updates. If this option is selected, clients running earlier versions of Windows are updated by the DHCP server for both their host (A) and pointer (PTR) resource records.

To configure a zone for dynamic updates, open the Properties dialog box for the zone in the DNS tool. On the General tab there are three possible selections for the Allow Dynamic Updates option. Note that the Only Secure Updates option is available only after changing the zone's type to Active Directory-Integrated, as shown in Figure 10.2.

• No. Disables dynamic updates for the zone.
• Yes. Allows all DNS dynamic updates requested for the zone.
• Only Secure Updates. Allows only DNS dynamic updates that use secure DNS for the Active Directory–integrated zone.

Figure 10.2 Configuring a zone for dynamic updates

By default, communication between DHCP and DNS is not encrypted. However if the zone type is Active Directory Integrated Primary, the Only Secure Updates option appears in the Allow Dynamic Update list. Select this option to enable secure dynamic updates. With secure dynamic updates, the authoritative name server accepts updates only from clients and servers that are authorized to send dynamic updates. Secure dynamic update provides the following benefits:

• It protects zones and resource records from being modified by users without authorization.
• It enables you to specify exactly which users and groups can modify zones and resource records.

Windows 2000 extends DHCP functionality to include support for superscopes and multicast scopes. You use these new features to assign IP addresses to a physical network that contains more than one logical subnet. In addition to extended scope support, Windows 2000 includes a set of wizards that make the task of configuring DHCP scopes, superscopes, and multicast scopes easier.

In Windows 2000, you use the Create Scope wizard to configure a new scope. To start the Create Scope wizard, on the Start menu, point to Programs, point to Administrative Tools, and click DHCP. In the console tree, click the name of the DHCP server for which you want to create a scope. Right-click the name of the DHCP server, and then click New Scope.

When you configure a new scope, you specify the information listed in Table 10.1.

Table 10.1 Parameters for Creating a New Scope

You can also configure some common DHCP options including the following:

• IP addresses of any gateways
• Domain name and the IP address of any DNS servers
• IP addresses of any WINS servers

When you create a new scope, it must be activated before it can start lease distribution. You can choose to activate the new scope during completion of the New Scope wizard, or you can activate it later. To activate a scope later, right-click the scope name, and then click Activate.

In a Microsoft Windows NT 4.0 network, IP addresses for DHCP clients are limited to a single logical subnet per physical network. The Windows 2000 implementation of DHCP supports superscopes, which provide IP addresses from multiple logical subnets to DHCP clients on a single physical network. In Figure 10.3, SuperscopeA contains Scope1, which contains IP addresses from one logical subnet, and Scope2, which contains IP addresses from a second logical subnet.

Figure 10.3 Superscope

You use superscopes in a variety of situations, including the following:

• You need to add more hosts on a subnet than originally planned.
• You replace existing address ranges with new address ranges.
• The network uses two DHCP servers to manage separate logical subnets on the same physical subnet.

You use the New Superscope wizard to configure a new superscope. To start the New Superscope wizard, on the Start menu, point to Programs, point to Administrative Tools, and click DHCP. In the console tree, click the name of the DHCP server for which you want to create a superscope. Right-click the name of the DHCP server, and then click New Superscope. In the New Superscope wizard, enter the superscope name, and then specify the scopes to include.

Multicast scopes are supported through the use of Multicast Address Dynamic Client Allocation Protocol (MADCAP). MADCAP is a new proposed standard protocol for performing multicast address allocation. In earlier versions of Windows, DHCP scopes provided client configuration by allocating ranges of IP addresses from the Class A, B, and C address classes. DHCP in Windows 2000 provides the same ranges of IP addresses, but it also supports MADCAP in the form of multicast scopes. Multicast scopes allow DHCP-enabled clients to lease Class D addresses (224.0.0.0 to 239.255.255.255).

Most IP addresses are unique and specific to a single network computer. Multicast addresses are shared by many network computers. When the destination address of an IP datagram is a multicast address, the datagram is forwarded to all members of a multicast group. Multicast address assignment allows selected computers on a network to participate in collaborative application sessions. Typically, conferencing and audio applications use multicasting technology for deploying information to several computers at one time without generating network traffic. Without a multicast scope, users must manually configure multicast addresses. Membership in a multicast group is dynamic, so hosts can leave or join the group at any time. Group membership can be any size and hosts can be members of multiple multicast groups.

You use the New Multicast Scope wizard to configure a new multicast scope. To start the New Multicast Scope wizard, start DHCP, and in the console tree, click the name of the DHCP server for which you want to create a multicast scope. Right-click the name of the DHCP server, and then click New Multicast Scope. In the New Multicast Scope wizard, enter the multicast scope's name and the IP address range. Specify any excluded IP addresses and the lease duration. When prompted, activate the multicast scope.

In a Windows NT 4.0 network, a DHCP server provides the same configuration information to all DHCP clients that receive an IP address. The Windows 2000 implementation of DHCP supports option classes, which you can use to provide unique configurations to client computers. For example, you might configure an option class to provide a group of computers with Internet access. Therefore, you must configure both the DHCP server and DHCP clients to allow option class support.

Windows 2000 supports two types of option classes:

• Vendor-defined classes. Configure vendor-defined classes to manage DHCP options that are assigned to clients that are identified by vendor type. For example, you can configure a vendor-defined class to provide a configuration for a specific brand of computer. The vendor-class identifier information is a string of character data interpreted by the DHCP servers. Vendors can choose to define specific vendor class identifiers to convey particular configuration or other identification information about a client. For example, the identifier can encode the client's hardware or software configuration. Most vendor types are derived from the standard reserved-hardware and OS-type abbreviation codes listed in RFC 1700.
• User-defined classes. Configure user-defined classes to manage DHCP options that are assigned to clients that require a common configuration that is not based on vendor type; for example, you might want to assign shorter leases to a dial-up client or a laptop portable computer. As of the writing of this training kit, user class options for DHCP is a proposed Internet standard. For more information on DHCP user options, see the Internet Engineering Task Force (IETF) Web site (http://www.ietf.org).

After you define option classes on a DHCP server, you must configure individual scopes with any class-related options that you want to provide to clients.

Windows 2000 supports a new mechanism for automatic IP address assignment for simple local area network (LAN)-based network configurations. This addressing mechanism, called Automatic Private IP Addressing (APIPA), is an extension of dynamic IP address assignment for LAN adapters, enabling the configuration of IP addresses without using static IP address assignment or installing the DHCP Service.

For the APIPA feature to function properly on a computer running Windows 2000, you must configure a network LAN adapter for TCP/IP and click Obtain An IP Address Automatically in the Internet Protocol (TCP/IP) Properties dialog box.

When Windows 2000 starts, TCP/IP attempts to find a DHCP server on the attached network to obtain a dynamically assigned IP address. If there is no DHCP server available, the client cannot obtain an IP address. However, if the Obtain An IP Address Automatically option has been selected, APIPA generates an IP address in the form of 169.254.x.y (where x.y is a unique identifier on the network that the client generates) and a subnet mask of 255.255.0.0.

After generating the address, the client computer broadcasts it, and then, if no other computer responds, assigns the address to itself. The computer continues to use this address until it detects and receives configuration information from a DHCP server. This allows the computer to be connected to a LAN hub, to restart without any IP address configuration, and to be able to use TCP/IP for local network access.

APIPA can assign an IP address to DHCP clients automatically. However, APIPA does not generate all of the information that DHCP typically provides, such as the address of a default gateway. Consequently, computers that are enabled with APIPA can communicate only with computers on the same subnet that have also been assigned addresses through APIPA.

By default, the APIPA feature is enabled. However, you can disable this feature. To disable APIPA, add the IPAutoconfigurationEnabled entry to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ Parameters\Interfaces\GUID_of_the_adapter subkey in the registry.

The IPAutoconfigurationEnabled entry takes a REG_DWORD data type. To disable APIPA, specify a value of 0 for the entry.

In this practice, you will install and configure the DHCP Service and then add the DHCP server to the list of authorized servers for the domain.

In this exercise, you will install the DHCP Service on your computer.

1. Log on to your domain as Administrator.
2. Click Start, point to Programs, and then point to Administrative Tools.

Are there any entries for DHCP?

3. Open Control Panel.
4. Double-click Add/Remove Programs.

The Add/Remove Programs window appears.

5. Click Add/Remove Windows Components.

The Windows Components wizard appears.

6. Click Networking Services, but do not remove the check mark in the box to the left of the component.

7. Click Details.

The Networking Services dialog box appears.

8. Under Subcomponents Of Networking Services, click to place a check mark in the box to the left of Dynamic Host Configuration Protocol (DHCP).
9. Click OK.

You are returned to the Windows Components page.

10. Click Next.

Windows 2000 Server begins installing the required components.

11. If the Insert Disk dialog box appears, insert the Windows 2000 CD-ROM, if necessary, and then click OK. Otherwise, go to step 15.

The Windows 2000 CD-ROM window appears.

12. Close the Windows 2000 CD-ROM window.

Windows 2000 Server Setup copies the required files.

13. Remove the CD-ROM.
14. Click Finish to close the Windows Components wizard.
15. Close the Add/Remove Programs window.
16. Close Control Panel.
17. Click Start, point to Programs, and then point to Administrative Tools.

Are there any entries for DHCP?

Answer

In this exercise, you authorize a DHCP server.

1. Click Start, point to Programs, and then point to Administrative Tools. Click DHCP.

The DHCP window appears.

2. In the console pane, click Server1.domain.com.

A message appears in the details pane describing how to authorize the DHCP server.

3. On the Action menu, click Authorize.

Authorization begins and can take several minutes to complete. When authorization is complete, a green upward-pointing arrow appears on the server's icon in the console pane.

4. If the hard disk light stops flashing, or if an extended amount of time has elapsed, and the arrow is still red, press F5 to refresh.

A green upward-pointing arrow should appear on the server's icon in the console pane.

In this exercise, you create and configure a DHCP scope.

1. Right-click Server1.domain.com (or the name of your computer), and then click New Scope.

The New Scope wizard appears.

2. Click Next.

The Scope Name page appears.

3. Type Scope1 in the Name box, and then click Next.

The IP Address Range page appears.

4. Type 192.168.1.70 in the Start IP Address box, and type 192.168.1.140 in the End IP Address box.

5. Ensure that the Mask is 255.255.255.0.
6. Click Next.

The Add Exclusions page appears.

7. Type 192.168.1.76 in the Start IP Address box.
8. Type 192.168.1.90 in the End IP Address box.
9. Click Add.

Notice that 192.168.1.76 to 192.168.1.90 appears in the Excluded Address Range box.

10. Click Next.

The Lease Duration page appears.

11. Click Next to accept the default lease duration of 8 days.

The Configure DHCP Options page appears.

12. Click No, I Will Configure These Options Later, and then click Next.

The Completing The New Scope Wizard page appears.

13. Click Finish.

An icon representing the new scope appears in the DHCP snap-in.

14. Double-click Scope1, right-click Scope1, and then click Activate.

The red arrow pointing downward disappears indicating that the scope is activated.

1. Right-click Server1.domain.com (or the name of your computer), and then click New Superscope.
2. In the New Superscope wizard, click Next.
3. On the Superscope Name page, type superscope in the Name box, and then click Next.

The Select Scopes page appears.

4. On the Select Scopes page, click Scope1.
5. Click Next, and then click Finish.

The superscope appears in the console tree.

1. Right-click Server1.domain.com (or the name of your computer), and then click New Multicast Scope.
2. In the New Multicast Scope wizard, click Next.
3. On the Multicast Scope Name page, type multicast in the Name box, and then click Next.

The IP Address Range page appears.

4. On the IP Address Range page, type 224.1.1.1 in the Start IP Address box, type 224.1.1.254 in the End IP Address box, and then click Next.
5. On the Add Exclusions page, click Next.
6. On the Lease Duration page, click Next to accept the default setting of 30 days.
7. On the Activate Multicast Scope page, ensure the Yes option is selected, and then click Next.
8. Click Finish.

The multicast scope appears in the console tree.

9. Close the DHCP window.

Windows 2000 includes an enhanced implementation of DHCP that simplifies IP address management. In earlier versions of Windows NT, a user could easily create an unauthorized DHCP server on the network. In Windows 2000, DHCP prevents unauthorized DHCP servers from assigning IP addresses—thus reducing this major source of address assignment conflicts. Another enhancement to the Windows 2000 implementation of DHCP is that the DHCP service can now be configured so that when it assigns an IP address to a client, it can also register the IP address with DNS name servers that support the DNS dynamic update protocol. This can help to reduce the administrative effort required to manage DNS name servers.

DHCP in Windows 2000 also has expanded scope support, adding support for superscopes and multicast scopes. A superscope allows you to group scopes so they can provide IP addresses from multiple logical subnets to DHCP clients on a single physical network. Multicast scopes simplify support for Multicast DHCP. Multicast addresses are shared by many network computers. When the destination address of an IP datagram is a multicast address, the datagram is forwarded to all members of a multicast group. Multicast address assignment allows selected computers on a network to participate in collaborative application sessions. Without a multicast scope, users must manually configure multicast addresses.

Other enhancements to the Windows 2000 implementation of DHCP include support for the option classes, which you use to separate and distribute appropriate options for clients with similar or special configuration needs; automatic assignment of IP addresses; and enhanced monitoring and statistical reporting. DHCP clients running Windows 2000 can automatically assign a temporary IP configuration if a DHCP server is unavailable to provide one. Addresses are self-assigned from a network address range that is reserved for private TCP/IP usage and is not used on the Internet. The enhanced monitoring and statistical reporting are found in the DHCP console. The DHCP console provides a graphical display of statistical data to help you monitor system status, such as the number of available addresses versus the number of depleted addresses or the number of leases being processed per second.

Windows 2000 supports a new mechanism for automatic IP address assignment for simple LAN-based network configurations called Automatic Private IP Addressing (APIPA). For APIPA to function properly on a computer running Windows 2000, you must configure a network LAN adapter for TCP/IP and click the Obtain An IP Address Automatically check box in the Internet Protocol (TCP/IP) Properties dialog box. By default, APIPA is enabled; you can disable it by adding the IPAutoconfigurationEnabled entry to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ GUID_of_the_adapter subkey in the registry.

APIPA can assign an IP address to DHCP clients automatically, but it does not generate all of the information that DHCP typically provides, such as the address of a default gateway. Consequently, computers that are enabled with APIPA can communicate only with computers on the same subnet that have also been assigned addresses through APIPA.