CHP 5 - Routing and Remote Access and Wireless Ntwking

Switch

Switch

examines the destination  and source address of incoming data frame and fwds to appropriate dest port according to dest address. Operate on layer 2, data link layer

CHP 5 - Routing and Remote Access and Wireless Ntwking

HUB

HUB

also called mulitport repeater

operates at Open Systems Interconnection (OSI) reference model layer 1 (Physical layer)

organizes data into bits

receives signal and recreates for transmission on ports

CHP 5 - Routing and Remote Access and Wireless Ntwking

3 routing protocols that can be added to the Routing and Remote Access service

- RIP v2

- IGMP Router and proxy (for multicast fwding)

- DHCP Relay Agent

CHP 5 - Routing and Remote Access and Wireless Ntwking

127.0.0.0

CHP 5 - Routing and Remote Access and Wireless Ntwking

224.0.0.0

CHP 5 - Routing and Remote Access and Wireless Ntwking

cmd line entries for RRAS

route print - displays routing table

route add - add route to table

route change

route delete - for specific route

CHP 5 - Routing and Remote Access and Wireless Ntwking

Demand-Dial routing

or

dial-on-demand routing

In RRAS when rtr receives packet, can use demand-dial to initiate connection to a remote site. Connection only active when data sent to remote site. Link disconnected when no data sent over link for specific amount of time.

Used in low traffic situations, and can use existing dial-up phone lines instead of leased lines so cheaper.

configure demand-dial interface on server with demand-dial interface wizard after RRAS configured, in General Tab of RRAS properties

CHP 5 - Routing and Remote Access and Wireless Ntwking

NAT

NAT - Network Address Translation

Server 2008 can be config'd as a NAT device, which allows internal network clients to connect to the internet using a shared single IP address.

CHP 5 - Routing and Remote Access and Wireless Ntwking

Dial-Up Networking (DUN)

Dial-Up Networking (DUN)

creates a physical connection bw a client and a remote access server using a dedcated device  - analog or ISDN modem. Eg. Laptop with modem installed, which client uses to dial phone number of remote access server.

Uses a dedicated physical connection, often unencrypted traffic

CHP 5 - Routing and Remote Access and Wireless Ntwking

Virtual Private Network - VPN

Virtual Private Network - VPN

creates a secure pt-to-pt connection across either private ntwk or public such as internet. Rely on secure TCP/IP based protocols "tunneling protocols" to be secure.

logical connection bw VPN client and VPN server over public network. Data must be encrypted to secure data.

CHP 5 - Routing and Remote Access and Wireless Ntwking

When not to use VPN

- when performance at any price is prime concern

- when most traffic synchronous - voice and video

- when using application with unusual protocols not compatible with TCP/IP

CHP 5 - Routing and Remote Access and Wireless Ntwking

components in a VPN connection in Server 2008

- VPN Server

- VPN client

- VPN connection (portion of connection where data encrypted)

- VPN tunnel (portion of connection where data is encapsulated)

CHP 5 - Routing and Remote Access and Wireless Ntwking

the 2 tunneling protocols for VPN

- Point-to-Point tunneling protocol (PPTP)

supports the 128-bit RC4 encryption algorithm

- Layer Two Tunneling Protocol (L2TP)

IETF standard used to encapsulate Pt-to-Pt protocol frames over ntwks. Combines best features of PPTP and Layer 2 fwding. can use with IPSec for secure encrypted VPN connection.

CHP 5 - Routing and Remote Access and Wireless Ntwking

accounting

accounting

After authentication and authorization, accounting keeps track of what resources a user has accessed or attempted to access.

CHP 5 - Routing and Remote Access and Wireless Ntwking

remote access permission for user account levels

- control access through NPS Network Policy *DEFAULT

specifies that the users access permissions be determined by first matching the NPS ntwk policy applied to the connection.

- Deny Access

- Allow Access

CHP 5 - Routing and Remote Access and Wireless Ntwking

RADIUS

RADIUS

Remote Authentication Dail-In User Service

a server that can provide authentication, authorization and accounting for access to ntwk resources

CHP 5 - Routing and Remote Access and Wireless Networking

3 compontents of NPS Ntwk policy

conditions

constraints

settings

CHP 5 - Routing and Remote Access and Wireless Ntwking

authentication protocols supported by RRAS

- EAP-TLS

cert based authentication used with smart cards. Supports authentication data and connection data. Not supported by stand alone servers, and server must be domain member.

- MS-CHAPv2

mutual authentication method with encryption of authentication and connection data. new cryptographic key for each connection and transmission direction.

- MS-CHAPv1

one way authenticatioin method with encryption of authent and conn data. Same cryptographic key for all connections

- EAP-MD5 CHAP

"Extensible Authentication Protocol-Msg Digest 5 CHAP"

- CHAP

Challenge Handshake Authentication Protocol

- Shiva pswd authentication protocol (SPAP)

- Pswd Authentication Protocol (PAP)

- Unauthenticated success

CHP 5 - Routing and Remote Access and Wireless Ntwking

 802.1X standard for Network Access Control

port based, can allow or deny access on basis of physical port or logical port.

provides security through 3 components:

Supplicant- device that is seeking access to ntwk (laptop)

Authenticator - component that requests authentication creds from supplicants, fwds supplicants creds to Authentication Server (AS)

Authentication Server (AS) - verifies the supplicants authentication creds, and tells authenticator to allow or deny access to port. AS role can be performed by Server 2008 computer with Ntwk policy server role or any 3rd party RADIUS server

CHP 6 - Configuring File Services 

Factors for planning file sharing on a lg ntwk 

- Scalability

- Navigation

- Protection

- Abuse

- Diversity

- Fault Tolerance

Avaliability

Snails Never Pack Art Down Flying Ants

CHP 6 - Configuring File Services

Server 2008 storage limitations

Max basic volume size - 2 Terabytes

Max dynamic volume size (simple & mirrored) - 2 TB

Max dynamic volume size (spanned & striped) - 64 TB - 2 TB per disk, max 32 disks

Max dynamic volume size (RAID 5) - 64 TB - 2 TB per disk, max 32 disks, 2 TB for parity info

Max NTFS volume size - 2 to power of 32 clusters minus 1 cluster - if default 4 KB cluster size, max is 16 TB, with max 64 KB cluster, max volume 256 TB

max # of clusters on NTFS volume - 2 to power of 23

Max NTFS file size - 2 to power of 44 (16 TB) minus 64KB

Max # of volumes on server - approx 2000 (1000 dynamic volumes and the rest basic)

CHP 6 - Configuring File Services

tasks to do when installing additional storage on server

- select partitioning style

Master Boot Record (MBR) or GUID (globally unique identifier) partition table (GPT)

- Select disk type (basic and dynamic)

- Divide disk into partitions/volumes (partition for basic, volume for dynamic)

- format partitions/volumes with a file system (NTSF or FAT)

CHP 6 - Configuring File Services

partitions on basic disk

- system partition - contains hwdr related files used to boot

- boot partitions - contains the OS files

- can create up to 4 primary partitions (each can have OS)

- 4th partition can be made an extended partition (no OS)

- extended partition can hold unlimited logical drives

CHP 6 - Configuring File Services

dynamic disk volume types

Simple volume

space from single disk

Spanned volume

space from 2 - 32 physical dynamic disks. Combines space from multiple disks to single lg volume. Not fault tolerance.

Striped Volume

space from 2 to 32 disks. System writes data 1 stripe at time to each successive disk in volume. Not fault tolerant

Mirrored volume

2 disks. system does read and write operations on both disks at same time to provide fault tolerance.

RAID-5 volume

3 or more physical disks. the system stripes data and parity info across all disks, if 1 fails missing data can be recreated using parity info.

CHP 6 - Configuring File Services

Disk Management MCC snap in

CHP 6 - Configuring File Services

Disk Management views

- can show 2 at time.

- disk list

- volume list

- graphical view

CHP 6 - Configuring File Services

snap in for sharing folders and other

- Shared Folders snap-in

- to see shares, Network Discovery and File Sharing settings must be turned on in the Network and Sharing Center ctrl panel

CHP 6 - Configuring File Services

Permission systems

- Share permissions

ctrl access to folders over a network

- NTSF Permissions

ctrl access to files and folders stored on disk volumes formatted with NTFS

- Registry permissions

ctrl access to specific parts of windows registry

- Active Directory Permissions

ctrl access to specific parts of Active Directory Hierarchy

CHP 6 - Configuring File Services

Share permissions

- by default the Everyone special id receives the Allow Read share permission

Full Ctrl

change file permissions

take ownership of files

performs all tasks in Change permission

Change

create/delete folders

add, change, delete files

change file attributes

all actions permitted by Read permission

Read

displays folder/file names, file data, attributes

executes program files

access other folders w/i shared folder

CHP 6 - Configuring File Services

Server service

service under the file services role

enables computer to share files with ntwk users

CHP 6 - Configuring File Services

Dirstibuted File System (DFS)

implemented in file services role

include DFS namespaces and Replication

- simplify process of locating files

- ctrl amount of traffic passing over WAN links

- provide users at remote sites local file server access

- config ntwk to survive WAN link failure

- facilitate consistent backups

CHP 6 - Configuring File Services

Targets

CHP 6 - Configuring File Services

DFS replication

CHP 6 - Configuring File Services

Multiple Master Replication

CHP 6 - Configuring File Services

alternative to multiple master replication

single master replication

Changes that users make to one copy of a file are propagated, in one direction only to the other copies

CHP 6 - Configuring File Services

Unified services from DFS replication and namespaces

data distribution

users can access files from local server, minimizing internetwork traffic and delays. All users can browse same directory tree

Load balancing

because file is replicated on different file servers, DFS distros access requests amoung them, preventing any one server from shouldering entire traffic load

data collection
admins can replicate data from remote file servers to a central location for backups. DFS uses protocol called RDC to conserve bandwidth use and time needed for replication

CHP 6 - Configuring File Services

RDC

Remote Differential Compression

Protocol which conserves ntwk BW by detecting changes in files and transmitting only the modified data to dest.

CHP 6 - Configuring File Services

Two basic types of namespaces

stand-alone

domain based

CHP 6 - Configuring File Services

Stand-Alone namespace

- path to namespace \\server\root

- server name exposed

- namespace can contain upto 50,000 folders

- can be domain ctroller, member server in domain or standalone server

- namespace stored in system registry and memory cache

- supports use of only 1 namespace server for a single namespace

- no Active Dir domain services required

- supports DFS replication of folders when namespace server is joined to AD domain

- can be part of a server cluser

CHP 6 - Configuring File Services

Domain based Namespace

(Windows Server 2008)

- path to namespace \\domain\root

- server name hidden

- can contain up to 50,000 folders

- must be domain controller or member server of domain hosting namespace

- namespace stored in AD and memory cache on each namespace server

 - supports use of multiple namespace servers in same domain for single namespace

- requires AD using server 2008 domain functional level

- supports DFS replication of folders

- namespace c/n be clustered resource, but namespace server can be part of cluster

CHP 6 - Configuring File Services

Client Failback

ability of DFS clients to revert to targets that were previously unavailable, when they become available again and are of lower cost that the target the client is using.

enable for entire namespace by selecting "clients fall back to preferred targets" checkbox on referrals pg of namespace properties sheet.

enable for individual folder by selecting checkbox on referrals tab of folders properties sheet

CHP 6 - Configuring File Services

replication groups and members

collection of servers (members) which each contain target for particular DFS folder.

can have upto 256 members with 256 replicated folders. Each server can be member of upto 256 replication groups, with 256 connection (128 ingoing, 128 out)

Member server can support upto 1 TB of replicated files, up to 8 million replicated files per volume

CHP 6 - Configuring File Services

Full Mesh topology

default topology of replication groups.

every member in group replicates with every other member

good for small DFS deployments

CHP 6 - Configuring File Services

Hub/spoke topology

enables you to limit the replication traffic to specific pairs of members

good for larger installations

CHP 7 - Configuring Print Services

Printer components (in order)

Printer

software interface through which computer communicates with a print device. Can be USB, FireWire, LPT, serial, etc and Internet Printing Protocol (IPP) for printing HTTP traffic

Printer Driver

device driver that converts print jobs into appropriate string of cmds for specific print device.

Print Server

computer or standalone device that receives print jobs and sends to print devices

print device

actual hdwr that prints onto paper. can be local or network interface

CHP 7 - Configuring Print Services

interim formates used by printer driver to make job file

Enhanced Metafile (EMF)
converts application data into EMF file, printer sends to print server, stores in spooler which uses the printer driver on print server to render job into final PCL format for print device

XML Paper Specification (XPS)

new, platform-independent doc format in Server 2008 and Vista. Print jobs use single XPS format for entire journey to print device, rather than being converted first to EMF and then PCL

CHP 7 - Configuring Print Services

settings to enable printer sharing

set in Network and Sharing Center:

enable:

Network Discovery

Printer Sharing

CHP 7 - Configuring Print Services

Print permission

Print

Capabilities:

- connect to printer

- print doc

- pause, resume, restart and cancel users own doc

Special Permissions:

- Print

- Read Permissions

Default Assignments:

Applied to Everyone special identity

CHP 7 - Configuring Print Services

Manage Printer permission

Manage Printers

Capabilities:

- cancel all docs

- share a printer

- change printer properties

- delete a printer

- change printer permissions

Special Permissions:

- print

- manage printers

- read permissions

- change permissions

- take ownership

Default Assignments:

- Administrators Group

CHP 7 - Configuring Print Services

Manage Documents Permission

Manage Documents

Capabilites:

- Pause, resume, restart, cancel all users docs

- ctrl job settings for all documents

Special Permissions:

- manage docs

- read permissions

- change permissions

- take ownership

Default Assignments:

- Creator Owner special identity

CHP 7 - Configuring Print Services

Standard Printer Permissions

Print

Manage Printers

Manage Documents

CHP 7 - Configuring Print Services

LPD service

(in Print Services Role)

enables UNIX clients running LPR (line printer remote) program to send their print jobs to windows printer

CHP 7 - Configuring Print Services

Internet Printing

(in Print Services Role)

system services installed:

- world wide web publishing service

- IIS Admin Service

must install ISS (web server) role

Creates a web site that enables users on the internet to send print jobs to shared windows printers

CHP 7 - Configuring Print Services

Nodes in Print Management console MMC

Custom Filters

contains composite views of all printers hosted by the print servers listed in the console, regulated by customizable filters

Print Servers

Lists all of the print servers you have added to the console and all of the drivers, forms, ports, and printers for each print server

Deployed Printers

lists all of the printers you have deployed with Group Policy using the console

CHP 7 - Configuring Print Services

Custom filters default filters

- all printers

- all drivers

- printers not ready

- printers with jobs

CHP 7 - Configuring Print Services

Group Policy Object

To use Active Directory to depoly printers to clients, you must config the appropriate policies in a Group Policy Object (GPO)

You can link a GPO to any domain, site, or organizational unit (OU) in the AD tree.

When you config a GPO to deploy a printer, all of the users or computers in that domain, site or OU will receive the printer connection when they log on.

CHP 7 - Configuring Print Services

What protocol allows users to print docs through a IIS server?

CHP 9 - Securing Data transmission and Authentication

Checksum

mathematical value in the header of each UDP or TCP packet, which is used to provide an integrity check for the packet

If data is corrupted while in transit, checksum will alert receiver and packet will be dropped by the receiving computer

CHP 9 - Securing Data transmission and Authentication

IPSec

- suite of protocols intro'd to provide a series of cryptographic algorithms that can be used to provide security for all TCP/IP hosts at the internet layer, regardless of the actual application that is sending or receiving data.

CHP 9 - Securing Data transmission and Authentication

Two goals of IPSec

- protect contents of IP packets

- provide a defense against ntwk attacks through packet filtering and the reinforcement of trusted communication

CHP 9 - Securing Data transmission and Authentication

attack types

Packet sniffing:

uses an application to monitor and read ntwk packets in transmission. If in clear-text, full view of data can be seen. IPSec uses encryption

Data modification:

Attacker modifies ntwk packet that is in transit with counterfeit data. IPSec uses cryptographic checksum

Identity spoofing:

attacker falsifies the ID of sender or receiver computer with special programs that construct IP packets that apprear to be from trusted ntwks. IPSec uses mutual authentication and cryptography-based keys

Man-in-the-middle Attacks:

attacker btween two computers monitors, captures and controls data transparently. IPSec uses mutual authentication and cryptography-based keys

Denial of Service attacks (DoS)

Prevents normal use of computer or ntwk resources by flooding with traffic. IPSec uses IP Packet filtering to determine if communication allowed, secured or blocked

CHP 9 - Securing Data transmission and Authentication

IPSec security features

- Automatic security associations

- IP Packet filtering

- Network layer security

- Peer authentication

- Data orgin authentication

- Data integrity

- data confidentiality

- anti-replay

- key management

CHP 9 - Securing Data transmission and Authentication

IPSec modes

Transport mode:

use when require pkt filtering and when require end to end security. both host must support IPSec with same authentication protocols and compatible IPSec filters.

Tunnel Mode:

for site to site communication that cross internet (or other public ntwk). Provides gateway to gateway protection.

CHP 9 - Securing Data transmission and Authentication

IPSec protocols

Authentication Header (AH) protocol

provides authentication, integrity and anti-replay for entire packet (IP Header and data payload). d/n encrypt data. Uses keyed hash algorithms to sign pkt for integrity

encapsulating security payload (ESP) protocol

provides encryption + authentication, integrity and anti-replay for IP payload. In transport mode d/n sign IP header, just payload. can be used alone or w/ AH.

CHP 9 - Securing Data transmission and Authentication

Security Association (SA)

combo of security services, protection mechanisms, and cryptographic keys mutually agreed to by communicating peers. Two types of SA:

- ISAKMP SA (main mode)

- IPSec SA

CHP 9 - Securing Data transmission and Authentication

ISAKMP SA

main mode SA

used to protect IPSec security negotiations. Created by negotiating sipher suite (collection of cryptographic algorithms for encryption) used for protecting future ISAKMP traffic, etc. When complete, all future SA negotiations for both types protected - known as protected cipher suite negotiation.

CHP 9 - Securing Data transmission and Authentication

IPSec SA

CHP 9 - Securing Data transmission and Authentication

Internet Key Exchange (IKE)

CHP 9 - Securing Data transmission and Authentication

Dynamic Rekeying

CHP 9 - Securing Data transmission and Authentication

IPSec policy component:

Tunnel Setting

CHP 9 - Securing Data transmission and Authentication

IPSec policy component:

Network Type

CHP 9 - Securing Data transmission and Authentication

IPSec policy component:

IP Filter

A subset of ntwk traffic based on IP address, port and transport protocol. It informs IPSec which inbound and outbound traffic fhould be secured. IP Filter can be mirrored, meaning that traffic defined in 1 direction will also be defined in opposite direction.

IP Filter components:

Source Address:

Filter defined by IP address, specific DNS name, DNS servers, WINS servers, DHCP servers, Default gateway.

Destination address

IP Protocol Type:

any, EGP, HMP, ICMP, TCP, UDP, others...

IP Protocol Port:

from or to specific or any TCP or UDP port

CHP 9 - Securing Data transmission and Authentication

IPSec policy component:

IP Filter List

CHP 9 - Securing Data transmission and Authentication

IPSec policy component:

Filter Action

CHP 9 - Securing Data transmission and Authentication

IPSec policy component:

Authentication Method

one of the security algorithms and types used for authentication and key exchange:

Kerberos v5 protocol

default authent. method used by IPSec policies deployed w/i AD domain.

PKI cert from cert authority (CA)

provides ability to deploy IPSec securely in non AD enviro.

CHP 9 - Securing Data transmission and Authentication

Preconfig Connection Security Rules

- Isolation Rule

- Authentication Exemption rule

- Server-to-server rule

- Tunnel rule

CHP 10 - Maintaining Network Health

Public Key Infrastructure

- provides assurances that you are communicating with the intended internal or external entity w/o hacker intrusion.

- this is accomplished trhough the use of a public and private key

CHP 10 - Maintaining Network Health

Public Key

CHP 10 - Maintaining Network Health

Private Key

CHP 10 - Maintaining Network Health

PKI Common Terms:

Certification Authority (CA)

CHP 10 - Maintaining Network Health

PKI Common Terms:

Digital Certificate

CHP 10 - Maintaining Network Health

PKI Common Terms:

Digital Signature

CHP 10 - Maintaining Network Health

PKI Common Terms:

Certificate Practice Statement (CPS)

CHP 10 - Maintaining Network Health

PKI Common Terms:

Certificate Revocation List (CRL)

CHP 10 - Maintaining Network Health

PKI Common Terms:

Certificate Template

CHP 10 - Maintaining Network Health

PKI Common Terms:

Smart Cards

CHP 10 - Maintaining Network Health

PKI Common Terms:

Self-Enrollment

CHP 10 - Maintaining Network Health

PKI Common Terms:

Autoenrollment

CHP 10 - Maintaining Network Health

PKI Common Terms:

Recovery Agents

CHP 10 - Maintaining Network Health

PKI Common Terms:

Key Archival

CHP 10 - Maintaining Network Health

Active Directory Certificate Services server role services:

Web Enrollment

CHP 10 - Maintaining Network Health

Active Directory Certificate Services server role services:

Online Responder

CHP 10 - Maintaining Network Health

Active Directory Certificate Services server role services:

Ntwk Device Enrollment Service (NDES)

allows devices to enroll for certs w/i a windows server2008 PKI that might not otherwise be able to do so.

Uses Simple Certificate Enrollment Protocol (SCEP)

CHP 10 - Maintaining Network Health

2 types of CA

standalone CA

not integrated w/ AD, relies on admin intervention to respond to cert requests. Can be both root and subordinate CA. Can be taken offline for security.

enterprise CA

integrates w/ AD domain and can use cert templates to allow autoenrollment of digital certs, and can store certs w/i AD database. Can use as root or subordinate

CHP 10 - Maintaining Network Health

CA administrator

CHP 10 - Maintaining Network Health

Certificate Managers

CHP 10 - Maintaining Network Health

Backup Operators

CHP 10 - Maintaining Network Health

Auditors

CHP 10 - Maintaining Network Health

Network Access Protection - NAP

CHP 10 - Maintaining Network Health

NAP enforcement methods:

DHCP enforcement

CHP 10 - Maintaining Network Health

NAP enforcement methods:

IPSec enforcement

CHP 10 - Maintaining Network Health

NAP enforcement methods:

VPN enforcement

CHP 10 - Maintaining Network Health

NAP enforcement methods:

802.1X enforcement

CHP 10 - Maintaining Network Health

NAP enforcement methods:

Terminal Services Gateway (TS Gateway) enforcement

CHP 10 - Maintaining Network Health

System Health Agents (SHAs)

CHP 10 - Maintaining Network Health

NAP Agent

CHP 10 - Maintaining Network Health

Enforcement point

CHP 10 - Maintaining Network Health

Health Registration Authority (HRA)

CHP 10 - Maintaining Network Health

Statement of Health Response (SOHR)

CHP 10 - Maintaining Network Health

NAP Administration Server

manages the NAP Server side components

- obtains the SSOH for a NAP client from the relevant NAP enforcement service.

- distros each SOH w/i a the SSOH to the appropriate system health validator for analysis and action

- collects the SOHR from each SHV and passes info onto Network policy server (NPS) service.

CHP 10 - Maintaining Network Health

System Statement of Health Response SSOHR