DNS, DHCP, and IP Address Management Session

Chia sẻ: Danh Ngoc | Ngày: | Loại File: PDF | Số trang:29

Thêm vào BST

Báo xấu

259
lượt xem 92
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

DNS, DHCP, and IP Address Management Session 806 Policies Based on IP Addresses Intelligent Network Users User Provisioning Scalable Reliable DNS/DHCP Service Applications Automated Network Addressing User-Based Policy Networking Managing Names and Addresses Edit by Hand Spreadsheet Custom Application Migrating to Directories Etc. Firewall DNS DHCP PC Inventory PC Inventory Many Users DNS DNS Firewall Firewall 2000 Directory DHCP DHCP Policy Policy 1990’s Single Source of Data Multiple Sources of Data...

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: DNS, DHCP, and IP Address Management Session

806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 1 DNS, DHCP, and IP Address Management Session 806 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 2 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 1
DNS and DHCP Challenges Manual Processes Public Policies Domain Based on Software IP Addresses Intelligent Network Users Applications User Provisioning User-Based Scalable Automated Policy Reliable Network Networking DNS/DHCP Addressing Services 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 3 Managing Names and Addresses Custom Edit by Hand Spreadsheet Application 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 4 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 2
Migrating to Directories Etc. Many Users DNS DNS Firewall Firewall Firewall 2000 Directory DHCP DHCP Policy Policy DNS 1990’s DHCP PC Inventory PC Inventory Multiple Single Sources Source of Data 1980’s of Data Dial-In 1970’s E-Mail Few Users 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 5 Protocol Overview DNS and DHCP 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 6 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 3
How DNS Works DNS Namespace cisco.com zone • Hierarchical name space (root) • Each node in tree represents COM domain/subdomain CISCO CISCO • Some subdomains are defined as zones WWW WWW TIMSPC TIMSPC RTP RTP • Each zone has a “primary” name server responsible for all lower nodes • Resource records (RR) are defined for each node • Example RRs are: Address (A), pointer (PTR), mail exchange (MX), timspc.cisco.com name server (NS), start of authority (SOA) 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 7 How DNS Works DNS Queries • Clients query local DNS Root Name server for IP addresses Server • Local server starts with .COM Name Server the root name server and recursively queries DNS CISCO.COM servers until it finds a Name Server server that has the answer Local • Local servers send DNS answers back to the Server www.cisco.com clients and cache A. 161.44.10.9 the answers Q. What Is the IP Address DNS Client Outside for www.cisco.com? of Cisco Network 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 8 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 4
DNS Redundancy Primary Name Server • Redundancy is built into DNS for CISCO.COM • Secondary servers automatically backup primary servers • Secondary servers check the primary for changes in the zone serial number • Updates controlled by the refresh rate in SOA record for zone • Use Notify and Incremental Zone Transfers to reduce propagation Secondary DNS Secondary DNS delay and bandwidth utilization Server for Server for • Spread secondary and caching CISCO.COM DNS Client CISCO.COM DNS servers liberally Old Zone Transfer Old Zone Transfer New Zone Transfer New Zone Transfer 1. Secondary Checks the Serial 1. Secondary Checks the Serial 1. Primary DNS Server Sends a 1. Primary DNS Server Sends a throughout the network Number of the Zone Number of the Zone NOTIFY Message to Secondary NOTIFY Message to Secondary 2. If It Has Changed, Secondary 2. If It Has Changed, Secondary When the Zone Data Changes When the Zone Data Changes Requests a Zone Transfer Requests a Zone Transfer 2. Secondary Requests an 2. Secondary Requests an 3. Primary Sends the Entire 3. Primary Sends the Entire Incremental Zone Transfer Incremental Zone Transfer Zone to Secondary Zone to Secondary 3. Primary Only Sends the 3. Primary Only Sends the Changes to Secondary Server Changes to Secondary Server 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 9 How DHCP Works Obtaining a Lease Send My • Dynamically assigns Configuration configuration information DHCP Information Server • Creates IP address pools to conserve addresses and support mobile users • Clients broadcasts DHCP DHCP Discover packet on Client local subnet Here is your configuration: • Multiple servers IP Address: 192.204.18.7 can respond Subnet Mask: 255.255.255.0 Default Routers: 192.204.18.1, 192.204.18.3 • Client chooses first DNS Servers: 192.204.18.8, 192.204.18.9 WINS Server: 192.204.18.9 or best response Lease Time: 5 days 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 10 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 5
How DHCP Works DHCP Discover Process Server 1 Client Server 2 ER DIS • DHCP client broadcasts OV COV ISC (Br oad ER D st) cas DHCP DISCOVER packet (Br oad ca t) on local subnet ER OF OFF FE t) (U icas • DHCP servers send nic as t) R ( Un OFFER packet with lease information REQ T UES UES • DHCP client selects lease REQ ast) (Br o T adc adc ast (Bro and broadcasts DHCP ) REQUEST packet ACK s t) • Selected DHCP server ica ( Un sends DHCP ACK packet 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 11 How DHCP Works DHCP Packet Hardware Hardware OP Code HOPS Type Length Transaction ID (XID) Seconds Flags Client IP Address (CIADDR) Your IP Address (YIADDR) Server IP Address (SIADDR) Gateway IP Address (GIADDR) Client Hardware Address (CHADDR)—16 bytes Server Name (SNAME)—64 bytes Filename—128 bytes DHCP Options 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 12 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 6
How DHCP Works DHCP Options • Server passes Common DHCP Options configuration options Option Code to client Lease Time 51 Subnet Mask 1 • Over 100 options defined Default Routers 3 DNS Servers 6 • Most DHCP clients support Domain Name 15 approximately 10 options Host Name 12 WINS Servers 44 • Custom and vendor NetBIOS Node Type 46 options available Client Identifier 61 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 13 What’s New in DNS and DHCP • New DNS standards Dynamic DNS updates (RFC 2136) Incremental Zone Transfers (RFC 1995) Notify (RFC 1996) • New DHCP standards DHCP Safe Failover (Internet draft) 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 14 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 7
Dynamic DNS Updates, Notify, and Incremental Zone Transfers Cisco Network Cisco Network sbombay- sbombay- Registrar DHCP pc.cisco.com IP: pc.cisco.com IP: Registrar Primary Server 172.16.18.74 172.16.18.74 DNS Server Host: Host: Notify Notify sbombay-pc sbombay-pc Message Message IP Address: IP Address: 172.16.18.74 172.16.18.74 IXFR IXFR Only changed information is sent Only changed information is sent sbombay-pc.cisco.com sbombay-pc.cisco.com Request Request 172.16.18.74 172.16.18.74 WAN DHCP Client • Dramatically reduces propagation delay • Dramatically reduces WAN bandwidth utilization • Integrates DHCP and DNS Secondary 806 DNS Server 0963_05F9_c3 © 1999, Cisco Systems, Inc. 15 DHCP Safe Failover Protocol Backup DHCP Server • All DHCP requests are sent to both servers Primary DHCP Server • Primary updates backup with lease information • Backup takes over when primary fails Primary Address Pool Primary Address Pool Backup Address Pool Backup Address Pool • Backup server uses 172.16.18.101-200 172.16.18.101-200 172.16.18.191-200 172.16.18.191-200 dedicated pool of addresses allocated by the primary to prevent duplicate IP address • Servers synchronize when primary is up • IETF Internet Draft 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 16 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 8
DNS Issues 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 17 Split DNS External www.cisco.com • Two “primary” DNS Internet DNS mail.cisco.com servers for the domain Server ftp.cisco.com • Hides the structure of the internal network • Internal clients point to internal DNS servers • External server www.cisco.com publishes web, mail, mail.cisco.com ftp and other external Internal ftp.cisco.com servers Network wwwin.cisco.com • Internet DNS servers delegate to external callmanager.cisco.com primary DNS server erpserver.cisco.com Internal timspc.cisco.com DNS eng-web.cisco.com Server 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 18 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 9
Selective Forwarders Root DNS Server External External DNS Internet DNS Server Server Big.com Small.com Connect to erp.small.com Internal Internal erp.small.com DNS Server DNS Server 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 19 WINS • Windows Internet Names Service (WINS) NetBIOS Names Service (NBNS) Windows NT file and print services Flat name space • Coexists with DNS • Scaling problems in large networks • Going away with Windows 2000! 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 20 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 10
Windows 2000 and Active Directory • Coming soon! • DNS requirements Dynamic DNS updates (RFC 2136) SRV records • Active directory is dependent on DNS • WINS is phased out 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 21 DHCP Issues 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 22 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 11
DHCP in a Routed Network • DHCP clients broadcasts Router with DHCP Relay a DHCP discover packet interface se0 • DHCP relay (ip helper address) ip helper 161.44.54.7 on the router hears the DHCP ip helper 161.44.54.8 DHCP Discover packet and forwards Server DHCP (unicast) the packet to the 161.44.54.7 Server DHCP Packet 161.44.54.8 DHCP server • DHCP relay fills in the GIADDR GIADDR 161.44.18.1 field with IP address of the primary interface of router • DHCP relay can be configured to forward the packet to multiple Physical Network DHCP servers. Client will choose 161.44.18.0 the “best” server • DHCP servers use GIADDR field of DHCP DHCP Discover packet as an index Client in to the list of address pools 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 23 DHCP in a Switched Network • Cisco IOS® allows DHCP Packet Router multiple addresses on with DHCP an interface which GIADDR DHCP Server implies multiple logical Relay networks on same 192.204.18.1 Primary physical network 192.204.19.1 Secondary Catalyst® • DHCP relay inserts first 192.204.20.1 Secondary Switch IP address of interface 192.204.21.1 Secondary in GIADDR field • Most DHCP servers can One Physical Network create an address pools Four Logical Networks with multiple logical 192.204.18.0 DHCP DHCP 192.204.19.0 Client Client networks. This is also 192.204.20.0 known as super scopes 192.204.21.0 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 24 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 12
DHCP Security • DHCP lacks built in security Any client can get an address Any server can allocate an address • Client class in CNR Create list of authorized MAC addresses • IETF working on the problem • Generally not an issue on most nets 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 25 IP Address Management Issues 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 26 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 13
Private Network Numbers (RFC 1918) • Difficult to obtain new network numbers Internet • Unlimited addresses with private network numbers • Allows for flexible addressing schemes Private Network • Requires NAT/PAT to 10.0.0.0/8 access Internet Private Network Numbers 10.0.0.0 - 10.255.255.255 (10/8 prefix) 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) 192.168.0.0 - 192.168.255.255 (192.168/16 prefix) 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 27 NAT, PAT, and Dynamic NAT Private Network 10.0.0.0/8 10.0.0.7 172.16.0.0/12 Internet Internal Add. External Add. Translation Note 10.0.100.151 10.0.0.7 161.44.16.7 Static NAT Permanent Mapping for Mail Server 172.16.4.57 10.0.100.151 161.44.16.105 Dynamic NAT VoIP Phone Calling on the Internet 172.16.4.57 161.44.17.5 PAT Web client browsing Internet Translation Mapping How It Works Permanent Mappings between Internal Permanent Mappings between Internal Static NAT Permanent—1 to 1 Servers to external addresses Servers to external addresses Pool of External Addresses Dynamically Pool of External Addresses Dynamically Dynamic NAT Dynamic—1 to 1 Assigned to Internal Clients for Duration Assigned to Internal Clients for Duration of Session of Session Multiple Internal Clients Share Single Multiple Internal Clients Share Single PAT Dynamic—Many to 1 External Address External Address 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 28 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 14
NAT in PIX, and Cisco IOS Packet with Embedded IP Address Translated Packet SA: 10.0.5.8 NAT Mappings SA: 171.68.10.5 161.44.8.9 DA: 161.44.8.9 10.0.5.8 -> 171.68.10.5 DA: 161.44.8.9 Pool of NAT Addresses 171.68.10.2-100 10.0.5.8 10.0.5.8 171.68.10.5 Cisco Translation Applications PIX IOS Easy Telnet, FTP, HTTP, Simple C/S Apps Yes Yes Multimedia, H.323, NetBIOS, DNS, Dual NAT, Difficult Yes Most SQL*NET, Dynamic Port Negotiation Impossible SNMP - - 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 29 Directory Services Standard Schemas • Directory Enabled Networks (DEN) Started by Cisco/Microsoft, now owned by DMTF • Schemas for DHCP being developed Proposals from Microsoft, Novell, and IETF 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 30 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 15
Server Sizing (100K, 10K, 1K, 100 Clients) Nodes Minimum Server Configuration Redundant DHCP Server (Mid-Range UNIX Servers—Sun Ultra 250E, Redundant DHCP Server (Mid-Range UNIX Servers—Sun Ultra 250E, Raid Disks, 512 MB RAM) Raid Disks, 512 MB RAM) 100K Primary DNS Server (Mid-Range UNIX Server—Sun Ultra 250E, Raid Disks, 512 MB Primary DNS Server (Mid-Range UNIX Server—Sun Ultra 250E, Raid Disks, 512 MB RAM)Distribute Secondary and Caching DNS Servers Throughout Network RAM)Distribute Secondary and Caching DNS Servers Throughout Network Option 1: Redundant DHCP Servers (Mid-Range UNIX Servers, 384 MB RAM) Option 1: Redundant DHCP Servers (Mid-Range UNIX Servers, 384 MB RAM) 10K Option 2: Redundant DHCP Servers (High-End NT Servers, 384 MB RAM) Option 2: Redundant DHCP Servers (High-End NT Servers, 384 MB RAM) Primary DNS Server (Mid-range UNIX Server—Sun Ultra 250E, Raid Disks,512 MB Primary DNS Server (Mid-range UNIX Server—Sun Ultra 250E, Raid Disks,512 MB RAM) Distribute Secondary and Caching DNS Servers Throughout Network RAM) Distribute Secondary and Caching DNS Servers Throughout Network 1K Option 1: Two Servers Running DNS/DHCP (Low-end UNIX Servers—Raid Disks, 256 MB RAM) Option 1: Two Servers Running DNS/DHCP (Low-end UNIX Servers—Raid Disks, 256 MB RAM) Option 2: Two Servers Running DNS/DHCP (Mid-range NT Servers—Raid Disks, 256 MB RAM) Option 2: Two Servers Running DNS/DHCP (Mid-range NT Servers—Raid Disks, 256 MB RAM) Distribute Secondary and Caching DNS Servers Throughout Network Distribute Secondary and Caching DNS Servers Throughout Network 100 Option 1: Cisco IOS DHCP Server on Any Platform 1600, 2500, 3600, Etc. Option 1: Cisco IOS DHCP Server on Any Platform 1600, 2500, 3600, Etc. Provide DNS Service Remotely Across WAN Provide DNS Service Remotely Across WAN Option 2: CNR on a Small Windows NT System to Provide DNS & DHCP Option 2: CNR on a Small Windows NT System to Provide DNS & DHCP Performance Factors Number of Nodes, Number of Queries, DHCP Lease Time, and Disk I/O Performance 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 31 Example Network Designs 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 32 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 16
Large Campus Corporate • Large campus networks require high-performance, redundant DNS Data Center and DHCP servers to support Primary multiple 10,000s of nodes DNS • The server functions need to be Server split across multiple servers in a cluster • Build a cluster with at least three servers, one primary DNS and two redundant DHCP servers. An additional DNS server can used to provide secondary DNS service DHCP DHCP • DNS servers need high Server 1 Server 1 performance disk I/O (preferably a RAID system) to keep up with dynamic DNS updates Secondary • Each major location around the DNS world—U.S., Europe and Asia Server needs a cluster 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 33 Large Branch Offices • Organizations with a large Primary DNS Secondary number of remote branch offices with a UNIX or NT Server for DNS server at each remote site. Company Zone Server Typically 20-200 nodes/site Bigco.Com • At each of the remote sites, Corporate Headquarters an organization should deploy at least one DNS and DHCP server, two for redundancy. The redundant DHCP server could be at HQ Corporate • Each location could have a WAN separate domain for the site and a primary DNS server at DNS and the location. This depends DHCP Servers on the WAN bandwidth • This configuration survives WAN outages DNS and Store Number: 1007 Store Number: 1007 DNS and Zone: st1007.bigco.com Zone: st1007.bigco.com DHCP Servers DHCP Servers 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 34 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 17
Small Branch Offices • Organization has a large number of remote sites and less than 20 nodes per site. Primary DNS Redundant Remote sites should have Server for DHCP dial-backup connections for Store Zones Servers redundancy. DHCP/Bootp relay is enabled on router Corporate Headquarters • At HQ deploy cluster of redundant DNS and DHCP DHCP/Bootp Relay servers to provide service to remote sites (aka IP Helper) • Each location could have a Corporate separate domain. Primary WAN DNS server for each remote DNS and site zone is in HQ. If available, run a secondary DHCP Servers DNS server in the remote site for the remote site zone using IXFR and NOTIFY Secondary Store Number: 1007 Store Number: 1007 DNS Zone: st1007.bigco.com Zone: st1007.bigco.com Server 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 35 Small Office/Home Office • SOHO users can connect to the corporate network using ISDN, DSL or Frame Relay • Use the Cisco IOS DHCP server Corporate to provide addresses for WAN devices in the SOHO. Use a private, unregistered network number Cisco Cisco IOS • Use Port Address Translation DHCP Serve Port to converse IP addresses Address Translation • Provide DNS services from the corporate network 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 36 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 18
Provisioning IP Phones 10.0.100.15 10.0.100.21 IF MAC Address = Phone Mac Address Then CNR IP Address = 10.0.100.X DHCP Else Server IP Address = 161.44.12.X DHCP Extension Point Script Primary IP address = 161.44.12.1 161.44.12.45 161.44.12.53 Secondary IP address = 10.0.100.1 • Deployment of IP phones will require a large number of new IP addresses • Private network numbers (RFC 1918) should be used for IP phones • Cisco Network Registrar is able to distinguish between PCs and IP phones using a DHCP extension point script • DHCP server distributes additional configuration information to IP phones 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 37 Custom Application User Registration • Boston College (BC) EagleNet activation • Users must “activate” Minimal documentation Enter name and BC PIN Activation • Four activated classes Web Page Other BC Student, staff Network Guest, device Resources • Existing DB updated User name/MAC • Help desk load User DB 60% fewer calls 806 0963_05F9_c3 © 1999, Cisco Systems, Inc. 38 Copyright © 1998, Cisco Systems, Inc. All rights reserved. Printed in USA. Presentation_ID.scr 19
Cisco IOS DHCP Server Configuration ! Start DHCP Server service dhcp ! ! Store DHCP Lease database on tftp server ip dhcp database tftp://tftp.cisco.com/dhcp. db ! ! ! Create DHCP address pool for the 10.0.0.0/28 network ip dhcp pool subnet-10 lease 3 0 0