ipam · 2014-09-30 · dhcp operational event auditing is supported for dhcp servers running...

IPAM

IP Address Management (IPAM) is one of the New Features

introduced with Windows Server 2012. In this Article I explained

how to install and configure.

By

Radhakrishnan G

What Is IPAM?

IPAM (IP Address Management) is the New Feature in Windows Server 2012.

Enables to Plan, Mange, Deploy, Monitor your IP Address Infrastructure in a Single place.

IPAM automatically discovers IP address infrastructure servers on your network and enables

you to manage them from a central interface.

In this Guide I have focused only on practical Deployment. Hence For more about IPAM and It’s

Features, Please visit http://technet.microsoft.com/en-us/library/jj878331.aspx

IPAM’s Key Components

1. Address Space Management (ASM)

2. Multi Server Management & Monitoring (MSM)

3. Network Audit

1. Address Space Management (ASM)

a. ASM enables you to manage all your IP address Infrastructure in a Single Console.

b. You can Customize and make Multi Level server Hierarchy of address Space.

c. For more about ASM and Features, Please visit http://technet.microsoft.com/en-

us/library/jj878331.aspx

2. Multi Server Management & Monitoring (MSM)

a. MSM is automatically discovering all your DHCP and DNS servers on the network, Monitor

service availability, and centrally manage their Configuration.

b. You can use Group policy based and manual Provisioning modes to IPAM Accessing Settings in

MSM servers.

c. Group Policy based Provisioning is painless as we are making all settings using group policy,

hence no need to anything manually.

d. Manual Method also available and required more manual settings has to be done for

Provisioning.

e. For more about MSM and Features, Please visit http://technet.microsoft.com/en-


3. Network Audit

a. IPAM’s Network Audit Component provides centralized Repository for all Configuration

changes performed on DHCP Servers and the IPAM Servers.

b. IPAM audit tools enable you to view potential configuration problems on DHCP servers by

actively tracking and reporting all administrative actions

c. Detailed IP address tracking data is also provided, including client IP addresses, client ID, host

name, and user name. Advanced search capabilities enable you to selectively search for events

and obtain results that associate user logons to specific devices and times.

d. For more about Network and Features, Please visit http://technet.microsoft.com/en-


http://technet.microsoft.com/en-us/library/jj878331.aspx







IPAM Requirements:

Processor Minimum: 1.4 GHz (x64 processor) Recommended: quad-core, 2.66 GHz or faster

Memory Minimum: 2 GB RAM Recommended: 4 GB RAM or greater

OS(IPAM Server) Server 2012

OS(IP Client) Server 2012, Windows 8

Disk Space Minimum: 10 GB Recommended: 80 GB or greater*

Active Directory IPAM Server what you planning to install must be Domain Joined Host

You can’t install IPAM on Workgroup Computer Installing on Domain Controller is not

recommended.

Network The IPAM server must also have network connectivity to all servers that are marked as managed in the server inventory.

IPAM server be configured to provide access to at least one domain controller and authoritative DNS server

IPAM specifications

IPAM Server has the following specifications:

The scope of IPAM server discovery is limited to a single Active Directory forest. The forest itself may be comprised

of a mix of trusted and untrusted domains.

IPAM supports only Microsoft domain controllers, DHCP, DNS, and NPS servers running Windows Server® 2008

and above.

DHCP operational event auditing is supported for DHCP servers running Windows Server® 2008 R2 and above.

IPAM installation on a DHCP server is not recommended. The IPAM server discovery feature will not be able to

discover DHCP roles if DHCP Server is installed on the same computer.

IPAM supports only domain joined DHCP, DNS and NPS servers in a single Active Directory forest.

IPAM does not support management and configuration of non-Microsoft network elements.

IPAM does not support external databases. Only a Windows Internal Database is supported.

A single IPAM server can support up to 150 DHCP servers and 500 DNS servers.

A single IPAM server has been tested to support up to 6000 DHCP scopes and 150 DNS zones.

IPAM stores 3 years of forensics data (IP address leases, host MAC addresses, user login/logoff information) for

100,000 users in a Windows Internal Database. There is no database purge policy provided, and the administrator

must purge data manually as needed.

IP address utilization trends are provided only for IPv4.

IP address reclaiming support is provided only for IPv4.

No special processing is done for IPv6 stateless address auto configuration private extensions.

No special processing for virtualization technology or virtual machine migration.

IPAM does not check for IP address consistency with routers and switches.

IPAM does not support auditing of IPv6 stateless address auto configuration on an unmanaged machine to track

the user.

IPAM users must be logged in using domain credentials. Do not log sign in to the IPAM server using the local

Administrator account or another local user account on the IPAM server.

If you are accessing the IPAM server from a remote IPAM client, you must be a member of the WinRMRemote

WMIUsers group on the IPAM server, in addition to being a member of the appropriate local IPAM security group.

If the Group Policy based provisioning method is used, users must have domain administrator privileges to mark

servers as managed or unmanaged in the server inventory.

IPAM Architecture

IPAM Server-Client Communication

The IPAM client communicates with an IPAM server using the Windows Communication

Foundation (WCF) protocol with TCP as the transport method. By default, TCP binding is performed

on port 48885 on the IPAM server.

IPAM Communication with Server roles:

RPC: Remote Procedure Call (Port Number: 135-TCP)

WMI: Windows Management Instrumentation (Port Number: TCP)

SMB: Session Message Block (Port Number: 445-TCP)

LDAP: Lightweight Directory Access Protocol (Port Number: 389-TCP/UDP)

Domain Controller

DHCP

NPS

DNS

Monitor: IP address utilization

Monitor: Service status

Configure: Servers and scopes

Audit: IP address lease events

Audit: DHCP configuration

events

Discover: DNS servers Monitor: DNS zone health Configure: DNS zones

Discover: DNS and DHCP servers Validate: Managed servers Audit: User and device logon events

Audit: User and device logon events

RPC, WMI, SMB, WS-Management

RPC, WMI, WS-Management

RPCRPC

RPC, WMI, LDAPRPC, WMI, LDAP

IPAM Deployment Plan:

Normally IPAM can be deployed in three different topologies in Enterprise Environment.

1. Distributed: An IPAM server deployed at every site in the enterprise.

2. Centralized: One IPAM server in the enterprise.

3. Hybrid: A central IPAM server deployed with dedicated IPAM servers at each site.

An Example: Hybrid Deployment

TEST LAB

I have taken 4 Server to test IPAM and my Environment is as mentioned.,

AD Domain:

soft.comNetBIOS Name: SOFT

Domain functional level: Windows Server 2003

Total User's: 6Total DC's: 2

fsmoPDC: DC-SOFT.SOFT.COM

fsmoINFRA: DC-SOFT.SOFT.COM

fsmoRID: DC-SOFT.SOFT.COMkrishnan.soft.comNetBIOS Name: KRISHNAN

Domain functional level: Windows Server 2003

Total User's: 4Total DC's: 1

fsmoPDC: DC1.KRISHNAN.SOFT.COM

fsmoINFRA: DC1.KRISHNAN.SOFT.COM

fsmoRID: DC1.KRISHNAN.SOFT.COMSOFT><KRI

SHNAN

KRISHNAN

><SOFT

DC-SOFT

6.2 (9200)

ADC-SOFT

6.2 (9200)

DC1

6.2 (9200)

AD Sites:

Default-First-Site-NameTotal Domain Controllers in Site: 0

IntraSite Topology Generation: Disabled

Cleanup: Disabled

Optimizing Edges: Disabled

Stale Link Detection: Disabled

InterSite Topology Generation: Disabled

SOFTSITETotal Domain Controllers in Site: 2

Total Number of Subnets in Site: 1


Cleanup: Disabled




soft-krishnanTotal Domain Controllers in Site: 1

Total Number of Subnets in Site: 1


Cleanup: Disabled




DEFAULTIPSITELINK

(Type:IP-Link, Cost:100, Interval:180)

SOFT


SOFT


SOFT


soft-krishnan


23019598-9a82-

435b-9b13-

e36d91a6a56a

ccbba8ea-7973-

4acd-8f5d-

ebe44e327ec4

192.168.137.0/28

192.168.138.0/28

DC-SOFT.SOFT.COM

Global Catalog Server

ADC-SOFT.SOFT.COM


DC1.KRISHNAN.SOFT.COM


IPAM Installation:

IPAM Installed by using Both Server Manager and PowerShell.

I have explained both methods. You can select anyone method best on your interest and Knowledge.

IPAM Installation Using Server Manager:

Step 1: Open Server Manager

Step 2: Go to Manage and click Add Roles and Features

Step 3: Select Role-Based of Features-Based installation option

Step 4: Select the Server where you want to install IPAM

Step 5: Don’t select the any Server Roles as IPAM is not a Server role (IPAM is maintained under Features of the Server

2012)

Step 6: Select the IPAM server under Features

Step 7: Select all Management Tools that are required for IPAM

Step 8: Click on Install to begin the IPAM Server Installation

IPAM Installation Using PowerShell(PS)

Step 1: Open the Power shell and type the Command: Add-Windows Features ipam –IncludemanagementTools –

Whatif( will let us know that what will be happen if you install)

Step 2: Type the Command Add-Windows Features ipam –IncludemanagementTools and hit enter key to start the

installation

Now we have finished the installation of IPAM.IPAM is required some configuration Settings which are highly

required to make IPAM Operational.

There are Six more Additional Configuration steps are required,

1. Connect IPAM Server

2. Provision the IPAM Server

3. Configure Server Discovery

4. Start Server Discovery

5. Select or add Servers to manage and Verify IPAM Access

6. Retrieve data from Managed Servers

1. Connect IPAM Server:

a. You need to login as IPAM Administrator to connect the IPAM Server in IPAM Installed Host.

2. Provision the IPAM Server:

a. Click on Provision the IPAM Server and click Next.

b. Select Group Policy Based Provisioning method and Enter the GPO Name Prefix as IPAM1

There are two types of Provisioning one is Manual which is everything needs to be done manually

(It will take lot of time as we need to create GPO and IPAM Groups manually. Group Policy Based

is another way which I have selected in my Demo where all will be done automatically using GPO.

c. Click on Apply to Confirm the Settings. It may take some time to finish.

d. Now we have created GPO but it needs to be invoked to the Domain.

Open PowerShell(PS): Type the Command Invoke-IpamGpoProvsioning –Domain

SOFT.COM –GpoprefixName IPAM1 –IpamServerFqdn win-2012.soft.com

and hit enter..

3. Configure Server Discovery: We have created GPO and Invoked in the Domain: Soft.com. Now we need

to Configure Server Discovery.

a. Click on Configure Server Discovery and add the Domains those you want to manage within you

Forest.

4. Start Server Discovery: Click on Start Server Discovery once you finished the Configuration. It may take

some time it depends on number of servers in the selected Domains.

5. Select or Add Servers to Manage and Verify IPAM Access:

a. Click on the Select or Add Servers to Manage and Verify IPAM Access and see the Discovered

servers in your Domain. In my Domain I have three Servers and it has been discovered.

b. Right on Server and go to Edit Server Option and Select Managed under the manageability Status.

c. If you hit OK once selected manage. You will get error message stating that GPO not applied for the

Specified Server. Hence we have invoked the GPO for Domain called Soft and Sub Domain

Krishnan but it needs to be applied to the Domain Controllers. Hence that particular server can be

managed by using IPAM.

d. Open Group Policy management console. You can open it by using command: GPMC.MSC

e. Go to Group Policy Objects under Forest Soft.com. There will be three GPOs( IPAM1_DC_NPS,

IPAM_DHCP, IPAM_DNS) which are created for IPAM while Provisioning Domains.

f. Add Servers which are required to be managed using IPAM under Security Filtering.do the same

for all other GPOs of IPAM as well.

g. Login to the Individual server and apply the Group Policy and restart the server by using the

Command Gpupdate /sync . It can be done using PowerShell from the Server manager where you

managing all servers in Central Place(It is also wonderful feature available in Server 2012.That is

why I Love Server 2012!!).

h. Below Server which is the centralized server for the entire servers in Soft.com. Right click the server

which needs Gpupdate needs to be done for IPAM Manage.

i. Go to PowerShell and give the credentials to login and enter the Command gpupdate /Force. You

can do it for other servers also using same method.

j. If you want to apply the settings in otherway, You can login to the perticular servers and apply the

settings.

k. Now we finished the all the configurations for managed Servers. Now it is ready to retrieve all the

data related to DHCP Scopes, IP Ranges, IP Blocks, DNS and NPS server detail.

l. Click on Retrieve Data from Managed Servers. It will take more time based on your servers in

Domain.

That is all the IPAM Server Installation, Configuration and Apply Settings. You can see all the DHCP, DNS server Details

with Available Scopes and its Utilization in the IPAM. No need to go to individual servers to

Create/Delete/Modify/Reserve the Scopes/ IP address in centralized place called IPAM.

ipam · 2014-09-30 · dhcp operational event auditing is supported for dhcp servers running...

Documents