How To Manage Ip Address Management In Windows Server 2012 (Gipam)

(1)

IPAM

IP Address Management (IPAM) is one of the New Features introduced with Windows Server 2012. In this Article I explained how to install and configure.

By

(2)

What Is IPAM?

 IPAM (IP Address Management) is the New Feature in Windows Server 2012.

 Enables to Plan, Mange, Deploy, Monitor your IP Address Infrastructure in a Single place.  IPAM automatically discovers IP address infrastructure servers on your network and enables

you to manage them from a central interface.

In this Guide I have focused only on practical Deployment. Hence For more about IPAM and It’s Features, Please visit http://technet.microsoft.com/en-us/library/jj878331.aspx

IPAM’s Key Components

1. Address Space Management (ASM)

2. Multi Server Management & Monitoring (MSM) 3. Network Audit

1. Address Space Management (ASM)

a. ASM enables you to manage all your IP address Infrastructure in a Single Console. b. You can Customize and make Multi Level server Hierarchy of address Space. c. For more about ASM and Features, Please visit

http://technet.microsoft.com/en-us/library/jj878331.aspx

2. Multi Server Management & Monitoring (MSM)

a. MSM is automatically discovering all your DHCP and DNS servers on the network, Monitor service availability, and centrally manage their Configuration.

b. You can use Group policy based and manual Provisioning modes to IPAM Accessing Settings in MSM servers.

c. Group Policy based Provisioning is painless as we are making all settings using group policy, hence no need to anything manually.

d. Manual Method also available and required more manual settings has to be done for Provisioning.

e. For more about MSM and Features, Please visit http://technet.microsoft.com/en-us/library/jj878331.aspx

3. Network Audit

a. IPAM’s Network Audit Component provides centralized Repository for all Configuration changes performed on DHCP Servers and the IPAM Servers.

b. IPAM audit tools enable you to view potential configuration problems on DHCP servers by actively tracking and reporting all administrative actions

c. Detailed IP address tracking data is also provided, including client IP addresses, client ID, host name, and user name. Advanced search capabilities enable you to selectively search for events and obtain results that associate user logons to specific devices and times.

d. For more about Network and Features, Please visit http://technet.microsoft.com/en-us/library/jj878331.aspx

(3)

IPAM Requirements:

Processor  Minimum: 1.4 GHz (x64 processor)

 Recommended: quad-core, 2.66 GHz or faster

Memory  Minimum: 2 GB RAM

 Recommended: 4 GB RAM or greater

OS(IPAM Server)  Server 2012

OS(IP Client)  Server 2012, Windows 8

Disk Space  Minimum: 10 GB

 Recommended: 80 GB or greater*

Active Directory  IPAM Server what you planning to install must be

Domain Joined Host

 You can’t install IPAM on Workgroup Computer  Installing on Domain Controller is not

recommended.

Network  The IPAM server must also have network

connectivity to all servers that are marked as managed in the server inventory.

 IPAM server be configured to provide access to at

least one domain controller and authoritative DNS server

IPAM specifications

IPAM Server has the following specifications:

 The scope of IPAM server discovery is limited to a single Active Directory forest. The forest itself may be comprised

of a mix of trusted and untrusted domains.

 IPAM supports only Microsoft domain controllers, DHCP, DNS, and NPS servers running Windows Server® 2008

and above.

 DHCP operational event auditing is supported for DHCP servers running Windows Server® 2008 R2 and above.  IPAM installation on a DHCP server is not recommended. The IPAM server discovery feature will not be able to

discover DHCP roles if DHCP Server is installed on the same computer.

 IPAM supports only domain joined DHCP, DNS and NPS servers in a single Active Directory forest.  IPAM does not support management and configuration of non-Microsoft network elements.  IPAM does not support external databases. Only a Windows Internal Database is supported.  A single IPAM server can support up to 150 DHCP servers and 500 DNS servers.

 A single IPAM server has been tested to support up to 6000 DHCP scopes and 150 DNS zones.

 IPAM stores 3 years of forensics data (IP address leases, host MAC addresses, user login/logoff information) for

100,000 users in a Windows Internal Database. There is no database purge policy provided, and the administrator must purge data manually as needed.

 IP address utilization trends are provided only for IPv4.  IP address reclaiming support is provided only for IPv4.

 No special processing is done for IPv6 stateless address auto configuration private extensions.  No special processing for virtualization technology or virtual machine migration.

 IPAM does not check for IP address consistency with routers and switches.

 IPAM does not support auditing of IPv6 stateless address auto configuration on an unmanaged machine to track

the user.

 IPAM users must be logged in using domain credentials. Do not log sign in to the IPAM server using the local

Administrator account or another local user account on the IPAM server.

 If you are accessing the IPAM server from a remote IPAM client, you must be a member of the WinRMRemote

WMIUsers group on the IPAM server, in addition to being a member of the appropriate local IPAM security group.

 If the Group Policy based provisioning method is used, users must have domain administrator privileges to mark

(4)

IPAM Architecture

IPAM Server-Client Communication

 The IPAM client communicates with an IPAM server using the Windows Communication

Foundation (WCF) protocol with TCP as the transport method. By default, TCP binding is performed on port 48885 on the IPAM server.

IPAM Communication with Server roles:

 RPC: Remote Procedure Call (Port Number: 135-TCP)

 WMI: Windows Management Instrumentation (Port Number: TCP)  SMB: Session Message Block (Port Number: 445-TCP)

(5)

Domain Controller DHCP

NPS DNS

Monitor: IP address utilization Monitor: Service status Configure: Servers and scopes Audit: IP address lease events Audit: DHCP configuration events

Discover: DNS servers Monitor: DNS zone health Configure: DNS zones

Discover: DNS and DHCP servers Validate: Managed servers Audit: User and device logon events

Audit: User and device logon events RPC, WMI, SMB, WS-Management RPC, WMI, WS-Management RPC RPC RPC, WMI, LDAP RPC, WMI, LDAP

IPAM Deployment Plan:

Normally IPAM can be deployed in three different topologies in Enterprise Environment. 1. Distributed: An IPAM server deployed at every site in the enterprise.

2. Centralized: One IPAM server in the enterprise.

3. Hybrid: A central IPAM server deployed with dedicated IPAM servers at each site.

(6)

TEST LAB

 I have taken 4 Server to test IPAM and my Environment is as mentioned.,

AD Domain:

soft.com

NetBIOS Name: SOFT

Domain functional level: Windows Server 2003 Total User's: 6Total DC's: 2

fsmoPDC: DC-SOFT.SOFT.COM fsmoINFRA: DC-SOFT.SOFT.COM fsmoRID: DC-SOFT.SOFT.COM

krishnan.soft.com

NetBIOS Name: KRISHNAN

Domain functional level: Windows Server 2003 Total User's: 4Total DC's: 1

fsmoPDC: DC1.KRISHNAN.SOFT.COM fsmoINFRA: DC1.KRISHNAN.SOFT.COM fsmoRID: DC1.KRISHNAN.SOFT.COM SOFT><KRI SHNAN KRISHNAN ><SOFT DC-SOFT 6.2 (9200) ADC-SOFT 6.2 (9200) DC1 6.2 (9200) AD Sites:

(7)

Default-First-Site-Name

Total Domain Controllers in Site: 0

IntraSite Topology Generation: Disabled Cleanup: Disabled

Optimizing Edges: Disabled Stale Link Detection: Disabled

InterSite Topology Generation: Disabled

SOFTSITE

Total Domain Controllers in Site: 2 Total Number of Subnets in Site: 1 IntraSite Topology Generation: Disabled Cleanup: Disabled

soft-krishnan

Total Domain Controllers in Site: 1 Total Number of Subnets in Site: 1 IntraSite Topology Generation: Disabled Cleanup: Disabled

DEFAULTIPSITELINK

(Type:IP-Link, Cost:100, Interval:180)

SOFT

(Type:IP-Link, Cost:50, Interval:60) SOFT

SOFT

soft-krishnan

23019598-9a82- 435b-9b13-e36d91a6a56a ccbba8ea-7973- 4acd-8f5d-ebe44e327ec4 192.168.137.0/28 192.168.138.0/28 DC-SOFT.SOFT.COM Global Catalog Server

ADC-SOFT.SOFT.COM Global Catalog Server DC1.KRISHNAN.SOFT.COM

(8)

IPAM Installation:

 IPAM Installed by using Both Server Manager and PowerShell.

I have explained both methods. You can select anyone method best on your interest and Knowledge.

IPAM Installation Using Server Manager: Step 1: Open Server Manager

(9)

Step 3: Select Role-Based of Features-Based installation option

(10)

Step 5: Don’t select the any Server Roles as IPAM is not a Server role (IPAM is maintained under Features of the Server 2012)

(11)

Step 7: Select all Management Tools that are required for IPAM

(12)

IPAM Installation Using PowerShell(PS)

Step 1: Open the Power shell and type the Command: Add-Windows Features ipam –IncludemanagementTools –

Whatif( will let us know that what will be happen if you install)

Step 2: Type the Command Add-Windows Features ipam –IncludemanagementTools and hit enter key to start the

(13)

 Now we have finished the installation of IPAM.IPAM is required some configuration Settings which are highly required to make IPAM Operational.

 There are Six more Additional Configuration steps are required,

1. Connect IPAM Server 2. Provision the IPAM Server 3. Configure Server Discovery 4. Start Server Discovery

5. Select or add Servers to manage and Verify IPAM Access 6. Retrieve data from Managed Servers

1. Connect IPAM Server:

(14)

2. Provision the IPAM Server:

a. Click on Provision the IPAM Server and click Next.

b. Select Group Policy Based Provisioning method and Enter the GPO Name Prefix as IPAM1 There are two types of Provisioning one is Manual which is everything needs to be done manually (It will take lot of time as we need to create GPO and IPAM Groups manually. Group Policy Based is another way which I have selected in my Demo where all will be done automatically using GPO.

(15)

(16)

d. Now we have created GPO but it needs to be invoked to the Domain.

Open PowerShell(PS): Type the Command Invoke-IpamGpoProvsioning –Domain

SOFT.COM –GpoprefixName IPAM1 –IpamServerFqdn win-2012.soft.com and hit enter..

(17)

3. Configure Server Discovery: We have created GPO and Invoked in the Domain: Soft.com. Now we need to Configure Server Discovery.

a. Click on Configure Server Discovery and add the Domains those you want to manage within you Forest.

4. Start Server Discovery: Click on Start Server Discovery once you finished the Configuration. It may take some time it depends on number of servers in the selected Domains.

(18)

(19)

5. Select or Add Servers to Manage and Verify IPAM Access:

a. Click on the Select or Add Servers to Manage and Verify IPAM Access and see the Discovered servers in your Domain. In my Domain I have three Servers and it has been discovered.

(20)

b. Right on Server and go to Edit Server Option and Select Managed under the manageability Status.

c. If you hit OK once selected manage. You will get error message stating that GPO not applied for the Specified Server. Hence we have invoked the GPO for Domain called Soft and Sub Domain

Krishnan but it needs to be applied to the Domain Controllers. Hence that particular server can be managed by using IPAM.

d. Open Group Policy management console. You can open it by using command: GPMC.MSC

e. Go to Group Policy Objects under Forest Soft.com. There will be three GPOs( IPAM1_DC_NPS,

(21)

f. Add Servers which are required to be managed using IPAM under Security Filtering.do the same for all other GPOs of IPAM as well.

(22)

(23)

g. Login to the Individual server and apply the Group Policy and restart the server by using the Command Gpupdate /sync . It can be done using PowerShell from the Server manager where you managing all servers in Central Place(It is also wonderful feature available in Server 2012.That is why I Love Server 2012!!).

h. Below Server which is the centralized server for the entire servers in Soft.com. Right click the server which needs Gpupdate needs to be done for IPAM Manage.

i. Go to PowerShell and give the credentials to login and enter the Command gpupdate /Force. You

(24)

(25)

j. If you want to apply the settings in otherway, You can login to the perticular servers and apply the settings.

(26)

k. Now we finished the all the configurations for managed Servers. Now it is ready to retrieve all the data related to DHCP Scopes, IP Ranges, IP Blocks, DNS and NPS server detail.

l. Click on Retrieve Data from Managed Servers. It will take more time based on your servers in Domain.

(27)

That is all the IPAM Server Installation, Configuration and Apply Settings. You can see all the DHCP, DNS server Details with Available Scopes and its Utilization in the IPAM. No need to go to individual servers to Create/Delete/Modify/Reserve the Scopes/ IP address in centralized place called IPAM.