Editing GSTN - Directory services DNS PRINT DHCP (section)

== The Servers: ==

<div style="color:#00000a;">Primary IP address: 172.18.101.12</div>

<div style="color:#00000a;">Secondary IP address: 172.18.101.13</div>


'''How HA is working?'''


<div style="color:#00000a;">With DHCP failover, DHCPv4 scopes can be replicated from a primary DHCP server to a secondary DHCP server, enabling redundancy and load balancing of DHCP services.</div>


<div style="color:#00000a;">Both server are configured in HA. Given below the configuration file of both DHCP servers. They communicate on port number 519 and 520 as defined in dhcpd.conf file.</div>

'''Primary DHCP server:'''

<div style="color:#00000a;"><nowiki># Failover specific configurations</nowiki></div>

''[root@gd9101 ~]# cat /etc/dhcp/dhcpd.conf''

<div style="color:#00000a;">ddns-update-style none;</div>

<div style="color:#00000a;">one-lease-per-client true;</div>

<div style="color:#00000a;">option domain-name "gstn.local";</div>

<div style="color:#00000a;">option domain-name-servers 172.18.101.14, 172.18.101.15;</div>

<div style="color:#00000a;">default-lease-time 28800;</div>

<div style="color:#00000a;">max-lease-time 288000;</div>

<div style="color:#00000a;">lease-file-name "/var/log/dhcpd/dhcpd.leases";</div>

<div style="color:#00000a;">authoritative;</div>

<div style="color:#00000a;">log-facility local5;</div>

<div style="color:#00000a;">option option-242 code 242 = string;</div>

<div style="color:#00000a;">failover peer "dhcp" {</div>

<div style="color:#00000a;">primary;</div>

<div style="color:#00000a;">address 172.18.101.12;</div>

<div style="color:#00000a;">port 519;</div>

<div style="color:#00000a;">peer address 172.18.101.13;</div>

<div style="color:#00000a;">peer port 520;</div>

<div style="color:#00000a;">max-response-delay 60;</div>

<div style="color:#00000a;">max-unacked-updates 10;</div>

<div style="color:#00000a;">mclt 600;</div>

<div style="color:#00000a;">split 128;</div>

<div style="color:#00000a;">load balance max seconds 3;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">include "/etc/dhcpd.master";</div>

<div style="color:#00000a;"><nowiki>==============================================================</nowiki></div>

'''Secondary Server:'''

<div style="color:#00000a;"><nowiki># Failover specific configurations</nowiki></div>

''[root@gd9102 ~]# cat /etc/dhcp/dhcpd.conf''

<div style="color:#00000a;">ddns-update-style none;</div>

<div style="color:#00000a;">one-lease-per-client true;</div>

<div style="color:#00000a;">option domain-name "gstn.local";</div>

<div style="color:#00000a;">option domain-name-servers 172.18.101.14, 172.18.101.15;</div>

<div style="color:#00000a;">default-lease-time 28800;</div>

<div style="color:#00000a;">max-lease-time 288000;</div>

<div style="color:#00000a;">lease-file-name "/var/log/dhcpd/dhcpd.leases";</div>

<div style="color:#00000a;">authoritative;</div>

<div style="color:#00000a;">log-facility local5;</div>

<div style="color:#00000a;">option option-242 code 242 = string;</div>

<div style="color:#00000a;">failover peer "dhcp" {</div>

<div style="color:#00000a;">secondary;</div>

<div style="color:#00000a;">address 172.18.101.13;</div>

<div style="color:#00000a;">port 520;</div>

<div style="color:#00000a;">peer address 172.18.101.12;</div>

<div style="color:#00000a;">peer port 519;</div>

<div style="color:#00000a;">max-response-delay 60;</div>

<div style="color:#00000a;">max-unacked-updates 10;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">include "/etc/dhcpd.master";</div>


<div style="color:#00000a;"><nowiki>=============================================================</nowiki></div>


<div style="color:#00000a;">When two DHCP servers are configured for failover, they will share scope information, including all active leases. This enables both DHCP servers to provide leases to the same subnet for load balancing or redundancy purposes. Scope settings are replicated when you first configure DHCP failover, and can be replicated again later if configuration changes are made. </div>


<div style="color:#00000a;">To take advantage of failover, we need to create a pool. We have created pools in '''"/etc/dhcpd.master"''' on both servers as shown below:</div>


'''Primary Server:'''

<div style="color:#00000a;">Output of "'''/etc/dhcpd.master'''"</div>

<div style="color:#00000a;">subnet 172.18.101.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.101.216 172.18.101.217;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.101.1;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">shared-network data {</div>

<div style="color:#00000a;">subnet 172.18.5.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool { </div>

<div style="color:#00000a;">failover peer "dhcp"; </div>

<div style="color:#00000a;">range 172.18.5.51 172.18.5.240;</div>


<div style="color:#00000a;">} </div>

<div style="color:#00000a;">option routers 172.18.5.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.5.255;</div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">shared-network voice {</div>

<div style="color:#00000a;">subnet 172.18.2.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool { </div>

<div style="color:#00000a;">failover peer "dhcp"; </div>

<div style="color:#00000a;">range 172.18.2.51 172.18.2.240;</div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">option routers 172.18.2.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.2.255;</div>

<div style="color:#00000a;">option option-242 "MCIPADD=172.18.102.16,MCPORT=1719,HTTPSRVR=172.18.102.16";</div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.3.32 netmask 255.255.255.224 { </div>

<div style="color:#00000a;">pool { </div>

<div style="color:#00000a;">failover peer "dhcp"; </div>

<div style="color:#00000a;">range 172.18.3.41 172.18.3.62; </div>

<div style="color:#00000a;">deny dynamic bootp clients; </div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">option routers 172.18.3.33;</div>

<div style="color:#00000a;">option broadcast-address 172.18.3.63;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.4.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.4.51 172.18.4.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.4.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.4.255;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.6.0 netmask 255.255.255.192 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.6.21 172.18.6.62;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.6.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.6.63;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.7.0 netmask 255.255.255.224 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.7.11 172.18.7.30;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.7.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.7.31;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.8.0 netmask 255.255.255.224 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.8.11 172.18.8.30;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">option routers 172.18.8.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.8.31;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.10.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.10.51 172.18.10.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.10.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.10.255;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.11.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.11.51 172.18.11.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.11.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.11.255;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.12.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">option broadcast-address 172.18.12.255;</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.12.51 172.18.12.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">option routers 172.18.12.1;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">shared-network gd-soft {</div>

<div style="color:#00000a;">subnet 172.18.16.0 netmask 255.255.255.192 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.16.11 172.18.16.62;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.16.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.16.63;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.20.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">option broadcast-address 172.18.20.255;</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.20.51 172.18.20.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.20.1;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.21.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">option broadcast-address 172.18.21.255;</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.21.51 172.18.21.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.21.1;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"><nowiki>=================================================================== </nowiki></div>


<div style="color:#00000a;">'''Seconday Server''':</div>

<div style="color:#00000a;">Output of "/etc/dhcpd.master"</div>


<div style="color:#00000a;">subnet 172.18.101.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.101.216 172.18.101.217;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.101.1;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">shared-network data {</div>

<div style="color:#00000a;">subnet 172.18.5.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool { </div>

<div style="color:#00000a;">failover peer "dhcp"; </div>

<div style="color:#00000a;">range 172.18.5.51 172.18.5.240;</div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">option routers 172.18.5.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.5.255;</div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"></div>

<div style="color:#00000a;"></div>

<div style="color:#00000a;">shared-network voice {</div>

<div style="color:#00000a;">subnet 172.18.2.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool { </div>

<div style="color:#00000a;">failover peer "dhcp"; </div>

<div style="color:#00000a;">range 172.18.2.51 172.18.2.240;</div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">option routers 172.18.2.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.2.255;</div>

<div style="color:#00000a;">option option-242 "MCIPADD=172.18.102.16,MCPORT=1719,HTTPSRVR=172.18.102.16";</div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.3.32 netmask 255.255.255.224 { </div>

<div style="color:#00000a;">pool { </div>

<div style="color:#00000a;">failover peer "dhcp"; </div>

<div style="color:#00000a;">range 172.18.3.41 172.18.3.62; </div>

<div style="color:#00000a;">deny dynamic bootp clients; </div>

<div style="color:#00000a;">} </div>

<div style="color:#00000a;">option routers 172.18.3.33;</div>

<div style="color:#00000a;">option broadcast-address 172.18.3.63;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.4.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.4.51 172.18.4.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">option routers 172.18.4.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.4.255;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.6.0 netmask 255.255.255.192 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.6.21 172.18.6.62;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.6.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.6.63;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet 172.18.7.0 netmask 255.255.255.224 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.7.11 172.18.7.30;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.7.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.7.31;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.8.0 netmask 255.255.255.224 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.8.11 172.18.8.30;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">option routers 172.18.8.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.8.31;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.10.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.10.51 172.18.10.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.10.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.10.255;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.11.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.11.51 172.18.11.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">option routers 172.18.11.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.11.255;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.12.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">option broadcast-address 172.18.12.255;</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>


<div style="color:#00000a;">range 172.18.12.51 172.18.12.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.12.1;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">shared-network gd-soft {</div>

<div style="color:#00000a;">subnet 172.18.16.0 netmask 255.255.255.192 {</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.16.11 172.18.16.62;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.16.1;</div>

<div style="color:#00000a;">option broadcast-address 172.18.16.63;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet 172.18.20.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">option broadcast-address 172.18.20.255;</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.20.51 172.18.20.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.20.1;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"></div>

<div style="color:#00000a;"></div>

<div style="color:#00000a;">subnet 172.18.21.0 netmask 255.255.255.0 {</div>

<div style="color:#00000a;">option broadcast-address 172.18.21.255;</div>

<div style="color:#00000a;">pool {</div>

<div style="color:#00000a;">failover peer "dhcp";</div>

<div style="color:#00000a;">range 172.18.21.51 172.18.21.240;</div>

<div style="color:#00000a;">deny dynamic bootp clients;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">option routers 172.18.21.1;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"></div>

<div style="color:#00000a;"></div>

<div style="color:#00000a;"><nowiki>=====================================================================</nowiki></div>

<div style="color:#00000a;">'''DHCP6 Configuration in HA''':</div>


<div style="color:#00000a;">In DHCPv6, the half of ipv6 range is given in Primary server and rest half of the ipv6 range is given in secondary server.</div>

<div style="color:#00000a;">For example:</div>

<div style="color:#00000a;">IPv6 range on primary server for below range is from </div>

<div style="color:#00000a;">range6 2404:a800:1000:d:2000::b 2404:a800:1000:d:2000::85</div>


<div style="color:#00000a;">and on secondary server it is from</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:2000::88 2404:a800:1000:d:2000::100</div>


<div style="color:#00000a;">'''Primary Server''': </div>

<div style="color:#00000a;">DHCPv6 configuration file:</div>

''vi /etc/dhcp/dhcpd6.conf''




<div style="color:#00000a;"></div>

<div style="color:#00000a;">default-lease-time 28800;</div>

<div style="color:#00000a;">preferred-lifetime 28800;</div>

<div style="color:#00000a;">option dhcp-renewal-time 3600;</div>

<div style="color:#00000a;">option dhcp-rebinding-time 7200;</div>

<div style="color:#00000a;">allow leasequery;</div>

<div style="color:#00000a;">option dhcp6.name-servers 2404:a800:1000:d:7800::e, 2404:a800:1000:d:7800::f;</div>

<div style="color:#00000a;">option dhcp6.domain-search "gstn.local";</div>

<div style="color:#00000a;"><nowiki>##option dhcp6.preference 255;</nowiki></div>

<div style="color:#00000a;"><nowiki>##option dhcp6.rapid-commit;</nowiki></div>

<div style="color:#00000a;">option dhcp6.info-refresh-time 2160;</div>

<div style="color:#00000a;">dhcpv6-lease-file-name "/var/lib/dhcpd/dhcpd6.leases";</div>

<div style="color:#00000a;">subnet6 2404:a800:1000:d:7800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:7800::90 2404:a800:1000:d:7800::91;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:2000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:2000::b 2404:a800:1000:d:2000::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:0800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:800::b 2404:a800:1000:d:800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:1800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:1800::b 2404:a800:1000:d:1800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:2800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:2800::b 2404:a800:1000:d:2800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"></div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:3000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:3000::b 2404:a800:1000:d:3000::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:3800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:3800::b 2404:a800:1000:d:3800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:4800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:4800::b 2404:a800:1000:d:4800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:5000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:5000::b 2404:a800:1000:d:5000::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:5800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:5800::b 2404:a800:1000:d:5800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:6000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:6000::b 2404:a800:1000:d:6000::85;</div>


<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:6800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:6800::b 2404:a800:1000:d:6800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"></div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:b800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:b800::b 2404:a800:1000:d:b800::85;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">'''Secondary Server''':</div>


<div style="color:#00000a;">DHCPv6 configuration file:</div>

''vi /etc/dhcp/dhcpd6.conf''


<div style="color:#00000a;">default-lease-time 28800;</div>

<div style="color:#00000a;">preferred-lifetime 28800;</div>

<div style="color:#00000a;">option dhcp-renewal-time 3600;</div>

<div style="color:#00000a;">option dhcp-rebinding-time 7200;</div>

<div style="color:#00000a;">allow leasequery;</div>

<div style="color:#00000a;">option dhcp6.name-servers 2404:a800:1000:d:7800::e, 2404:a800:1000:d:7800::f;</div>

<div style="color:#00000a;">option dhcp6.domain-search "gstn.local";</div>

<div style="color:#00000a;"><nowiki>##option dhcp6.preference 255;</nowiki></div>

<div style="color:#00000a;"><nowiki>##option dhcp6.rapid-commit;</nowiki></div>

<div style="color:#00000a;">option dhcp6.info-refresh-time 2160;</div>

<div style="color:#00000a;">dhcpv6-lease-file-name "/var/lib/dhcpd/dhcpd6.leases";</div>

<div style="color:#00000a;">subnet6 2404:a800:1000:d:7800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:7800::92 2404:a800:1000:d:7800::93;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:2000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:2000::88 2404:a800:1000:d:2000::98;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:0800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:800::88 2404:a800:1000:d:800::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"></div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:1800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:1800::88 2404:a800:1000:d:1800::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:2800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:2800::88 2404:a800:1000:d:2800::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:3000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:3000::88 2404:a800:1000:d:3000::100;</div>

<div style="color:#00000a;">}</div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:3800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:3800::88 2404:a800:1000:d:3800::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:4800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:4800::88 2404:a800:1000:d:4800::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:5000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:5000::88 2404:a800:1000:d:5000::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:5800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:5800::88 2404:a800:1000:d:5800::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;"></div>

<div style="color:#00000a;"></div>

<div style="color:#00000a;">subnet6 2404:a800:1000:000d:6000::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:6000::88 2404:a800:1000:d:6000::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:6800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:6800::88 2404:a800:1000:d:6800::100;</div>

<div style="color:#00000a;">}</div>


<div style="color:#00000a;">subnet6 2404:a800:1000:000d:b800::/69 {</div>

<div style="color:#00000a;">range6 2404:a800:1000:d:b800::88 2404:a800:1000:d:b800::100;</div>

<div style="color:#00000a;">}</div>




<div style="color:#00000a;">In HA, DHCP servers are in continuos syncronization with each other. You can get it from /var/log/messages file of DHCP server.</div>


# 
## '''Active Directory via SAMBA4'''



Samba AD DC Features* LDAP
* Kerberos
* X.500 complaint
* Windows Domain Controller
* Centralized Identity Management Server
* Authentication
* Authorization
* SMB / SMB2 / CIFS
* Windows machines join AD natively
* Ipv4 and Ipv6 ready
* SSL over TCP as the Transporting Protocol ( [https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_(LDAPS)_on_a_Samba_AD_DC https://wiki.samba.org/index.php/Configuring_LDAP_over_SSL_%28LDAPS%29_on_a_Samba_AD_DC] )
* 7 FSMO roles
** PDC Emulator
** RID Master
** Schema Master
** Domain Naming Master
** Infrastructure Master
** Domain DNS Zone Master role
** Forest DNS Zone Master role



At GSTN , AD and ADC will be implemented# 
## 
### '''Forest and Domain design'''



Considering the Need of GSTN , there is no need to have Multi forest or Multi domain . There will be a single forest with a single domain as “GSTN.local” .

Environment will have one domain controller in a domain and additional domain controllers to the domain is added to improve the availability and reliability of network services. Adding additional domain controllers can help provide fault tolerance, balance the load of existing domain controllers, and provide additional infrastructure support to sites. More than one domain controller in a domain makes it possible for the domain to continue to function if a domain controller fails or must be disconnected. Multiple domain controllers can also improve performance by making it easier for clients to connect to a domain controller when logging on to the network.

[[Image:GSTNDIRECTORY21.png]]






<div style="color:#00000a;"></div>

Distribution of FSMO roles for Active Directory DC and Addition DC will be

Active Directory DC* 
** PDC Emulator
** RID Master
** Schema Master
** Domain Naming Master
** Infrastructure Master
** Domain DNS Zone Master role
** Forest DNS Zone Master role



Below screen shot shows the 7 fsmo roles on PDC.

[[Image:GSTNDIRECTORY22.png]]

There is no FSMO roles on ADC.


In case of DC failure the ADC needs to be promoted as DC .# 
## 
### '''Time Synchronization'''



Time synchronization design and setup are very important for an Active Directory environment. This is because time synchronization issues lead to Kerberos authentication failures once the maximum tolerance for computer clock synchronization (By default is five (5) minutes) is exceeded.

We have 2 NTP servers running on RHEL for the time synchronization purpose . Active directory will update time or synchronize time from these NTP servers.


























NTP configuration done on PDC as in below screen shot. 

[[Image:GSTNDIRECTORY23.png]]


We have created NTP policy, all client computers will sync the time from AD only.

[[Image:GSTNDIRECTORY24.png]]


# 
## 
### '''AD Group Policies'''



Group Policy

The guiding principle for Group Policy design is OU design and IT administrative model and together they form the below benefits* To enable delegation of administration
* To scope the application of Group Policy Objects



While designing the group policy the required consideration from key stake holders and best practices are consulted.

Group Policy settings are passed from parent containers down to child containers. This means that a policy that is applied to a parent container applies to all the containers including users and computers that are below the parent containers in the Active directory tree hierarchy.

However if you specifically assign a group policy for a child container that contradicts the parent container policy, the child container’s policy overrides the parent group policy. If policies are not contradictory, both are implemented. Group Policies are processed in the following order:


* Local Group policy
* Site Group Policy
* Domain Group Policy
* Organizational unit Group Policy





[[Image:GSTNDIRECTORY25.png]]

We are selecting No Override option at GSTN so that child containers cannot override any policy setting set by higher level GPO. This option is not turned on by default and must be turned on in each GPO where it’s wanted.

In Addition with Default Domain and Domain Controller policy will apply set of CIS (Center for Internet Security) recommended policy for Active Directory like Account, Audit, Security, Interactive Login, Event Log Settings, Network Services, Network Access, User Account Control etc for GSTN.


<span style="background-color:#ffff00;">Please Note the AD Based policies will only be Applicable for Windows based environments and its components. These policies will not be applicable any of Linux environment and its components</span>.# 
## 
### '''Accounts Policy'''



Account policies control password restrictions and account lockouts and help protecting the system from unauthorized access. Account policies apply to all user accounts at the same time locally or domain-wide, depend on the scope where the policy is defined.



{| style="border-spacing:0;width:14.605cm;"
|- style="background-color:#ffffff;border:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Account Policy
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Account lockout threshold' to '7 invalid logon attempt(s)'
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Account lockout duration' to '10 or more minute(s)'
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Reset account lockout counter after' to '10 minute(s)'
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Minimum password length' to '8 or more character(s)'
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Enforce password history' to '24 or more password(s)
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Password must meet complexity requirements' to 'Enabled'
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Store passwords using reversible encryption' to 'Disabled
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Minimum password age' to '1 or more day(s)'
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Set 'Maximum password age' to '30 or fewer days'
|-
|}


Below screen shot is showing password policy which has been defined.

<div style="margin-left:0cm;margin-right:0cm;">[[Image:GSTNDIRECTORY26.png]]</div># 
## 
### {{anchor|RefHeading2653241649886}} '''Audit Policy'''



Auditing enhancements in Active Directory support the needs of IT Admins of Windows environments who are responsible for implementing, maintaining, and monitoring the ongoing security of an organization's Windows related physical and information assets.


These settings can help administrators to get answers of following:


Who is accessing our assets?

What assets are they accessing?

When and where did they access them?

How did they obtain access?


'''Advanced Audit Policies '''



{| style="border-spacing:0;width:14.605cm;"
|- style="background-color:#ffffff;border:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| '''Account Management'''
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit Computer Account Management “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit User Account Management “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| '''Logon/Logoff'''
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit Account Lockout “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit User / Device Claims “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit logoff “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit Logon “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit Other Logon/Logoff Events “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| '''Policy Change'''
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit Audit Policy Change “Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| Audit Authentication Policy Change Success”
|- style="background-color:#ffffff;border-top:none;border-bottom:0.5pt solid #000000;border-left:0.5pt solid #000000;border-right:0.5pt solid #000000;padding-top:0cm;padding-bottom:0cm;padding-left:0.182cm;padding-right:0.191cm;"
|| 
|-
|}




[[Image:GSTNDIRECTORY27.png]]




















<div style="color:#00000a;">'''SAMBA SECONDARY DOMAIN CONTROLLER'''</div>

<div style="color:#00000a;">With a Primary Domain Controller (PDC) on the network it is best to have a Backup Domain Controller (BDC) as well. This will allow clients to authenticate in case the PDC becomes unavailable. Adding further DCs, will provide failure safety, high availability and load balancing. </div>

[[Image:GSTNDIRECTORY28.png]]




'''Rsysnc based SysVol replication.'''

Samba AD currently doesn't provide support for SysVol replication. To achive this important feature in a Multi-DC environment, until it's implemented, workarounds are necessary to keep it in sync. This HowTo provides a basic workaround solution based on rsync.

This tool is unidirectional, this means files can only be transferred in one direction. That's why for rsync-based SysVol replication, you have to choose one DC on which you do all modifications like GPO edits, logon script changes, etc. A good choice for this "master" host is the one that contains the FSMO roles. All other DC's retrieve the changes from this host, this is because modifications on them are overwritten when syncing. 


'''1. Setup SysVol replication:'''

a. Install rsync on the pdc by runing below command.

<nowiki># yum install rsync</nowiki>

Open '''/etc/rsyncd.conf '''file and make below entries.


[SysVol]

path = /usr/local/samba/var/locks/sysvol/

comment = Samba Sysvol Share

uid = root

gid = root

read only = yes

auth users = sysvol-replication

secrets file = /usr/local/samba/etc/rsyncd.secret


Create a file '''/usr/local/samba/etc/rsyncd.secret'''.

''<nowiki># vi /usr/local/samba/etc/rsyncd.secret</nowiki>''

Make below entry in '''rsyncd.secret''' file.

sysvol-replication:Pa$$w0rD

and set 600 permission on this file.

<nowiki>#</nowiki>'' chmod 600 /usr/local/samba/etc/rsyncd.secret''

Restart rsyncd services.

''<nowiki># systemctl restart rsyncd.service</nowiki>''

Setup on secondary Domain Controller 

a. Install rsync on the adc by runing below command.

''<nowiki># yum install rsync</nowiki>''

Create a password file /usr/local/samba/etc/rsync-sysvol.secret. 

''<nowiki># vi /usr/local/samba/etc/rsync-sysvol.secret</nowiki>''


Fill it with the password you set on the PDC for the sysvol-replication rsync account.

''Pa$$w0rD''

Set 600 permission on this file and restart rsync service.

''<nowiki># chmod 600 /usr/local/samba/etc/rsyncd.secret</nowiki>''

''<nowiki># systemctl restart rsyncd.service</nowiki>''


For replicating the SysVol folder, run the following command (--dry-run means that no modifications are actually made):


''<nowiki># /usr/bin/rsync --dry-run -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/</nowiki>''


If everything looks sane, run the command without the --dry-run option and let rsync do the replication.

To automate synchronisation, run the command via cron.


''<nowiki># */2 * * * * /usr/bin/rsync -XAavz --delete-after --password-file=/usr/local/samba/etc/rsync-sysvol.secret rsync://sysvol-replication@172.18.101.14/SysVol/ /usr/local/samba/var/locks/sysvol/</nowiki>''


[[Image:GSTNDIRECTORY29.png]]