What You Need to Know About DHCP to Pass a Microsoft Exam
When considering the main infrastructure servers within a Microsoft network, it is often considered that the DHCP server is the easiest and most straight forward to configure. At the end of the day it just gives out the IP addresses, right? That’s not too hard to understand! Well to summarise the role of a DHCP server in ten words or less that about covers it, but in reality there is much to its role in a Microsoft network than that.
Within the context of the Microsoft certification exams, the DHCP server is one of the first infrastructure server roles you learn, and this isn’t because it is easy but because it is the first port of call for your connecting client’s computers and devices to access the rest of your network infrastructure. As a result, Microsoft expects you to have a solid understanding of how the DHCP server works, the options that it provides, and the granular knowledge required to troubleshoot the DHCP server role when it fails to work correctly. It is guaranteed that you will face exam questions related to DHCP while pursuing your Microsoft networking certification path; so in order to confirm you have all the areas covered, this checklist below provides a summary of what you will need to know about DHCP in order to pass a Microsoft networking exam.
How the DHCP process works
The first key element of the DHCP server is that it operates using network broadcasts to make the client connection possible. When a client computer is first added to the network it sends out a Discovery broadcast message, the server then sends an Offer message(containing an IP), and the client returns with a Request message, which the server follows up with an Acknowledgement message to approve the lease to the client computer. This is sometimes known as the DORA sequence, which also makes it a bit easier to recall the order. If you want to see this first hand, add a computer to the network with an enabled DHCP server and run the network monitor to capture the traffic. You can see the process above taking place as the client computer receives the requested IP addressing details. In the context of the Microsoft infrastructure exams, you are unlikely to go into the detail of looking at the specific packet headers at each sequence stage within a network monitor capture; however, they are worth a look.
Within the headers are the fine details, such as the DHCP server involved, the requesting client, the IP address given, and the lease time of the IP (lease time is discussed in more detail later). The headers also include DHCP Negative Acknowledgement messages (NACK), which are displayed when a client has failed to obtain an IP lease from the DHCP. Troubleshooting DNS is discussed more later; however, reasons for why you may fail to obtain an IP address are covered throughout. When the client receives a DHCP NACK, it begins the discovery process again until an IP is obtained.
Inevitably, you will come across the Microsoft APIPA IP address range if a DHCP server IP fails to be obtained. Microsoft always like to shoe-horn this feature into their client exams, as it is a purely Microsoft concept. The APIPA range is designed to allow clients to communicate on a network if no other DHCP service is available. However, it is often pointless in a live environment when all of your infrastructure servers and routers are on separate subnets. Make sure you understand why and when APIPA comes into action, its limitations, its possible benefits, and the IP range it uses in the form of 169.254.0.0/16.
The DHCP server setup
As I have stated in previous articles, the importance of getting hands-on practice with the actual server operating system you are studying is a key study element. Trial copies of the Microsoft standard server operating systems are available for download from Microsoft’s website, and they contain the infrastructure roles mentioned here too. In the case of DHCP server practice, installing Microsoft’s network monitor or Wireshark to see the network messages first hand would be very beneficial, especially in the troubleshooting topics.
Microsoft covers the role of a DHCP server in both capacities as a standalone server or as an authorized domain server. Primarily, you will be configuring an authorized domain DHCP server, which once you have installed via the additional roles feature will allow you to begin setting up your first DHCP scope. It is worth mentioning that if you install a DHCP server within your active directory domain and don’t authorise it then it will fail to hand out IP addresses until you have. If you are running a standalone server then authorisation isn’t needed, however if you do bring an Active directory domain online then the DHCP server will realise it’s not authorized on the domain and shut itself off until it is. Also note that the enterprise administrator’s role is required for DHCP server authorisation.
Finally we can now talk about setting up “scopes.” The term “scope” is the collective name for the IP address range you are setting up with the associated options and settings. Make sure you get plenty of practice with the new scope setup wizard and the options within it. There are two schools of thought in regards to settings this up: for example, you can enter an entire IP range and then in the next window enter the IP ranges within it to be excluded (not broadcast for client use). Alternatively, you can just specify the IP address range of IP addresses you wish to be issued, and enter the other specific addresses for the default gateway and DNS server as needed. In terms of the exam, always go for the former as the best practice method for setting up an IP range.
As you proceed through the new scope wizard, you are prompted to fill in the minimum options required, such as the default gateway, DNS, and domain name details, which are to be issued to the client computer. I will cover the more detailed options later, along with DHCP classes.
Before activating your scope, you must set the lease time of your IP address leases. This defines how long a client has an IP address before the server sends out the NACK message and the client computer begins the DORA process again to obtain a fresh lease. Once your scope is set up, you can begin issuing IP addresses to your clients. Make sure you are familiar with the DHCP server console now that it is setup. You can see the leases you have issued, the excluded IP range, and the options set at each level.
The Microsoft exam is likely to cover a failover strategy called the 80/20 rule. This is where two DHCP servers exist with the same IP range but with 80% of the scopes IP addresses on one server with 20% excluded and then 20% of the scope addresses on one server with 80% excluded. Should one of the servers fail to function, the alternate server would take its place and continue assigning IP addresses.
The use of superscopes is a commonly-asked exam question, usually in a scenario where a single network has out grown out of its current subnet range. You simply create another scope on your DHCP server and create a superscope, thereby doubling the IP addresses available. You should also know when superscopes can be used over two separate networks. As mentioned earlier, the DHCP relies on the use of broadcasting in order to process a client computer request for an IP address. When you are using a DHCP server over two networks, you are restricted by the router as they don’t allow broadcasting communications. This is when you would enable DHCP relay on the router to allow the DHCP server to service IP requests from the clients in the other subnet. It is pretty much the only RFC reference I ever remember, but DHCP relay is RFC 1532 compliant and is supported by most—if not all—router vendors. And in fact, whenever it is discussed in the Microsoft exams, it is usually configured on a RAS server, which is usually part of the same infrastructure exam, so you can see how this is enabled.
Options, Classes and reservations
There are a large number of configurable options within a HDCP server, and each one is listed in the options window with its own individual code number (for example, 006 is DNS server). The main ones to know for the exam are as follows:
- 003-default gateway (router)
- 006-DNS server
- 044 and 046-WINS and NetBT
- 051-lease time
- 015-Domain name
- 066-TFTP server
Another consideration is how these options apply themselves. Server rules are applied first, then these are superseded by the scope options, which are in turn superseded by the reservation options.
Reservations are a handy feature, very much a carryover from the BOOTP era. The client computer can be specified by its MAC address so that it picks up a specific IP address on every start up from the DHCP server without static configuration. This is useful for network printers, or perhaps ensuring a group of computers receive a different default gateway setting to the rest of the network. This is likely to come up on an exam, with a common question often being the correct way to enter the MAC address into the reservation dialog box (no colons and it is not case sensitive).
Another way of defining whether a specific sub set of IP addresses has different options applied to the rest of the scope is to set this up using user and vendor classes. In short, vendor classes are defined by the joining systems themselves: it’s built in to the system. User classes are used to define what options are actually applied to the computer. From here you can view the pre-defined user classes; the main one in terms of examination questions is the default routing and remote access class, usually in the context of keeping the lease time down on potentially short-term connections using option 051-lease time. Furthermore, you can set up pre-defined user classes to configure client computers with a subset of options, as mentioned above. Make sure you know how to set up a new user-defined class and how the ipconfig /setclassid command is used to assign it.
DHCP and DNS
In the server properties dialog box, there is a tab dedicated to the DNS options available to DHCP clients, with consideration for the legacy operating systems who are too old to know what dynamic DNS and as result don’t have the ability to update DNS records as required.
To summarize, DNS is the practice of matching hostnames to IP addresses for name resolution on a network. When a DHCP server issues IP addresses to clients, some of whom might be remote clients or clients with short term leases, there needs to be a system in place to ensure the DNS database stays current and up to date. It terms of legacy clients, you need to know why and how to enable dynamic DNS registrations on their behalf. It is also likely that you will get a Microsoft exam question related to a scenario in a mixed environment containing NT 4 computers that don’t have the ability to update their own DNS registrations, so you would enable this on the DHCP server.
Also know the relevance of the DNSUpdateProxy group. This handy group allows for DHCP servers to create resource records on the client’s behalf without any security settings, therefore allowing client computers to adjust them and take ownership of them when needed. This is particularly useful if you need to replace your DHCP server, when your previous DHCP would have been authoritative for the records it registered.
Migrating, backing up and compressing
As is the case with any database structure, it is best practice to back it up on a regular basis and also perform a bit of routine maintenance. The DHCP server supports automatic (of the database every hour) and manual backup (through the NT console). Make sure you know the difference between the two and which parts of the DHCP are backed up in each. In reality, the process of backing up the server is the same as migrating it; however, when migrating, you need to remember to stop the DHCP service on the source server so that no new IP leases are given out when the destination server is started. It is Microsoft best practice to enable conflict detection on the destination server to pick any accidental leases which may have occurred. There are also some handy command line tools (which I will mention later) that allow you to get all of the relevant information needed to restore your DHCP server to full health.
Make sure you know the reasons behind the jetpack.exe tool and the syntax required to carry it out. This can be a useful tool if your databases have expanded beyond 30mb, which might seem ridiculously small database size to worry about; but this is when you are likely to start seeing errors occurring.
Common command line tools
There are a number of very useful tools that you can use to manage and troubleshoot DHCP. The main ones from an exam point of view seem to be ipconfig and netsh (net shell):
- Netsh dhcp show server—This displays all of the authorized DHCP servers on your active directory domain.
- Netsh dhcp server dump (> DHCPdump.txt) to output all of your DHCP server settings.
- Ipconfig /all—displays all of your installed network interface card details, including whether or not they were supplied via a DHCP server and which DHCP server was used to supply them
- IPconfig /release and /renew—Commonly used together if you wish to release your current leased IP and then begin the discovery process to obtain a new lease. This is usually an alternative to restarting a client PC to renew the lease.
- IPconfig /set class id and /show class id—As explained above, these must be run on all client PCs that are assigned to a different class id than the default.
- Ping—Always a go-to tool for testing connectivity with other devices on the network.
- DHCPloc .exe—This tool is used to discover rogue DHCP servers on the network that are not authorized to issue IP address leases within active directory.
- Getmac—used to obtain client MAC address information, which is useful for setting up client reservations.
I could go on about the use the netsh command, as you can configure an entire DHCP server using it. However, in terms of your Microsoft exam preparation, just be aware of some of the core switches DHCP uses and how they can aid troubleshooting.
Troubleshooting DHCP
Along with the command line tools explained above, you will also be required to troubleshoot any network issues related to DHCP using logging, network monitoring, and a bit of old-fashioned common sense.
You can enable audit logging on the DHCP server through the DHCP server properties. By enabling audit logging, you can view the server activity over a seven-day period. Make sure you know where to go to enable it, and where the audit logs are kept (C:\Windows\system32\DHCP). You should also know that all of the log files and database paths are adjustable through the server properties dialog box. I wouldn’t be too concerned with remembering every DHCP log code number within the DHCP server log, but familiarize yourself with the output, as a sample output could well turn up in a DHCP troubleshooting question.
The trusty event viewer is a good place to find information on the DHCP server; this includes when the service won’t start due to authorization errors, conflict detection, and any errors detected when you are reconciling your DHCP database to resolve database errors.
I’m not sure if this should have waited till last, but one of the common questions Microsoft like to raise in regards to the initial setup of a DHCP server is ensuring the DHCP server is assigned a static IP address. In short, it can’t assign one to itself dynamically; that would involve talking to itself, which is never right!
In a Microsoft environment, the DHCP server is the last hurdle that can make or break your network in terms of allowing your clients to access the network infrastructure you have worked so hard to put in place. It really is a useful tool, and when (within Microsoft best practice) you can use it to automate your IP assignment, you should. Making sure you have the DHCP server knowledge down for the Microsoft exam will also prove equally useful in the real world too.