Добавил:

Upload Опубликованный материал нарушает ваши авторские права? Сообщите нам.

Вуз:

Алматинский университет энергетики и связи

Предмет:

[НЕСОРТИРОВАННОЕ]

Файл:

20411B-ENU-TrainerHandbook

.pdf

Скачиваний:

237

Добавлен:

01.05.2015

Размер:

16.48 Mб

Скачать

☆

<<< < Предыдущая 15 16 17 18 19 20 21 22 23 24 25 2627 / 5327 28 29 30 31 32 33 34 35 36 37 38 39 > Следующая >>>

Administering Windows Server® 2012 7-49

3. Create required DNS records by performing the following steps:
a.	Open the DNS Manager console, and then create new host records with the following settings:MCT
		Name: nls		USE
			IP Address: 172.16.0.21
		Name: crl
			IP Address: 172.16.0.1

b.	Close the DNS Manager console.			ONLY
4. Remove ISATAP from the DNS global query block list by performing the following steps:
a.	Open a command prompt window, type the following command, and then press Enter:
		dnscmd /config /globalqueryblocklist wpad

b.Ensure that the Command completed successfully message displays.

c.Close the command prompt window.

5.Switch to LON-RTR and configure the DNS suffix by performing the following steps: STUDENT

a.In the Local Area Connection Properties dialog box, in the Internet Protocol Version 4 (TCP/IPv4) dialog box, add the Adatum.com DNS suffix.

b.Close the Local Area Connection Properties dialog box.

6.Configure the Local Area Connection 2 properties as follows:

a.Change the Local Area Connection 2\ Internet Protocol Version 4 (TCP/IPv4) configuration using the following configuration settings:

IP address: 131.107.0.2

Subnet mask: 255.255.0.0

 Task 2: Configure certificates

1.Configure the CRL distribution settings by performing the following steps:

a.Switch to LON-DC1, and open the Certification Authority console.

b.Configure Adatum-LON-DC1-CA certification authority with the following extension settings:

Add Location: http://crl.adatum.com/crld/

Variable: CAName, CRLNameSuffix, DeltaCRLAllowed

Location: .crl

Select the following:

Include in CRLs. Clients use this to find Delta CRL locations

Include in the CDP extension of issued certificates

Do not restart Certificate Services.

Add Location: \\LON-RTR\crldist$\

Variable: CaName, CRLNameSuffix, DeltaCRLAllowed

Location: .crl

PROHIBITED USE

7-50 Configuring and Troubleshooting Remote Access		MCT
7-50 Configuring and Troubleshooting Remote Access

	 Select the following:
	 Include in CRLs. Clients use this to find Delta CRL locations
	 Include in the CDP extension of issued certificates	USE
c.	Restart Certificate Services.
d.	Close the Certificate Authority console.
2. To duplicate the web certificate template and configure appropriate permission by performing the
following steps:		.ONLY
a.		.ONLY
a.	In the Certificate Templates console, in the contents pane, duplicate the Web Server template by
	using the following options:
	 Template display name: Adatum Web Server Certificate
	 Request Handling: Allow private key to be exported
	 Authenticated Users permissions: under Allow, click Enroll
b.	Close the Certificate Templates console.	STUDENT
c.	In the Certification Authority console, choose to issue a New Certificate Template and select the	STUDENT
c.
	Adatum Web Server Certificate template.
d.	Restart the Certification Authority.
e.	Close the Certification Authority console.
3. Configure computer certificate auto-enrollment by performing the following steps:
a.	On LON-DC1, open the Group Policy Management Console.
b.	In the Group Policy Management Console, navigate to Forest: Adatum.com
	\Domains\Adatum.com.
c.	Edit the Default Domain Policy.
d.	In the Group Policy Management Editor, navigate to Computer Configuration	USE
	\Policies\Windows Settings\Security Settings\Public Key Policies.	USE

e.	Under Automatic Certificate Request Settings, configure Automatic Certificate Request to
	issue the Computer certificate.
f.	Close both the Group Policy Management Editor and the Group Policy Management Console.

 Task 3: Configure internal resources

1.Request a certificate for LON-SVR1 by performing the following steps:

a. On LON-SVR1, open a command prompt, type the following command, and then press Enter:

gpupdate /force

b.At the command prompt, type the following command, and then press Enter:

mmc

2.Add the Certificates snap-in for Local computer.

3.In the console tree of the Certificates snap-in, navigate to Certificates (Local Computer) \Personal\Certificates, and request a new certificate.

PROHIBITED

Administering Windows Server® 2012

4.Under Request Certificates, select Adatum Web Server Certificate with the following setting:

oSubject name: Under Common name, type nls.adatum.com

5.In the details pane of the Certificates snap-in, verify that a new certificate with the name nls.adatum.com was enrolled with Intended Purposes of Server Authentication.

6.Close the console window. When you are prompted to save settings, click No.

7.To change the HTTPS bindings, perform the following steps:

a.Open Internet Information Services (IIS) Manager.

b.In the Internet Information Services (IIS) Manager console, navigate to and click Default Web site.

c.Configure Site Bindings by selecting nls.adatum.com for SSL Certificate.

d.Close the Internet Information Services (IIS) Manager console.

 Task 4: Configure the DirectAccess server

7-MCT51

ONLY USE .

1. Obtain required certificates for LON-RTR by performing the following steps:
	a.	Switch to LON-RTR.
	b.	Open a command prompt, and refresh group policy by typing the following command:


	c.	Open the Microsoft Management Console by typing mmc at a command prompt.
	d.	Add the Certificates snap-in for Local computer.
	e.	In the Certificates snap-in, in the Microsoft Management Console , request a new certificate with
		the following settings:	STUDENT
		 Certificate template: Adatum Web Server Certificate

		 Common name: 131.107.0.2	USE
		 Friendly name: IP-HTTPS Certificate
	f.	Close the Microsoft Management Console.
2. Create CRL distribution point on LON-RTR by performing the following steps:

	a.	Switch to Server Manager.
	b.	In Internet Information Services (IIS) Manager, create new virtual directory named CRLD, and
		assign c:\crldist as a home directory.
	c.	Enable directory browsing and the allow double escaping feature.
3. Share and secure the CRL distribution point by performing the following step:
	o	In the details pane of Windows Explorer, right-click the CRLDist folder, click Properties, and then


		grant Full Control Share and NTFS permissions.	PROHIBITED
			PROHIBITED

7-52 Configuring and Troubleshooting Remote Access				MCT
7-52 Configuring and Troubleshooting Remote Access

4. Publish the CRL to LON-RTR by performing the following steps:
	Note: This step makes the CRL available on the edge server for Internet-based DirectAccess			USE

clients.
clients.
	a.	Switch to LON-DC1.
	b.	Start the Certification Authority console.		.ONLY
	c.	In the console tree, open Adatum-LON-DC1-CA, right-click Revoked Certificates, point to All		.ONLY
	c.
		Tasks, and then click Publish.
5. Complete the DirectAccess Setup Wizard on LON-RTR by performing the following steps:
	a.	On LON-RTR, open Server Manager.
	b.	In Server Manager, in Tools, select Routing and Remote Access.
	c.	In Routing and Remote Access, disable the existing configuration, and close the console.		STUDENT
	d.	In Server Manager console, start the Remote Management console, click Configuration, and		STUDENT
	d.
		start the Enable DirectAccess Wizard.
	Note: If you get an error at this point, restart LON-RTR, sign in as Adatum\administrator,

and then restart from c).
	e.	Complete the wizard with following settings:
		 Network Topology: Edge is selected
		 131.107.0.2 is used by clients to connect to the Remote Access server.
	f.	In the Remote Access Management console, under Step 1, click Edit.
	g.	Add the DA_Clients group.		USE
	h.	Clear the Enable DirectAccess for mobile computers only check box.		USE
	h.
	i.	Remove the Domain Computers group.
	j.	In the Remote Access Management console details pane, under Step 2, click Edit.
	k.	On the Network Topology page, verify that Edge is selected, and type 131.107.0.2.		PROHIBITED
	s.	In the DNS Suffix Search List, click Next.	CN=131.107.0.2 is used as a certificate to	PROHIBITED
	l.	On the Network Adapters page, verify that	CN=131.107.0.2 is used as a certificate to
		authenticate IP-HTTPS connection.
	m.	On the Authentication page, click Use computer certificates, click Browse, and then click
		Adatum Lon-Dc1 CA.
	n.	On the VPN Configuration page, click Finish.
	p.	On the Network Location Server page, click The network location server is deployed on a
		remote web server (recommended), and in the URL of the NLS, type https://nls.adatum.com,
		and then click Validate.
	q.	Ensure that URL is validated.
	r.	On the DNS page, examine the values, and then click Next.

The main tasks for this exercise are as follows:

		Administering Windows Server® 2012 7-53
	t. On the Management page, click Finish.		MCT
	t. On the Management page, click Finish.
	u. In the Remote Access Management console details pane, review the setting for Step 4.
	v. In Remote Access Review, click Apply.
	w. Under Applying Remote Access Setup Wizard Settings, click Close.
6. Update Group Policy settings on LON-RTR by performing the following step:
	o Open the command prompt, and type the following commands, pressing Enter after each line:USE
		gpupdate /force
		Ipconfig

	Note: Verify that LON-RTR has an IPv6 address for Tunnel adapter IPHTTPSInterface		.ONLY

starting with 2002.

Results: After completing this exercise, you will have configured the DirectAccess infrastructure.
Exercise 2: Configuring the DirectAccess Clients			STUDENT
Scenario

After you configured the DirectAccess server and the required infrastructure, you must configure DirectAccess clients. You decide to use Group Policy to apply DirectAccess settings to the clients and for certificate distribution.

1.Configure DirectAccess Group Policy settings.

2.Verify client computer certificate distribution.

3.Verify internal connectivity to resources.

1.Start LON-CL1, and then sign in as Adatum\Administrator with the password of Pa$$w0rd. OpenUSEa command prompt window, and then type the following commands, pressing Enter at the end of each line:


2.	Verify that DirectAccess Client Settings GPO is displayed in the list of the Applied Policy objects for
	the Computer Settings.	PROHIBITED
1.	On LON-CL1, open the Certificates MMC.
2.	Verify that a certificate with the name LON-CL1.adatum.com displays with Intended Purposes of
	Client Authentication and Server Authentication.
3.	Close the console window without saving it.

When client configuration is completed, it is important to verify that DirectAccess works. You do this by moving the DirectAccess client to the Internet, and trying to access internal resources.

The main tasks for this exercise are as follows:

7-54 Configuring and Troubleshooting Remote Access

	 Task 3: Verify internal connectivity to resources		MCT
1.		On LON-CL1, open Windows Internet Explorer® from the Desktop, and in the address bar, type	MCT
		http://lon-svr1.adatum.com/. The default IIS 8 web page for LON-SVR1 displays.
2.		In Internet Explorer, go to https://nls.adatum.com/. The default IIS 8 web page for LON-SVR1
		displays.
3.		Open a Windows Explorer window, in the address bar, type \\Lon-SVR1\Files, and then press Enter.
		A window with the contents of the Files shared folder will display.	USE

4.		Close all open windows.

	Results: After completing this exercise, you will have configured the DirectAccess clients.

	Exercise 3: Verifying the DirectAccess Configuration		ONLY.
	Scenario		ONLY.
	Scenario

1.	Move the client computer to the Internet virtual network.		STUDENT
2.	Verify connectivity to the DirectAccess server.		STUDENT
2.	Verify connectivity to the DirectAccess server.
3.	Verify connectivity to the internal network resources.
4.	To prepare for the next module.
 Task 1: Move the client computer to the Internet virtual network
1.	Switch to LON-CL1.		USE
2.	Change the network adapter configuration to the following settings:
	o	IP address: 131.107.0.10
	o	IP address: 131.107.0.10
	o	Subnet mask: 255.255.0.0
	o	Default gateway: 131.107.0.2
3.	Disable and then re-enable the Local Area Network network adapter.
4.	Close the Network Connections window.
5.	On your host, in Hyper-V Manager, right-click 20411B-LON-CL1, and then click Settings. Change
	the Legacy Network Adapter to be on the Private Network 2 network, and then click OK.		PROHIBITED
	Task 2: Verify connectivity to the DirectAccess server		PROHIBITED
	Task 2: Verify connectivity to the DirectAccess server
1.	On LON-CL1, open a command prompt, and type the following command:

		ipconfig

2.	Notice that the returned IP address starts with 2002. This is IP-HTTPS address.
3.	At the command prompt, type the following command, and then press Enter:

Netsh name show effectivepolicy

	Administering Windows Server® 2012	MCT
	Administering Windows Server® 2012	7-55
4. At the command prompt, type the following command, and then press Enter:

	powershell

5.At the Windows PowerShell® command-line interface, type the following command, and then pressUSE Enter:


1.		Switch to Internet Explorer, and go to http://lon-svr1.adatum.com/. You should see the default IIS
		8 web page for LON-SVR1.	.ONLY
2.		Open Windows Explorer, in the address bar, type \\LON-SVR1\Files, and then press Enter.	.ONLY
3.		A folder window with the contents of the Files shared folder should display.	STUDENT
4.		At a command prompt, type the following command, and then press Enter:	STUDENT
4.




7.		Close all open windows.
8.		Switch to LON-RTR.
9.		Start the Remote Access Management console, and review the information on Remote Client	USE
		Status.
		Note: Notice that LON-CL1 is connected via IP-HTTPS. In the Connection Details pane, in

	the bottom-right of the screen, note the use of Kerberos for the Machine and the User.
10.		Close all open windows.	PROHIBITED
10.		Close all open windows.
	 To prepare for the next module
	•	When you finish the lab, revert the virtual machines to their initial state.

Results: After completing this exercise, you will have verified the DirectAccess configuration.

7-56 Configuring and Troubleshooting Remote Access

Module Review and Takeaways

Tools


Tool	Use for	Where to find it
Tool	Use for	Where to find it

Services.msc	Managing Windows services	Administrative Tools
		Launch from Run
Gpedit.msc	Editing the local Group Policy	Launch from Run
Mmc.exe	Creating and managing the Microsoft Management	Launch from Run
	Console
Gpupdate.exe	Managing Group Policy application	Run from a command-line

PROHIBITED USE STUDENT .ONLY USE MCT

		8-1

Module 8		MCT
Module 8		USE
Installing, Configuring, and Troubleshooting the Network
Policy Server Role

Contents:		.ONLY
Module Overview	8-1
Lesson 1: Installing and Configuring a Network Policy Server	8-2
Lesson 2: Configuring RADIUS Clients and Servers	8-6
Lesson 3: NPS Authentication Methods	8-12
Lesson 4: Monitoring and Troubleshooting a Network Policy Server	8-20
	8-20
Lab: Installing and Configuring a Network Policy Server	8-25
Module Review and Takeaways	8-29

Module Overview

	The Network Policy Server (NPS) role in Windows Server® 2012 provides support for the Remote
	Authentication Dial-In User Service (RADIUS) protocol, and can be configured as a RADIUS server or
	proxy. Additionally, NPS provides functionality that is essential for the implementation of Network Access
	Protection (NAP). To support remote clients and to implement NAP, it is important that you know how to
	install, configure, and troubleshoot NPS.	STUDENT
	Objectives	USE
	After completing this module, you will be able to:

	• Install and configure NPS.
	• Configure RADIUS clients and servers.	PROHIBITED
	• Explain NPS authentication methods.
	• Monitor and troubleshoot NPS.
	• Monitor and troubleshoot NPS.

8-2 Installing, Configuring, and Troubleshooting the Network Policy Server Role

Lesson 1

Installing and Configuring a Network Policy Server

NPS is implemented as a server role in Windows Server 2012. While installing the NPS role, you must decide whether to use NPS as a RADIUS server, RADIUS proxy, or a NAP policy server. After the

installation, you can configure the NPS role by using various tools. You must understand how to install and configure the NPS role in order to support your RADIUS infrastructure.

Lesson Objectives

After completing this lesson, you will be able to:

•Describe the NPS role service.

•Explain how to install NPS.

•Describe the tools used to configure an NPS.

•Explain how to configure general NPS settings.

What Is a Network Policy Server?

NPS enables you to create and enforce organization-wide network access policies for client health, connection request authentication, and connection request authorization. You also can use NPS as a RADIUS proxy to forward connection requests to NPS or other RADIUS servers that you configure in remote RADIUS server groups.

You can use NPS to centrally configure

and manage network-access authentication, authorization, and client health policies with any combination of the following three functions:

•RADIUS server

•RADIUS proxy

•NAP policy server

RADIUS Server

NPS performs centralized connection authentication, authorization, and accounting for wireless, authenticating switch, and dial-up and virtual private network (VPN) connections. When using NPS as a RADIUS server, you configure network access servers, such as wireless access points and VPN servers, as RADIUS clients in NPS. You also configure network policies that NPS uses to authorize connection

requests, and you can configure RADIUS accounting so that NPS logs accounting information to log files on the local hard disk or in a Microsoft® SQL Server® database.

NPS is the Microsoft implementation of a RADIUS server. NPS enables the use of a heterogeneous set of wireless, switch, remote access, or VPN equipment. You can use NPS with the Routing and Remote Access service, which is available in Windows® 2000 and more recent versions of Windows Server.

When an NPS server is a member of an Active Directory® Domain Services (AD DS) domain, NPS uses AD DS as its user-account database and provides single sign-on (SSO), which means that users utilize the

PROHIBITED USE STUDENT .ONLY USE MCT

<<< < Предыдущая 15 16 17 18 19 20 21 22 23 24 25 2627 / 5327 28 29 30 31 32 33 34 35 36 37 38 39 > Следующая >>>

Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]

#
01.05.201559.39 Кб101_Diplom_Trebovania_Tekhnika_bezopasnosti.doc
#
01.05.201548.15 Кб272 д-ріс.docx
#
01.05.2015110.08 Кб152 лаба.doc
#
01.05.2015224.26 Кб52-РГР техника жне технология негіздері.doc
#
01.05.2015624.64 Кб542012215.pdf
#
01.05.201516.48 Mб23720411B-ENU-TrainerHandbook.pdf
#
01.05.2015134.66 Кб182192_srs2_politology.doc
#
10.03.2016475.65 Кб52222.doc
#
01.05.201569.93 Кб1924 билет ЗИ в ТКС.docx
#
01.05.201518.89 Кб133 д-ріс.docx
#
01.05.2015675.84 Кб123 лаба метод указ.doc