Trending Topics

VMware on AWS - How to restore NSX DFW firewall rules to previous state

Image
Customers who uses NSX day-in, day-out would like to have a point-in time restore functionality of DFW firewall rules. Many customer have a large footprints in VMC and make changes to DFW quite often. This feature was missing for long time and we could see its included in recent versions . Let's see how DFW configuration roll back works  NSX DFW configuration has versioning, and it is stored in the NSX Manager.  Every time when someone update DFW configuration, NSX creates one more version but keep storing the previous ones. You can rollback for previous config but reapplying it once again.  You can find the options under Networking & Security tab , > Security > Distributed Firewall . In the right side we see an Actions drop down. Choose View to get to the below screen.  Let’s go through the use case:  1. Original state- default config with no custom rules:  a. There are no saved configurations during last 30 days: In my existing test setup, with the current setting

DHCP Relay Agent


The DHCP Relay Agent allows you to place DHCP clients and DHCP servers on different networks. Deploying DHCP in a single segment network is easy. All DHCP messages are IP broadcast messages, and therefore all the computers on the segment can listen and respond to these broadcasts. A single scope on a solitary DHCP server is all that is required.
DHCP Messages on a Multisegment Network
Things get a little more complicated when you have more than one subnet on your network. This is because the DHCP broadcast messages do not, by default, cross the router interfaces.
There are several ways you can handle this situation. One alternative is to put a DHCP server on each segment. If you have just a few segments, you might consider this option. However, when you have a large organization, placing a DHCP server on each segment can increase cost and add to administrative effort.
Relay To The Rescue
A better option is to use fewer DHCP servers and place these machines in central locations. To solve the problem of DHCP broadcast messages, routers can be configured to pass DHCP/BOOTPmessages selectively. This is referred to as BOOTP Relay.
The concept of BOOTP Relay can get a little confusing. It gets even more confusing when the termBOOTP Forwarding is used. This is because the concepts for Relay and Forwarding are quite different.Forwarding implies that the message is forwarded from one interface to another, without any special processing. Relay implies that the message is processed to a greater extent, which may include changes being made to the original packet.
An Agent is a Relay and Not a Forwarder
RFC 1542 elaborates on BOOTP Relay and BOOTP Relay Agents. A router that can perform BOOTP Relay does more than just forward BOOTP broadcast messages. Rather, the BOOTP Relay Agent actually examines the packet and makes appropriate changes to it, and then Relays the packet to a DHCP Server. The DHCP server to which the packet is Relayed is configured by adding a Helper Address on the router.
Some routers do not support BOOTP Relay. In this case, you can set up a computer on segments that have DHCP clients that will take the place of the BOOTP Relay Agent on the router. You can configure a Windows 2000 RRAS Server to Relay DHCP messages by installing the DHCP Relay Agent.
The Relay Agent communicates with a DHCP server and acts as a proxy for DHCP broadcast messages that must be routed to remote segments. Like the router-based BOOTP Relay Agent, the DHCP Relay Agent is configured with addresses of DHCP servers to which they should Relay the DHCP Message.
Be Careful of the Terminology
Be sure you recognize the difference between a DHCP/BOOTP Relay Agent and a Router that acts as a BOOTP forwarder. Remember that forwarders will propagate a broadcast message across the router interfaces, while the DHCP Relay Agent intercepts the broadcast, makes changes to the DHCP Message, and forwards its via a directed datagram to a specific DHCP server

Popular posts from this blog

What is a Sysvol?

Image
SYSVOL is the acronym for the SYSFOL folder and all of the files stored in it on the Windows Operating System (OS). It stores the server’s copy of public data and files for the domain. These files consist of group or user policy information. The information stored in the SYSVOL folder is copied to all domain controllers on the respective domain. What are the SYSVOL Requirements? First, the SYSVOL folder has to be located on a Windows NTFS volume. The information stored in the SYSVOL folder is replicated on all domain controllers’ local disk via the File Replication Service (FRS), which must be installed for the operation to work properly. For network clients to access the SYSVOL tree’s contents, they must gain permission to access the NETLOGON and SYSVOL folders. The SYSVOL folder is used for a number of common networking applications, including adding a domain to an existing set or “Forest” of domain servers and locally creating a new logon script. How to Add a Domain to an
Read more

HOW TO EDIT THE BCD REGISTRY FILE

Image
The BCD registry file controls which operating system installation starts and how long the boot manager waits before starting Windows. Basically, it’s like the Boot.ini file in earlier versions of Windows. If you need to edit it, the easiest way is to use the Startup And Recovery tool from within Vista. Just follow these steps: 1. Click Start. Right-click Computer, and then click Properties. 2. Click Advanced System Settings. 3. On the Advanced tab, under Startup and Recovery, click Settings. 4. Click the Default Operating System list, and edit other startup settings. Then, click OK. Same as Windows XP, right? But you’re probably not here because you couldn’t find that dialog box. You’re probably here because Windows Vista won’t start. In that case, you shouldn’t even worry about editing the BCD. Just run Startup Repair, and let the tool do what it’s supposed to. If you’re an advanced user, like an IT guy, you might want to edit the BCD file yourself. You can do this
Read more

AD LDS – Syncronizing AD LDS with Active Directory

Image
First, we will install the AD LDS Instance: 1. Create and AD LDS instance by clicking Start -> Administrative Tools -> Active Directory Lightweight Directory Services Setup Wizard. The Setup Wizard appears. 2. Click Next . The Setup Options dialog box appears. For the sake of this guide, a unique instance will be the primary focus. I will have a separate post regarding AD LDS replication at some point in the near future. 3. Select A unique instance . 4. Click Next and the Instance Name dialog box appears. The instance name will help you identify and differentiate it from other instances that you may have installed on the same end point. The instance name will be listed in the data directory for the instance as well as in the Add or Remove Programs snap-in. 5. Enter a unique instance name, for example IDG. 6. Click Next to display the Ports configuration dialog box. 7. Leave ports at their default values unless you have conflicts with the default values. 8. Click N
Read more