Windows DHCP最佳實踐（二）

{"type":"doc","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這是Windows DHCP最佳實踐和技巧的最終指南。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果您有任何最佳做法或技巧，請在下面的評論中發佈它們。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"在本指南（二）中，我將分享以下","attrs":{}},{"type":"text","marks":[{"type":"strong","attrs":{}}],"text":"DHCP最佳實踐和技巧","attrs":{}},{"type":"text","text":"。","attrs":{}}]},{"type":"numberedlist","attrs":{"start":"1","normalizeStart":1},"content":[{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":1,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://bigyoung.cn","title":""},"content":[{"type":"text","text":"從DHCP作用域中排除IP","attrs":{}}]}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":2,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://bigyoung.cn","title":""},"content":[{"type":"text","text":"瞭解PowerShell DHCP命令","attrs":{}}]}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":3,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://bigyoung.cn","title":""},"content":[{"type":"text","text":"子網劃分和網絡分段的好處","attrs":{}}]}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":4,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://bigyoung.cn","title":""},"content":[{"type":"text","text":"DHCP租約期限提示","attrs":{}}]}]}],"attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"從DHCP作用域中排除IP","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"-------------","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"創建DHCP作用域時，建議不要爲靜態IP分配排除一小部分範圍。是的，我在上一個技巧中知道我說過不使用靜態分配，但是基礎設施設備將需要它。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"您的網絡將具有一個默認路由，該默認路由將是路由器，因此您絕對希望將其排除在DHCP池之外。您可能還會遇到其他需要靜態IP的設備，因此最好將這些設備的排除的IP在DHCP池中設置一個較小範圍較。例如，我看到了各種需要靜態IP的警報和安全設備，因此我只提供排除範圍內的IP。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這是用於工作站和筆記本電腦的數據VLAN的屏幕截圖，其中排除了10.2.10.1至10.2.10.10。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/96/96ddef8aff7162b961ec596592f8f2de.jpeg","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"瞭解PowerShell DHCP命令","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"-------------------","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"使用DHCP控制檯（dhcpmgmt.ms）並沒有錯，但是PowerShell很棒，並且簡化了許多任務。如果您的大型網絡具有數百個DHCP作用域，那麼使用PowerShell將節省大量時間。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這裏有一些命令可以幫助您入門。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"安裝DHCP角色","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Install-WindowsFeature -IncludeManagementTools DHCP","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"備用DHCP服務器","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Backup-DhcpServer -ComputerName \"dhcp1.ad.activedirectorypro.com\" -Path \"C:\\Windows\\system32\\dhcp\\backup\"","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"查看DHCP租約","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Get-DhcpServerv4Scope | Get-DhcpServerv4Lease","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"從MAC地址查找DHCP租約","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Get-DhcpServerv4Scope |Get-DhcpServerv4Lease |where {$_.ClientId -like “b4-b6-86-b4-**-**” }","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"添加DHCP作用域","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Add-DHCPServerv4Scope -EndRange 10.2.1.254 -Name Vlan110 -StartRange 10.2.1.1 -SubnetMask 255.255.255.0 -State Active","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"獲取所有活動的ipv4範圍","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Get-DHCPServerv4Scope","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"獲取範圍的所有DHCP保留","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Get-DHCPServerv4Lease -ScopeId 10.2.1.0","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"創建DHCP預留","attrs":{}}]},{"type":"codeblock","attrs":{"lang":""},"content":[{"type":"text","text":"Get-DhcpServerv4Lease -ComputerName dhcpserver1 -IPAddress 10.2.1.8 | Add-DhcpServerv4Reservation -ComputerName server1","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"這只是用PowerShell管理DHCP服務器。下面的一些鏈接，是使用Powershell管理其他的一些服務。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"資料來源","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https://docs.microsoft.com/en-us/powershell/module/dhcpserver/?view=win10-ps","title":""},"content":[{"type":"text","text":"https://docs.microsoft.com/zh-cn/powershell/module/dhcpserver/?view=win10-ps","attrs":{}}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https://4sysops.com/archives/configure-dhcp-with-powershell-in-windows-server-2012-r2-and-above/","title":""},"content":[{"type":"text","text":"https://4sysops.com/archives/configure-dhcp-with-powershell-in-windows-server-2012-r2-and-above/","attrs":{}}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"https://activedirectorypro.com/powershell-commands/","title":""},"content":[{"type":"text","text":"Active Directory的PowerShell命令的大量列表","attrs":{}}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"子網劃分和網絡分段的好處","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"------------","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"我不會深入探討子網劃分，因爲有很多服務可以做到這一點。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"但是，在配置DHCP作用域時，它有助於對網絡有一些基本的瞭解。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"您不想爲所有設備只有一個大的DHCP池，而是應將設備分段到單獨的網絡中。這也取決於網絡的大小，如果網絡較小，則網絡分段不是那麼重要。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"網絡分段的好處","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":4},"content":[{"type":"text","text":"安全","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"通過將設備保持在單獨的網絡上，您可以更好地控制網絡。您的打印機需要訪問互聯網嗎？可能不會。財務部門的計算機是否需要直接與HR中的計算機對話，絕對不是。通過將設備分成自己的網絡，您可以更好地控制它們的訪問。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"限制網絡中的橫向移動確實可以減慢攻擊者和病毒的速度。在網絡級別啓用防火牆或訪問控制列表以限制網絡中的橫向移動非常重要。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":4},"content":[{"type":"text","text":"網絡性能","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"將所有內容都放在一個大型網絡上將創建一個巨大的廣播域。這可能會導致各種問題，例如生成樹循環，廣播和多播風暴。對網絡進行分段將分隔廣播域並減少可能的性能問題。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":4},"content":[{"type":"text","text":"控制訪客/訪客訪問","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"您不希望您的訪客網絡訪問您的安全網絡。將此流量分離到其自己的網絡，可以過濾流量並阻止對內部網絡的訪問。我還將訪客網絡用於僅需要Internet連接的IOT類型的設備。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"以下是如何細分網絡流量的示例。","attrs":{}}]},{"type":"bulletedlist","content":[{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"計算機= 10.2.10.0/24 VLAN 110","attrs":{}}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"打印機= 10.2.8.0/24 VLAN 108","attrs":{}}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"語音= 10.2.6.0/24 VLAN 106","attrs":{}}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"視頻監控= 10.2.4.0/24 VLAN 104","attrs":{}}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"服務器= 10.2.2.0/24 VLAN 102","attrs":{}}]}],"attrs":{}},{"type":"listitem","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"訪客= 10.16.0.0/23 VLAN 116","attrs":{}}]}],"attrs":{}}],"attrs":{}},{"type":"image","attrs":{"src":"https://static001.geekbang.org/infoq/48/48d09b2dbb2da14fc53cdc470eeaca1f.jpeg","alt":null,"title":null,"style":[{"key":"width","value":"75%"},{"key":"bordertype","value":"none"}],"href":null,"fromPaste":true,"pastePass":true}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"除了進行網絡分段之外，請嘗試使IP方案保持簡單，這確實簡化了DHCP作用域的管理。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"DHCP租約期限提示","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"----------","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"DHCP租約是DHCP服務器爲客戶端分配IP地址的時間段。DHCP作用域的默認DHCP租用時間爲8天。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"提示＃1增加固定設備的租賃時間","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"對於小型網絡，您可以將租約時間保留爲默認設置8小時。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"對於大型網絡，請考慮將固定設備（工作站）的DHCP作用域更改爲16天。這樣可以減少與DHCP相關的網絡流量。工作站不經常移動，因此無需爲了獲得IP地址而經常跟DHCP進行交互。","attrs":{}}]},{"type":"heading","attrs":{"align":null,"level":3},"content":[{"type":"text","text":"提示＃2減少訪客/移動設備的租賃時間","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果提供來賓wifi，則這些DHCP作用域會很快耗盡可用IP。這些設備很可能只需要臨時訪問（例如幾個小時）。對於這些範圍，請考慮將DHCP租用時間調整爲1小時。如果設備仍然處於活動狀態，它將續訂，但是如果設備斷開連接，它將釋放IP地址，這將有助於您的來賓有足夠的可用IP。","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"移動設備也可能是這種情況，儘管越來越多的用戶使用筆記本電腦，但這種設備可能會很棘手。默認的8天可能就足夠了，但是如果您知道移動設備經常到處移動，則可以考慮減少租賃時間。","attrs":{}}]},{"type":"blockquote","content":[{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","marks":[{"type":"strong","attrs":{}}],"text":"總結：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"如果您擁有僅用於特定設備（例如工作站）的DHCP作用域，請考慮調整DHCP租用時間。","attrs":{}}]}],"attrs":{}},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"本系列文檔目錄：","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"text","text":"===","attrs":{}}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://www.bigyoung.cn/posts/174/","title":""},"content":[{"type":"text","text":"DHCP最佳實踐（一）","attrs":{}}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://www.bigyoung.cn/posts/175/","title":""},"content":[{"type":"text","text":"DHCP最佳實踐（二）","attrs":{}}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://www.bigyoung.cn/posts/176/","title":""},"content":[{"type":"text","text":"DHCP最佳實踐（三）","attrs":{}}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null},"content":[{"type":"link","attrs":{"href":"http://www.bigyoung.cn/posts/177/","title":""},"content":[{"type":"text","text":"DHCP最佳實踐（四）","attrs":{}}]}]},{"type":"paragraph","attrs":{"indent":0,"number":0,"align":null,"origin":null}}]}