Какие варианты назначения ip адреса существуют при установке сервера windows 2003

Network Device Configuration

1. Use the “Typical settings” selection to obtain the
   configuration via DHCP. Most clients use this setting. As a network
   administrator, it is your job to ensure that the clients obtain the
   correct configuration from DHCP, as described in Chapter 5.

2. Use the “Custom settings” selection to manually define the
   configuration for the system. Custom configuration is the focus of
   this chapter.

Tip

By default, the first Ethernet interface is called Local Area
Connection. The second Ethernet interface is named Local Area
Connection 2, the third is named Local Area Connection 3, and so on.
If your system has interface names of this type, you can rename the
interfaces to something more meaningful in exactly the same way that
you would rename a file. Simply right-click on the interface in the
Network Connections menu, select Rename from the right-click menu, and
enter a new, more descriptive name.

Figure 4-1. The Support tab of the Adapter Status window

Figure 4-2. Network Connection Details

• Use the Disable button to down the interface. This can be
  useful during troubleshooting. Normally, of course, the interface is
  left up and running. To reenable the interface after it has been
  disabled, simply select the interface from the Network Connections
  menu and it will automatically be reenabled. Disabling and
  reenabling the interface resets the connection time and the number
  of packets sent and received.

• Use the Properties button to reconfigure the interface.

Advanced

This tab allows you to select the Internet
Connection Firewall (ICF). When you select the
checkbox, the Settings button becomes active, which allows you to
select the level of security logging the system will use, the
types of services that will be offered to remote users, and the
types of ICMP packets to which the system will respond. The ICF is
covered in Chapter
9.

Authentication

This tab allows you to select and configure IEEE 802.1X
authentication. One of the configuration parameters is the type of
Extensible Authentication Protocol (EAP) that
will be used. Configuring authentication, including EAP, is
covered in Chapter
8.

General

This tab allows you to configure the network adapter device
driver and the network protocols used by this interface. This is
the focus of this chapter.

Figure 4-3. The Adapter Properties General tab

The level of hardware configuration offered depends upon the
capabilities of the hardware and the associated device driver. The
tabs displayed will vary from device to device. Figure 4-4 shows an example
for a specific D-Link Ethernet card.

The properties window shown in Figure 4-4 displays five
tabs. The Advanced tab lists configuration properties specific to this device.
Another Ethernet card would have different settings on the Advanced
tab, if it offered an Advanced tab at all. The Driver tab displays
information specific to the driver for this device. The information
displayed on the Driver tab varies from manufacturer to manufacturer. However, the
essential buttons on this tab should be the same for any network
device. The key Driver tab buttons are as follows:

Windows Server 2003 ships drivers for numerous network adapter
cards bundled with the operating system. The drivers are of high
quality, but things change. Bugs are discovered and drivers are
improved. Because of these changes you may find yourself clicking the
Update Driver button. Before you do, make sure you have the latest
driver available for your adapter:

The General, Resources, and Power Management tabs shown in Figure 4-4 are more generic
than the Driver tab. The Power Management tab is there for devices that support Advanced Power
Management (APM). APM allows for two-way power
control:

The Resources tab lists the hardware resources used by the network device and notifies you if any
hardware conflicts exist. PC adapter cards require up to four distinct
hardware configuration parameters. The parameters are the Interrupt
Request number (IRQ), Direct Memory Access (DMA) Direct Request number
(DRQ),^[*] I/O Port Address (or I/O Range), and Adapter Memory
Address.

Of the four configuration values, IRQ assignment traditionally
caused the most trouble because there were a limited number of
interrupts and interrupts could not be shared. Interrupts on the
original PC bus were edge triggered, which means that the transition
of the signal on the IRQ line caused the system to detect an
interrupt. (Specifically, IBM defined the signal as a transition from
low to high.) An IRQ could not be reliably shared because when more
than one card attempted to use a single IRQ line the interrupt could
be lost.

The Peripheral Component Interconnect (PCI)
bus has, by and large, eliminated this problem. The PCI bus is an
intelligent bus that supports automatic adapter configuration through
Plug and Play (PnP). With PnP, the adapter, the bus and the operating
system cooperate to find and assign unused hardware values, thus
eliminating conflicts. The NTDETECT.COM software collects the hardware
information for the Windows Server 2003 system.

If a conflict is found, the Resources tab lists the device that
conflicts with the network adapter. One possible cause of a conflict
is an adapter that allows manual configuration that has been
incorrectly configured. The problem is not necessarily in the network
card. It could be caused by misconfiguration of the conflicting
adapter.

The General tab identifies the device, displays the current
device status, and allows you to select the “Device usage,” which can
be either enable or disabled—yet another way to disable the interface.
(Disabling the device via the “Device usage” drop-down box has exactly
the same effect as disabling the interface through the Disable button
described in the previous section of this chapter.) If the device
status is not “This device is working properly,” you can click on the
Troubleshoot button, which opens the Help and Support Center window.
This is the same Help and Support Center that is available from the
Start menu. The difference is that when you enter the Help and Support
Center using the Troubleshoot button shown in Figure 4-4, the Help and
Support Center has already been primed with the problem: “I’m having a
problem with my hardware device.” While not as generic as the Help and
Support Center window invoked from the Start menu, it is still not
specific to network troubleshooting or even troubleshooting network
hardware. See Chapter 14
for network-oriented troubleshooting advice.

Network adapters do not need any manual configuration for most
systems. Most of the time, Windows Server 2003 correctly identifies
the adapter and installs a properly configured driver for the adapter.
The Configure button is useful but rarely needed.

Refer back to Figure
4-3. The window in the middle of the properties dialog shown in
Figure 4-3 lists the
network components used for the network connection. Three network
components are listed:

Directly under the list of network components are three buttons:
Install, Uninstall, and Properties. Click the Install button to
install a network component. The Install button opens the Select
Network Component Type window. Three component types are
offered:

If you install a component that you don’t need, it is easily
removed. The Uninstall button removes an unneeded network component.
To remove a component, simply highlight the component name in the list
box and click Uninstall. You will be asked to verify the removal.
Click Yes and the network component is removed. Any network component
can be removed in this manner except for TCP/IP , which is always required.

The Properties button is used to configure a protocol. Protocol
configuration is the principal topic of this chapter.

General TCP/IP Configuration

Figure 4-5. The Internet Protocol (TCP/IP) Properties window

Unfortunately, not every Windows system can use a DHCP server
for its configuration. Some systems don’t have access to a DHCP
server. Also a DHCP server itself cannot be configured by DHCP, and
the administrators of other servers often choose not to configure
their systems via DHCP. To configure a system without using DHCP,
select the “Use the following IP address” option button, and complete
the configuration manually. Below are the manual configuration fields
on the IP address portion of the General tab:

Of course, before manually entering data into any of these
fields you must know exactly what you are going to enter. The network
administrator is responsible for making and communicating decisions
about overall network configuration. If you’re adding a system to an
existing network, you can simply provide the correct values to the
person configuring the system from the range of values valid for your
network. If you are creating a new network, you will have to make some
basic decisions. One of these decisions is how to choose a network
number for your new network, which is the topic of the next section.
If you already have IP addresses for your network, you can skip this
section.

Refer to Figure
4-5. The lower half of the General tab of the Internet Protocol
(TCP/IP) Properties window defines the IP addresses of two DNS
servers . If the “Obtain an IP address automatically” checkbox
is selected, you will be offered the opportunity to select the Obtain
DNS server address automatically checkbox. This means that if you
obtain the host’s IP address from the DHCP server, you have the option
of either obtaining the DNS server address from DHCP or entering the
DNS server address manually. However, if you enter the host IP address
manually, you must also enter the DNS server address manually.

Two DNS server addresses can be entered in this window:

The General tab creates a minimal configuration . There are, of course, more TCP/IP configuration
options than the few shown on the General tab. We will examine these
additional configuration options in the following sections.

Adding More Configuration Details

Figure 4-6. The Advanced TCP/IP Settings window

IP Settings

This tab defines additional IP addresses with their
associated subnet masks, and it defines additional routers.

DNS

This tab defines additional DNS server addresses and the
value used to fully qualify unqualified domain names when
constructing DNS queries.

WINS

This tab defines the WINS server addresses and options for
NetBIOS name resolution.

Options

By default, the only option this tab provides access to is
“TCP/IP filtering.”

Windows Server 2003 allows you to assign multiple IP addresses
to a single physical network adapter. This is useful, for example, if
you want to run multiple subnets on the same physical network. We’ll
see a use for this in the discussion of superscopes in Chapter 5.

Add IP addresses to a network adapter by clicking Add in the “IP
addresses” pane to display the TCP/IP Address dialog box. In the
dialog, enter the IP address and its associated netmask. Windows
defaults the subnet mask to the natural mask of the IP address you
entered. If the IP address is part of a block with a specifically
assigned prefix-length or is a member of a subnet, the correct value
must be entered manually. Always verify that the subnet mask is
correct to avoid connectivity problems that can be extremely difficult
to resolve.

Highlight an address in the “IP addresses” pane and click Edit
to modify an existing IP address and subnet mask. Remove an IP address
by highlighting it and clicking Remove.

Windows Server 2003 allows you to define multiple default
gateways through the Add button in the “Default gateways” pane
of the IP Settings tab. (Refer back to the IP Settings tab in Figure 4-6.) Clicking the
Add button displays the TCP/IP Gateway Address dialog box. In the
dialog, enter the IP address of the gateway and select the routing
metric that you want to assign to this route. You can either check the
“Automatic metric” checkbox to allow Windows to assign the metric, or
you can uncheck that box and manually enter a numeric value for
Metric. The automatic metric is determined by the characteristics of
the network interface. Therefore when multiple routers are added
through the “Default gateways” pane of the same IP Settings tab, they
are all given the same automatic metric because they are all
associated with the same interface. The following route print command shows an example of
this:

    D:\>route print
    IPv4 Route Table
    ===========================================================================
    Interface List
    0x1 ........................... MS TCP Loopback interface
    0x10003 ...00 50 ba 3f c2 5e ...... D-Link DFE-530TX+ PCI Adapter
    ===========================================================================
    ===========================================================================
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
              0.0.0.0          0.0.0.0    192.168.0.250     192.168.0.20     20
              0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.20     20
            127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
          192.168.0.0    255.255.255.0     192.168.0.20     192.168.0.20     20
         192.168.0.20  255.255.255.255        127.0.0.1        127.0.0.1     20
        192.168.0.255  255.255.255.255     192.168.0.20     192.168.0.20     20
            224.0.0.0        240.0.0.0     192.168.0.20     192.168.0.20     20
      255.255.255.255  255.255.255.255     192.168.0.20     192.168.0.20      1
    Default Gateway:     192.168.0.250
    ===========================================================================
    Persistent Routes:
      None

The details of the routing table are explained in Chapter 2. In this case, we are
only interested in the first two active routes. They both are default
gateways as indicated by the fact that they both have destinations and
netmasks of 0.0.0.0. Both of these gateways were entered into the
configuration through configuration windows associated with the D-Link
Ethernet interface on this sample system. (The interface is assigned
the IP address 192.168.0.20.) The first gateway—the one assigned
address 192.168.0.250—was defined in the “Default gateway” box of the
General tab of the Internet Protocol (TCP/IP) Properties window for
this interface, as shown in Figure 4-5. The second
gateway was defined through the Add button of the “Default gateways”
pane of the IP Settings tab shown in Figure 4-6. When it was
defined, the “Automatic metric” checkbox was used. Both routes are
associated with the same interface, and both have the same metric.
Given the routing table shown above, the system will attempt to use
default gateway 192.168.0.250 first because it is listed first in the
table and has the same metric as the other default gateway.

Both of the default gateways in the table shown above are
reached through the same interface (192.168.0.20), therefore, they are
automatically assigned the same metric. To use a different metric,
manually enter the metric in the Metric box of the TCP/IP Gateway
Address dialog when adding a default gateway. In the routing table
shown below, a metric of 5 was
manually entered for the 192.168.0.1 default router:

    D:\>route print
     
    IPv4 Route Table
    ===========================================================================
    Interface List
    0x1 ........................... MS TCP Loopback interface
    0x10003 ...00 50 ba 3f c2 5e ...... D-Link DFE-530TX+ PCI Adapter
    ===========================================================================
    ===========================================================================
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
              0.0.0.0          0.0.0.0    192.168.0.250     192.168.0.20     20
              0.0.0.0          0.0.0.0      192.168.0.1     192.168.0.20      5
            127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
          192.168.0.0    255.255.255.0     192.168.0.20     192.168.0.20     20
         192.168.0.20  255.255.255.255        127.0.0.1        127.0.0.1     20
        192.168.0.255  255.255.255.255     192.168.0.20     192.168.0.20     20
            224.0.0.0        240.0.0.0     192.168.0.20     192.168.0.20     20
      255.255.255.255  255.255.255.255     192.168.0.20     192.168.0.20      1
    Default Gateway:     192.168.0.250
    ===========================================================================
    Persistent Routes:
      None

The metric defines the order of precedence among routers that
can reach the same destination. The lower the metric, the lower the
cost, and thus the more preferred the route. Given the routing table
shown above, the system will attempt to use default gateway
192.168.0.1 first because it has the lowest metric, even though it is
not the first default gateway listed in the table.

When multiple gateways are defined for a single destination,
only one gateway is active at any one time. Windows Server 2003 uses
the gateway with the lowest metric. If multiple gateways have the same
metric, Windows uses the first gateway listed. Only if the preferred
gateway is down or otherwise not accessible does it attempt to use
additional gateways.

Specifying multiple default gateways has limited utility because
it requires that more than one router be directly attached to the same
local network as the host, and that more than one of those routers be
capable of reaching all destinations. In many cases where there is
more than one router on the network some of the routers only reach
other internal networks and therefore are not suitable to be default
routers.

Don’t try to use the “Default gateways” pane to build complex
static routes. It is simply not flexible enough because it can only be
used to define default gateways. If static routes are required, use
the route command, which is
available through the Windows Server 2003 command interface. It lets
you manually configure the routes in the routing table. The command
syntax is:

    route [-f] [-p] [command [destination] [mask netmask] [gateway] [metric metric] [if
    interface]

The options are used as follows:

Assume we are configuring a system that has the IP address
192.168.0.20 and that is located on subnet 192.168.0.0. In the
following example we add a route to the host 172.16.12.3 and a route
to the subnet 172.16.8. In each case, the address mask determines if
the route is interpreted as a network route or a host route. After
entering the new routes, we display the routing table with the
route print command to examine our
handiwork:

    C:\>route -p add 172.16.12.3 mask 255.255.255.255 192.168.0.1
    C:\>route -p add 172.16.8.0 mask 255.255.255.0 192.168.0.1 metric 5
    C:\>route print
    IPv4 Route Table
    ===========================================================================
    Interface List
    0x1 ........................... MS TCP Loopback interface
    0x10003 ...00 50 ba 3f c2 5e ...... D-Link DFE-530TX+ PCI Adapter
    ===========================================================================
    ===========================================================================
    Active Routes:
    Network Destination        Netmask          Gateway       Interface  Metric
              0.0.0.0          0.0.0.0    192.168.0.250     192.168.0.20     20
            127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
           172.16.8.0    255.255.255.0      192.168.0.8     192.168.0.20      1
          172.16.12.3  255.255.255.255      192.168.0.5     192.168.0.20      1
          192.168.0.0    255.255.255.0     192.168.0.20     192.168.0.20     20
         192.168.0.20  255.255.255.255        127.0.0.1        127.0.0.1     20
        192.168.0.255  255.255.255.255     192.168.0.20     192.168.0.20     20
            224.0.0.0        240.0.0.0     192.168.0.20     192.168.0.20     20
      255.255.255.255  255.255.255.255     192.168.0.20     192.168.0.20      1
    Default Gateway:     192.168.0.250
    ===========================================================================
    Persistent Routes:
      Network Address          Netmask  Gateway Address  Metric
          172.16.12.3  255.255.255.255      192.168.0.1       1
           172.16.8.0    255.255.255.0      192.168.0.1       5

As the display shows, there are several more routes than the two
we just entered. All of the other routes are part of the basic routing
table, which is described in Chapter 2.

The routes we are interested in are both listed in the
Persistent Routes section of the route
print display. Routes added by the route add command will not survive a boot
without the -p option. Use the
-p option when you want to add
permanent static routes to the routing table. The -p option is not used when the routes are
installed for some temporary purpose, such as troubleshooting.

Note that the default metric used with the route command is 1. This is not the same default metric used
by the “Automatic metric” checkbox in the TCP/IP Gateway Address
dialog. The default metric can be overridden on the route command-line
using the metric argument, as in
the example above.

The sample system used in this example has only one network
interface adapter. All of the routes added by the route add command are associated with that
interface. When more than one network interface is available, Windows
selects the default interface for a route based on the gateway address
used for the route. For example, if the gateway address shows that the
gateway is on network 192.168.0.0, Windows will use the network
interface attached to network 192.168.0.0. To manually specify the
interface a route should use, add the if argument to the route command-line. The interface should be
specified by its interface number—not by its IP address. The interface
number is the first field displayed for each interface in the
Interface List section of the routing table. On our sample system, the
interface number associated with the D-Link Ethernet card is 0x10003.
The following route add command
associates the route to network 172.16.81.0 with the D-Link interface
on our sample system:

    D:\>route -p add 172.16.81.0 mask 255.255.255.0 192.168.0.8 if 0x10003

Use the route command only
when your system requires complex static routes. Most workstations use
a single default route, allowing that default router to redirect
packets as necessary. Let’s return to the Advanced TCP/IP Settings
window to finish entering configuration data.

An important part of a TCP/IP network is the DNS. The client
portion of DNS, which is called the resolver,
must be configured on every system. To customize the resolver
configuration, select the DNS tab , which is shown in Figure 4-7.

The “DNS server addresses, in order of use” pane, by default,
contains the server addresses entered on the General tab of the
Internet Protocol (TCP/IP) Properties window, as shown in Figure 4-5. Use the Add
button to enter the IP address of any additional DNS servers that you
wish to use. Additional DNS servers provide added redundancy, but they
rapidly reach a point of diminishing returns. Each server is queried
in turn, but only after the server above it in the list fails to
respond to the query. Each server is queried multiple times and each
query is given a reasonable timeout. These timeouts add up if too many
servers are placed in this list, which unnecessarily makes the user
wait for the inevitable error message. If the servers are properly
chosen, they are not all going to be down at the same time. It is far
more likely that multiple servers are unreachable at the same time
because of a network problem or a local problem. Adding more servers
to the list, cannot fix a network problem. Two well-chosen servers are
adequate, and three are probably the most you want. If you cannot
contact any of three different well-chosen servers, the problem is not
with the remote servers; it is with the network or your local system.
Use the Add, Edit, and Remove buttons as needed to configure the list
of servers.

Use the up and down arrow buttons to arrange the servers in the
order that you want them searched. When Windows needs to resolve an IP
address, it starts with the first server on the list. If that server
is unavailable, it then tries the second server. If that server fails
to respond, Windows continues to try servers in the order they are
listed until it either is able to resolve the address or runs out of
servers to try.

Two option buttons and a checkbox in the middle of the DNS tab
are used to configure how Windows qualifies unqualified hostnames. An
unqualified hostname is a hostname without an associated domain name.
When the resolver builds a DNS query for an unqualified hostname, the
hostname is extended to a fully qualified domain name before the query
is passed to the name server. The domain name the resolver appends to
the hostname depends on which options are selected.

When the “Append primary and connection specific DNS suffixes”
option button is selected, the primary domain name and the domain name
associated with this connection are used to fully qualify unqualified
hostnames. The domain name associated with the connection is the
domain name entered in the “DNS suffix for this connection” box near
the bottom of the DNS tab. In Figure 4-7, the sample value
entered in this box is sales.example.net. The primary
DNS suffix, however, is not configured through this window. It is
configured on the Computer Name tab of the System Properties dialog.
To configure the primary DNS domain name, go to the Start menu, open
the Control Panel menu and select System. In the System Properties
window, select the Computer Name tab. Click Change to open the
Computer Name Changes window. Then click More to open the DNS Suffix
and NetBIOS Computer Name dialog. In the “Primary DNS suffix for this
computer” box, enter the primary domain name for this computer. Figure 4-8 shows this
dialog.

Given the values in Figures 4-7 and 4-8, the primary DNS suffix
for this system is plant.example.com, and the DNS
suffix for this connection is sales.example.net. The “Append
parent suffixes of the primary suffix” checkbox impacts how these
domain names are used. If the checkbox had been selected with the
settings shown in Figures
4-7 and 4-8, a
request for the IP address of mandy generates a
query for mandy.plant.example.com,
then one for mandy.example.com (assuming the
first query was not successful), and finally one for mandy.sales.example.net
(assuming the second query was not successful). The system does not,
however, search example.net,
which is the parent domain of sales.example.net. If the
“Append parent suffixes of the primary suffix” checkbox is not
selected, a query for mandy would generate a
query for mandy.plant.example.com
and then one for mandy.sales.example.net.
No parent domains would be searched.

Defining your own domain search list is the alternative to using
the primary and connection DNS suffixes. To define your own search
list, click the “Append these DNS suffixes (in order)” option button.
This enables the Add, Edit, and Remove buttons. Click the Add button
to add a DNS suffix to the search list. Use the up and down arrows to
define the search sequence. Domains are searched in order from the top
to the bottom of the list. Figure 4-9 shows an example
domain search list.

With the configuration shown in Figure 4-9, a query for
mandy would generate queries for mandy.ohio.example.com,
mandy.iowa.example.com,
and mandy.texas.example.com,
in exactly that order. No other domains would be searched. Even the
domain provided in the “DNS suffix for this connection” box in Figure 4-9 is not searched
when an explicit search list is defined. When a search list is
provided, it must include all of the domains that you want
searched.

The two checkboxes at the bottom of the DNS tab configure
dynamic DNS. Selecting the “Register this connection’s address in DNS”
checkbox causes the system to attempt to register its IP address with
DNS using the hostname and domain defined for this system via the
Computer Name tab of the System Properties window. The “Use this
connection’s DNS suffix in DNS registration” checkbox is active only
if the first checkbox is selected. This checkbox causes the system to
also register its address using the hostname from the Computer Name
tab and the domain name from the “DNS suffix for this connection” box.
Of course, these client-side settings are only useful if you have a
server running dynamic DNS. Chapter
3 provides more information about dynamic DNS, and Chapter 6 provides information
about the server side of dynamic DNS.

The Windows Internet Name Service (WINS) maps NetBIOS names to
IP addresses, as described in Chapter 3. The WINS client needs
to know the address of the WINS server in order to use the server to
register its own name and resolve other NetBIOS names. The WINS client
can be configured through DHCP or manually configured through the WINS
tab shown in Figure 4-10.

The basic configuration of the WINS client is very
straightforward. Use the Add button in the “WINS addresses, in order
of use” pane to enter the IP addresses of the WINS servers this client
should use. Use the up and down arrows to define the order in which
the servers are used for registration and resolution. If no servers
are specified in this pane, the client will use broadcasting for
registration and resolution. Chapter 3 describes how WINS
registration and resolution functions.

Chapter 3 also
describes how the LMHOSTS file is created and
used. Mark the Enable LMHOSTS Lookup checkbox to
use the LMHOSTS file for NetBIOS name resolution.
The LMHOSTS file is located in the
%SystemRoot%\System32\Drivers\Etc folder. Use any
text editor to create an LMHOSTS file based on
the sample file Lmhosts.SAM, also located in this folder. You can
import an existing LMHOSTS file by clicking the
Import LMHOSTS button and browsing for the file.
The function of the Import LMHOSTS button is the
same as that of the #INCLUDE
command that can be placed inside the LMHOSTS
file. See Chapter 3 for a
detailed description of this file.

The three option buttons in the “NetBIOS setting” pane of the
WINS tab control whether or not NetBIOS over TCP/IP (NetBT) is
enabled, and how it is enabled. The functions of two of these buttons
are obvious: “Enable NetBIOS over TCP/IP” manually enables NetBT, and
“Disable NetBIOS over TCP/IP” manually disables it. Use these buttons
to manually control NetBT without regard to the DHCP configuration.
The Default button takes the NetBT setting from DHCP. If DHCP does not
provide a NetBT setting or DHCP is not used, the Default option
enables NetBT by default. Given the mix of NetBIOS network components
and the TCP/IP network component shown in Figure 4-3 for this sample
system, we need NetBT. Therefore, we would use either the Default
option or the “Enable NetBIOS over TCP/IP” option for this sample
configuration.

By default, the Options tab of the Advanced TCP/IP Settings
window lists only “TCP/IP filtering” in the “Optional settings” pane.
To filter incoming traffic based on ports and protocols, highlight
“TCP/IP filtering” and then click Properties to display the TCP/IP
Filtering dialog shown in Figure 4-11. Through this
dialog Windows Server 2003 allows you to control which TCP ports, UDP
ports, and IP Protocols are available to network users.

By default, Windows Server 2003 sets Permit All for all three
categories. This means that any network user can access any TCP/IP
service available on the server. Of course, this default could change
with the next service pack.

In Chapter 2 we saw
that each port number represents a network service and that each
protocol number identifies a protocol that communicates directly with
IP. You can control access to a network service or protocol by
controlling access to its TCP port, UDP port, or IP protocol. To
restrict one of these elements, click the Permit Only option button
for that pane, and use the Add and Remove buttons to list only those
ports or protocols that users will be permitted to access. Marking the
Permit Only option button for a pane and leaving the associated list
blank prohibits users from accessing any resources in that
category.

The port filtering defined in the TCP/IP Filtering dialog only
affects inbound traffic. Figure 4-11 shows a
possible configuration for a dedicated DNS server, which is configured
to permit only TCP and UDP port 53 (DNS), and only IP protocols, 1
(ICMP), 6 (TCP), and 17 (UDP). With these settings DNS would function
normally but other inbound connections would be blocked. For example,
this would prevent email from coming into the SMTP port but it would
not prevent the administrator of this system from sending email out to
some remote server’s SMTP port. Outbound traffic is not affected by
these filters.

The “Enable TCP/IP Filtering (All adapters)” checkbox, near the
top of the TCP/IP Filtering dialog, should be checked. If it is not
checked, the filtering configuration you build with this dialog will
not be used. The only time the “Enable TCP/IP Filtering (All
adapters)” checkbox should be unchecked is during network
troubleshooting, and then only for certain problems. If you have a
specific network application that is failing, it is possible that you
made a mistake when building your TCP/IP filters. Using this checkbox
you can temporarily disable the filters and retest the application. If
it still fails, the problem is not in the TCP/IP filters. If the
application runs with the filter disabled, the problem
might be the filter. In that case, you should
carefully examine the filter to see if you made a mistake entering
port numbers or protocol numbers.

Summary