Networking Study Platform
All study sets

Army Net.

Network and Active Directory lab study guide — switch, router, DNS, DHCP, and user account build in one place.

Domain
ArmyNet.mil
DC / DNS
10.0.0.10
DHCP network
192.100.X.0/24
Management VLAN
99
01

Lab variables

Values shown as <blank> must come from your station's addressing plan, SAAR, or instructor.

SymbolMeaning
XYour station number
XXAssigned data VLAN number
VLAN 99Management VLAN
VLAN 999Additional/unused VLAN used in the lab
DCDomain Controller
DC/DNS IP10.0.0.10
DomainArmyNet.mil
DHCP network192.100.X.0/24
Management switch IP192.99.X.2/24
02

Physical topology and port assignments

topology
Laptop ─── Switch ═══ Router ─── Instructor/Upstream Network
           Access     Trunk

Port assignments

  • Port/group 6: all switch ports except the trunk and laptop port
  • Port 5: laptop-to-switch access port
  • Port 2: switch-to-router trunk port
  • The switch-facing router interface uses subinterfaces for the data and management VLANs.

Recommended configuration order

  1. 1Connect and identify interfaces.
  2. 2Configure the switch.
  3. 3Configure the router.
  4. 4Configure DNS.
  5. 5Configure DHCP.
  6. 6Build the OUs.
  7. 7Create and configure users.
  8. 8Set the laptop to DHCP.
  9. 9Add the computer to the domain.
03

Switch configuration

A.Unused access ports

Apply this configuration to all ports except the trunk and laptop access port.

unused ports
interface range <unused-ports>
 switchport mode access
 switchport access vlan <assigned-vlan>
 switchport port-security
 switchport port-security maximum <value>
 switchport port-security violation <mode>
 shutdown

Important

The lab guidance specifies that unused ports should be shut down.

B.Laptop access port

laptop port
interface <laptop-port>
 switchport mode access
 switchport access vlan <data-vlan>
 switchport port-security
 switchport port-security maximum <value>
 switchport port-security violation <mode>

Do not shut down the laptop port.

C.Router trunk port

trunk port
interface <trunk-port>
 switchport mode trunk
 switchport trunk allowed vlan XX,99

The trunk must carry:

  • Data VLAN XX
  • Management VLAN 99

D.Switch virtual interfaces

data vlan
interface vlan XX
 description DATA
 ip address <data-svi-ip> <subnet-mask>
management vlan
interface vlan 99
 description MANAGEMENT
 ip address 192.99.X.2 255.255.255.0
vlan 999
interface vlan 999
 description <assigned-description>

E.Default gateway

The switch's default gateway should point to the router's management VLAN address.

ip default-gateway <router-management-ip>

F.Basic housekeeping and SSH

housekeeping
hostname <switch-hostname>
no ip domain-lookup
ip domain-name ArmyNet.mil
service password-encryption
banner motd #Authorized access only#
ip ssh version 2
crypto key generate rsa

Also configure the required:

  • Enable password or enable secret
  • Console password
  • VTY password or local login
  • Remote-management settings
04

Router configuration

This is a router-on-a-stick configuration. One physical router interface is divided into subinterfaces for multiple VLANs.

A.Data VLAN subinterface

data subinterface
interface g0/0/X.XX
 description DATA
 encapsulation dot1Q XX
 ip address <data-gateway-ip> <subnet-mask>
 ip helper-address 10.0.0.10

Why ip helper-address

DHCP clients send broadcasts, but the DHCP server is on another network. The router converts and forwards those DHCP broadcasts to the server at 10.0.0.10.

B.Management VLAN subinterface

management subinterface
interface g0/0/X.99
 description MANAGEMENT
 encapsulation dot1Q 99
 ip address <management-gateway-ip> <subnet-mask>

C.Instructor-facing interface

instructor interface
interface <instructor-facing-interface>
 description INSTRUCTOR
 ip address <assigned-ip> <subnet-mask>
 no shutdown

Make sure the physical router interface supporting the subinterfaces is also enabled.

interface g0/0/X
 no shutdown

D.OSPF

This lab uses OSPF process ID 100.

ospf
router ospf 100
 router-id <router-id>
 passive-interface g0/0/X.XX
 passive-interface g0/0/X.99
 network <instructor-network> <wildcard-mask> area <area>
 network <data-network> <wildcard-mask> area <area>
 network <management-network> <wildcard-mask> area <area>

Why the VLAN interfaces are passive

A passive interface:

  • Advertises its connected network through OSPF
  • Does not send OSPF hello packets
  • Does not try to form an OSPF neighbor relationship with end devices

E.Router housekeeping

Configure:

  • Hostname
  • Passwords
  • Password encryption
  • MOTD banner
  • Remote management and SSH
05

DNS configuration

Create a secondary forward lookup zone.

A.Add the DNS server

  1. 1Open DNS Manager.
  2. 2Highlight or right-click DNS.
  3. 3Select Add Server.
  4. 4Enter the Domain Controller's IP address.
  5. 5Click OK.

B.Create the secondary zone

  1. 1Expand the DNS server.
  2. 2Right-click Forward Lookup Zones.
  3. 3Select New Zone.
  4. 4Click Next.
  5. 5Select Secondary Zone.
  6. 6Click Next.
  7. 7Enter the zone name ArmyNet.mil.
  8. 8Enter the master DNS server IP 10.0.0.10.
  9. 9Click Next, then Finish.

C.Allow zone transfers

On the server hosting the primary zone:

  1. 1Highlight the ArmyNet.mil zone.
  2. 2Right-click it and select Properties.
  3. 3Open the Zone Transfers tab.
  4. 4Check Allow zone transfers.
  5. 5Click Apply, then OK.

Note

Without zone transfers, a secondary DNS server cannot receive a copy of the zone data.

06

DHCP configuration

Important

X represents your station number.

A.Authorize and connect to the server

  1. 1Open DHCP Manager.
  2. 2Right-click DHCP and select Authorize if it is unauthorized.
  3. 3Right-click DHCP and select Add Server.
  4. 4Enter the Domain Controller's IP.
  5. 5Click OK.

B.Create the IPv4 scope

  1. 1Expand the DHCP server.
  2. 2Right-click IPv4.
  3. 3Select New Scope.
  4. 4Name the scope Station X – DHCP.

C.Address range

scope range
Starting IP: 192.100.X.1
Ending IP:   192.100.X.254
Subnet mask: 255.255.255.0

D.Exclusions and reservations

The lab uses an exclusion beginning at 192.100.X.1 and ending at an instructor-assigned host number 192.100.X.XX.

Use this exclusion range to protect addresses assigned to infrastructure, such as:

  • Router/default gateway
  • Servers
  • Printers or other statically addressed devices
  • Reserved systems

E.Lease duration

Set the lease duration to 1 day.

F.DHCP options

OptionValue
Router / default gateway192.100.X.1
DNSAlready populated — verify it points to the correct DNS/DC server.
WINSEnter the Domain Controller's IP address and click Add.

G.Activate the scope

  1. 1Select Yes, activate this scope now.
  2. 2Click Next.
  3. 3Click Finish.

H.Configure the laptop

After DHCP setup is complete, configure the laptop's adapter to:

Obtain an IP address automatically
Obtain a DNS server address automatically

Important

Do not forget this step before testing DHCP.

07

Organizational unit structure

DC means Domain Controller. Create the following structure in Active Directory Users and Computers.

OU hierarchy
TrainingOrg
├── Users
│   ├── S1
│   └── S6
└── Computers
    ├── S1
    └── S6

This separates user accounts from computer accounts and then organizes them by section.

08

User naming standards

A.Full name and display name

format
LAST, First MI RANK/CIV

Military example:  <Last>, <First> <MI> <Rank>
Civilian example:  <Last>, <First> <MI> CIV

Use:

  • The person's military rank for military users
  • CIV for civilian or GS users

The displayed name and the name shown outside the user object should match.

B.User logon name

format
first.mi.last.mil
first.mi.last.civ

Use lowercase letters and periods between each portion.

09

User properties

A.General tab

FieldExample
First name<First>
Initial<MI>
Last name<Last>
Display name<Last>, <First> <MI> <Rank/CIV>
Description<Authorized role / rank>
Office<Authorized unit / section>
Telephone<Authorized contact number>
EmailLeave blank
Web pageLeave blank

SAAR references

  • Description: use Block 6 of the SAAR
  • Telephone: use Block 4 of the SAAR
  • Section/OU membership: use Block 13

The course notes state that the email field will automatically populate after the user is added to the appropriate system.

B.Address tab

address
Street:   <Authorized street / building>
City:     <City>
State:    <State>
ZIP:      <ZIP code>
Country:  <Country>
PO Box:   Leave empty if not required

C.Member Of tab

  1. 1Click Add.
  2. 2Enter the first letter or number of the unit/group.
  3. 3Click Check Names.
  4. 4Select either S1 or S6, depending on Block 13 of the user's SAAR.
  5. 5Click OK.
  6. 6Click OK again.
  7. 7Click Apply.

D.Account tab

  1. 1Locate Account expires.
  2. 2Set the expiration date to the authorized date from the source paperwork or instructor.
10

Final verification checklist

Work through each area before calling the lab complete.

0 of 30 verified
x

Ticks are saved in this browser only.

Switch

Router

Server

Active Directory

Client computer