Windows Server 2012 R2 IPAM for Clouds

Windows Server 2012 ReCap

• Existing IPAM options: Spreadsheets, in-house tools, commercial appliances
• In-box IPAM: Compliments DNS and DHCP services. Ability to organize, assign and monitor IPv4 and IPv6 addresses.
• Automatic discovery of DC, DHCP and DNS servers dynamic IP addresses
• Track and audit changes and provide real-time view of service status
• Multi-server management to manage all DNS and DHCP servers
• DHCP and DNS have major new features: DHCP failover (active/active config), DHCP policies (group difference devices and assign different address to them (e.g. printers, phones for proxy settings, etc.). DNSSEC cache poisoning protection.

R2 Address Space Demo:

• Shows IPAM DHCP scope utilization and health status
• Shows you can now group IP address blocks by geographic regions. You can then filter views by region and drill down into countries or regions and see all scopes and IP address assignments.

Server 2012 R2 Enhancements

• WS 2012 R2 Network environment: Host or Enterprise, multi-tenant and multiple datacenters with virtual networks
• Ability to setup DHCP failover across datacenters
• Supports virtual networks (administered by Fabric administrators)

IPAM 2012 R2 Enhancements

• IPAM now manages and monitors both physical and virtual addresses
• Integrated with VMM 2012 R2 and makes all address info available to VMM
• All-new role based access control in IPAM. Granular control over what admin tasks people can perform.
• Plan, design and administer IP address schemes of virtualized datacenters
• Support network isolation WNV, VLAN
• Enhanced service monitoring
• Single and multi-entity configuration of reservations, scopes, failovers, policies, filters, etc.
• External database support (SQL)
• CIM based PowerShell – 100% parity with GUI

Virtualized Networks

• Provider address space: Physical network address space
• Logical networks in VMM are customer address space
• Customer can bring in their own address space, which may overlap with other address spaces
• Must deploy network virtualized networks (e.g. NVGRE) to keep address spaces isolated

IPAM-VMM Integration

• IPAM has a view of both physical and virtualized address space
• Network admin tasks (fabric layer): Configure address space, subnets, pools, VLANs. Then creates subnets, pools and logical networks, and then the config is pushed to VMM. Changes in VMM are pushed back to IPAM. Conflict detection, notification and updates, changes and meta-data are all synchronized. All configuration is done in IPAM by the network admin.

IPAM-VMM Demo

• New “Virtualized Address Space” node in IPAM
• “Managed by Service” column that shows VMM or IPAM service that controls the subnet config
• “Service instance” column shows which VMM instance is assigned that subnet. Subnet now appears in VMM console.
• Shows VMM synchronization with IPAM when subnets are pushed to VMM
• When creating a VM network in VMM, he shows that the config is pushed to IPAM as a customer network

Role Based Access Control

• Granular admin control within IPAM, DNS, DHCP. Five step process:
• 1) Define a user role (operations an admin can perform)
• 2) Define business hierarchy model based on the desired administration levels and controls
• 3) Define access policy based on configured use role and access scope and associate users or groups
• 4) Set/associate access scope to objects in IPAM
• 5) New access control for leaf nodes or inherited from parent

DHCP/DNS Integration

• Monitoring: Server availability, DHCP scope utilization, DNS zone health, DHCP failover health
• Management: DHCP server, scopes, properties, options, filters, policies, classes, DNS records, etc.

DHCP Management and RBAC Demo

• Shows the ability in IPAM to configure DHCP scope failover on remote DHCP servers
• Shows the new “Access control” node in IPAM. 12+ pre-configured roles. Shows the ability to create a new custom role. Dozens of operations available to delegate and add to a custom role.
• Shows the ability to create network hierarchies (e.g. in a city you can create a building).
• Shows the ability to create an “Access Policy”, then bind the access policy to a DHCP scope for delegation
• Shows the creation of a new R2 ”FQDN” DHCP policy in the IPAM tool. Able to specify that all clients that do NOT contain *.contoso.com in their hostname get registered in DNS with guest.com instead.

External System Integration

• IPAM PowerShell interface facilitates integration with other external systems like SCCM and MAP toolkit
• Integration with AD Directory Services enables synchronization of site and services and subnets information

原文来自：http://www.derekseaman.com