Master advanced Windows Server networking features including NIC Teaming, Software Defined Networking, and network security technologies.
Combine multiple network adapters for bandwidth aggregation and failover.
NIC Teaming bonds two or more physical adapters into a single logical interface, giving you both bandwidth aggregation and automatic failover if a link drops.
Once the team is created, you can assign VLANs to it so a single team carries traffic for multiple network segments.
Understanding teaming modes and algorithms is critical for choosing the right configuration.
LACP teams require matching configuration on both the server and the physical switch. The HyperVPort algorithm is ideal when the server hosts virtual machines.
After creating a team, verify its configuration and check that all members are active and healthy.
Checking individual member status confirms each physical NIC is participating and shows its current role in the team.
DHCP failover provides high availability for DHCP services without requiring a cluster.
Load Balance mode splits the address pool evenly between two DHCP servers so both actively serve clients. The shared secret authenticates replication traffic between the partners.
Hot Standby mode designates one server as active and the other as a reserve. The standby only takes over when the active server becomes unreachable.
DNS policies enable advanced query handling based on client location, time of day, or query type.
Before creating DNS policies, you must define client subnets so the DNS server can identify where queries originate from.
Zone scopes let a single DNS zone serve different records depending on which policy matches the incoming query.
Add a resource record to the branch scope so branch clients resolve to their local application server instead of the HQ server.
The resolution policy ties everything together: when a client from the branch subnet queries, DNS returns the branch scope answer.
Split-brain DNS serves different answers for the same hostname based on whether the client is internal or external.
The default zone scope already holds the internal record (app.hexworth.local = 10.0.1.50). Create an external scope to hold the public-facing answer.
Add the same hostname to the external scope, but pointing to the public IP address so external clients reach the edge server.
The policy matches any query that does NOT come from the internal subnet and directs it to the external scope, achieving split-brain resolution from a single DNS server.
DNSSEC adds cryptographic signatures to DNS records to prevent spoofing and tampering.
Signing a zone generates the KSK and ZSK automatically, then creates RRSIG records for every existing DNS record in the zone.
Resolving servers need trust anchors to validate signatures. The DS record digest ties the child zone key to the parent zone trust chain.
After signing, verify the zone's DNSSEC settings to confirm it is actively signed and which algorithms are in use.
IPAM provides centralized management of the IP address space across multiple DHCP and DNS servers.
IPAM requires its Windows feature to be installed first. The management tools include both the Server Manager snap-in and PowerShell module.
Provisioning initializes the IPAM database. The WID (Windows Internal Database) option is simpler for smaller environments.
After provisioning, discover DHCP, DNS, and domain controller servers across the domain so IPAM can begin tracking their address spaces.
Once servers are discovered, query subnet utilization to identify address pools nearing exhaustion before they become a problem.
NPS is Microsoft's implementation of RADIUS for centralized network access authentication and authorization.
The Network Policy and Access Services (NPAS) role includes NPS, the RADIUS server, and its management console.
Registering NPS in Active Directory grants the server permission to read user account dial-in properties for authentication decisions.
Each network device that sends authentication requests to NPS must be registered as a RADIUS client with a matching shared secret.
Windows Server supports multiple VPN protocols through the RRAS (Routing and Remote Access Service) role.
The RRAS role provides both VPN and routing capabilities. Installing both roles enables the server to act as a VPN gateway with routing support.
After installing the role, configure the Remote Access service specifically for VPN connections.
The VPN address pool defines which IP addresses are handed to connecting VPN clients. Size this range based on your expected concurrent user count.
DirectAccess provides seamless, always-on remote connectivity without traditional VPN connections.
DirectAccess requires the same Remote Access role as VPN. The feature name includes both capabilities in a single package.
FullInstall mode deploys DirectAccess with all components. The ConnectToAddress is the public hostname clients use to reach the DA server.
Force tunneling routes all client traffic through the corporate network, not just internal destinations. This gives IT full visibility into remote client traffic.
BranchCache reduces WAN bandwidth consumption by caching content locally at branch offices.
BranchCache must be installed as a feature on the content servers at headquarters before branch clients can start caching.
In Distributed Cache mode, branch office clients share cached content peer-to-peer without needing a dedicated cache server.
Individual file shares must be explicitly enabled for BranchCache. Only shares with this setting generate content hashes for branch clients.
After configuration, verify the overall BranchCache status to confirm the service is running and which mode is active.
Virtual LANs segment network traffic at Layer 2 for security and performance.
Tagging a physical adapter with a VLAN ID restricts it to only that VLAN's traffic. The switch port must be configured as an access or trunk port accordingly.
For Hyper-V environments, you assign VLANs at the virtual NIC level so each VM can be placed on its own network segment.
SDN separates the control plane from the data plane for programmable networks.
SDN virtual networks are created through the Network Controller's REST API. The properties object defines the address space and subnet structure.
Hyper-V Network Virtualization enables overlay networks that decouple virtual networks from the physical infrastructure.
Virtual network properties are defined as a PowerShell hashtable before being sent to the Network Controller REST API. This example creates a two-tier network with web and app subnets.
Windows Firewall provides stateful packet filtering and application-aware protection.
Inbound rules control what traffic is allowed to reach the server. This rule opens port 443 for HTTPS connections from any source.
Outbound rules restrict what traffic leaves the server. Blocking legacy insecure protocols like Telnet prevents accidental use of unencrypted sessions.
Internet Protocol Security provides authentication and encryption at the network layer.
IPsec rules enforce encryption between hosts. Requiring both inbound and outbound security ensures all traffic to and from the target subnet is encrypted.
Quick Mode Security Associations show active IPsec tunnels between hosts, confirming encryption is working in real time.
QoS policies prioritize network traffic to ensure performance for critical applications.
DSCP marking tags packets with a priority value so network switches and routers give them preferential treatment. DSCP 46 is the Expedited Forwarding class used for real-time voice.
Throttle policies cap bandwidth for non-critical applications so they cannot saturate the network during business hours.
NAT enables private network addresses to communicate with public networks.
Windows Server NAT translates private IPs for an entire subnet. This is commonly used with Hyper-V internal switches to give VMs internet access.
Static port mappings forward specific external ports to internal servers, allowing you to publish services behind the NAT.
Troubleshoot network issues with built-in Windows tools and PowerShell cmdlets.
Test-NetConnection is the PowerShell replacement for telnet and ping combined. It tests both ICMP reachability and TCP port connectivity in a single command.
Grouping active TCP connections by remote address quickly reveals which external hosts your server communicates with most.
For deep packet analysis, netsh trace captures raw network traffic into an ETL file that can be opened in Message Analyzer or converted to pcap.
Practice advanced networking configuration through both interfaces.