Block 4 configures dynamic network parameter provisioning through DHCP Server and file distribution through an isolated IIS FTP Server. We analyze the 4-way DORA handshake, configure scope exclusions, distribute options 003, 006, and 015, lock down MAC address reservations, and configure FTP Passive Mode (PASV) data channels.
📡 The DHCP 4-Way Handshake (DORA Explained)
DORA Step-by-Step Breakdown:
- Discover (UDP Broadcast 0.0.0.0:68 -> 255.255.255.255:67): Client with no IP broadcasts requesting lease.
- Offer (UDP Unicast/Broadcast from Server): DHCP Server reserves an unallocated IP and offers it with lease time.
- Request (UDP Broadcast): Client formally informs all DHCP servers that it accepts the offer.
- Acknowledge (UDP): Server writes the active lease to its database and delivers DHCP Options (Gateway, DNS, Domain suffix).
⚙ DHCP Scope Options Reference
| Option ID | Standard Name | Configured Value in Lab | Functional Purpose |
|---|---|---|---|
| Option 003 | Router / Default Gateway | 192.168.10.1 |
Routes packets destined for outside the /24 subnet to the host adapter. |
| Option 006 | DNS Servers | 192.168.10.10 |
Directs clients to resolve hostnames via our local authoritative DNS server. |
| Option 015 | DNS Domain Name | lab.local |
Appends the primary DNS suffix automatically for single-label names (e.g. ping srv-01). |
Step 1: Install DHCP Role, Scope & Options
# 1. Install DHCP Server Feature & Initialize Security Groups Install-WindowsFeature -Name DHCP -IncludeManagementTools netsh dhcp add securitygroups | Out-Null Restart-Service -Name DHCPServer -Force # 2. Create Active IPv4 Scope (192.168.10.100 - 192.168.10.200) $scopeId = "192.168.10.0" Add-DhcpServerv4Scope -ScopeId $scopeId -Name "Lab-Subnet-10" ` -StartRange "192.168.10.100" -EndRange "192.168.10.200" ` -SubnetMask "255.255.255.0" -State Active # 3. Configure Static Exclusion Range (100 - 110) Add-DhcpServerv4ExclusionRange -ScopeId $scopeId -StartRange "192.168.10.100" -EndRange "192.168.10.110" # 4. Set Scope Options 003, 006, 015 Set-DhcpServerv4OptionValue -ScopeId $scopeId -OptionId 3 -Value "192.168.10.1" Set-DhcpServerv4OptionValue -ScopeId $scopeId -OptionId 6 -Value "192.168.10.10" Set-DhcpServerv4OptionValue -ScopeId $scopeId -OptionId 15 -Value "lab.local" # 5. Client MAC Address Reservation Add-DhcpServerv4Reservation -ScopeId $scopeId -IPAddress "192.168.10.150" -ClientId "00-15-5D-AA-BB-CC" -Name "Test-Lab-Client"
📁 FTP Active (PORT) vs Passive (PASV) Mode
| Mode | Control Connection (Port 21) | Data Channel Connection | Firewall / NAT Impact |
|---|---|---|---|
| Active Mode (PORT) | Client connects to Server:21 | Server initiates outbound connection from Port 20 to Client high port | Blocked by modern client firewalls & NAT routers. |
| Passive Mode (PASV) | Client connects to Server:21 | Client initiates outbound connection to Server dynamic port (50000-50100) | Standard & Firewall Friendly for cloud/virtual environments. |
Step 2: Deploy IIS FTP Server & Permissions
# 1. Install IIS FTP Role Install-WindowsFeature -Name Web-Ftp-Server, Web-Ftp-Service, Web-Ftp-Ext -IncludeManagementTools # 2. Create Directory Structure $ftpRoot = "C:\FTP_Root" New-Item -Path "$ftpRoot\Public", "$ftpRoot\Uploads" -ItemType Directory -Force | Out-Null # 3. Create FTP Site on Port 21 & "$env:SystemRoot\System32\inetsrv\appcmd.exe" add site /name:LabFTPSite /bindings:ftp://*:21 /physicalPath:$ftpRoot & "$env:SystemRoot\System32\inetsrv\appcmd.exe" set site "LabFTPSite" -ftpServer.security.authentication.anonymousAuthentication.enabled:true & "$env:SystemRoot\System32\inetsrv\appcmd.exe" set config "LabFTPSite" -section:system.ftpServer/security/authorization /+"[accessType='Allow',users='*',permissions='Read,Write']" /commit:apphost # 4. Open Firewall Rule Enable-NetFirewallRule -DisplayGroup "FTP Server"
Step 3: Verification & FTP Upload/Download Audit
& ".\scripts\04_Block4_DHCP_FTP\Verify-Block4.ps1"