Business Model - Create and Thrustling Group Policy in Windows Vista

Transcription

1 Bandwidth with Policy-Based Quality of Service Page 1 of 11 Managing Windows Vista and Windows Server Longhorn Network Bandwidth with Policy-Based Quality of Service Abstract Policy-based Quality of Service (QoS) in Windows Vista and Windows Server Longhorn enables administrators, via Group Policy, to create flexible rules that can prioritize or throttle outbound network traffic without changes to existing applications and in conjunction with your existing network routing infrastructure. QoS policies can be applied based on any, or all, of the following conditions: sending application, source or destination IP address, protocol, and source or destination port. Additionally, QoS policies can be uniquely defined for sets of user or computer accounts through policy deployment. You will get hands-on experience in creating and managing QoS policies. Note that this lab is built using BETA software. Some steps in this lab document may not function as expected at all times. Objectives At the end of this lab, you will be able to: Adjust the priority of network traffic based on application name, ip address, port and protocol Implement QoS controls using Group Policy Monitor QoS controls to ensure they are functioning Scenario The company is implementing a mission-critical line-of-business application that requires a guaranteed amount of network bandwidth. Large file transfers, however, are starving out all other traffic on the LAN. The application was not originally designed to be QoS aware, and is not capable of reserving bandwidth on its own. Your LAN switches do not have QoS flow-control capabilities, although your routers do. You need to increase the application s priority while lowering the priority of all other traffic. You also need to restrict the flow of file transfer traffic on the LAN so that the application has enough bandwidth to operate. These settings must be applied at the transmitting source, by the client operating system.

2 Bandwidth with Policy-Based Quality of Service Page 2 of 11 Prerequisites You should be familiar with the following products or technologies before you begin this lab: Traffic shaping and quality of service, specifically the use of DSCP (Differentiated Services Code Point) NetBIOS and FTP file transfer protocols Active Directory Group Policy Objects Performance Monitor, Network Monitor, gpresult.exe and gpupdate.exe Duration This lab is 60 minutes in duration. Background Information VistaLabs_DC1: Windows Server 2003 Domain Controller/file server/ftp server, preconfigured with Network Monitor VistaLabs_Client1: Windows Vista client workstation For More Information Microsoft TechNet - Policy-based QoS Architecture in Windows Server "Longhorn" and Windows Vista Microsoft Download Center - Quality of Service in Windows Server "Longhorn" and Windows Vista 807e-97e8a0cb9703&displaylang=en Support Information This lab is built and supported by HynesITe, Inc. See what s possible at

3 Bandwidth with Policy-Based Quality of Service Page 3 of 11 Exercise 1 Throttle File Transfer Traffic with the QoS Policy Wizard In this exercise you will identify how much bandwidth a client NetBIOS file transfer consumes. You will then use the Windows Vista QoS Policy Wizard to create a policy to limit the amount of bandwidth clients can use when uploading to the file server. You will link this policy to an Active Directory organizational unit that contains the client computer account. You will then perform the test upload again and observe the results, verifying that the policy only applies to client NetBIOS file transfers. Prepare the lab In this task you will move the Client1 computer account into the Client Computers organizational unit in Active Directory. Note: Perform this Exercise on DC1. 1. Log on to DC1 as administrator@contoso.com with a password of P@ssw0rd. 2. On the Start menu, click Run. 3. In the Run dialog box type dsa.msc then click OK. 4. In the Active Directory Users and Computers console, under contoso.com domain, click the Computers container. 5. In the right-hand pane, right click Client1 and then click Move 6. In the Move dialog box, under contoso.com domain, expand the Managed Objects expand Client Computers and select the Desktops organizational unit and then click OK. 7. Close Active Directory Users and Computers. 8. Log off of DC1. Create a custom administrative tool In this task you will add Performance Diagnostic Tools to a customized console to facilitate the lab exercises. Note: Perform this Exercise on Client1. 1. Log on to Client1 as administrator@contoso.com with a password of P@ssw0rd. 2. On the Start menu, in Start Search type mmc then press ENTER. 3. On the File menu, click Add/Remove Snap-in. 4. Under Available snap-ins: select Performance Diagnostic Console. Click Add and then click OK. 5. In the Console1 window, expand Performance Diagnostics (Local)\Monitoring Tools and select Performance Monitor. 6. In the middle pane, right click the white graph area, and then click Add Counters.

4 Bandwidth with Policy-Based Quality of Service Page 4 of In the Add Counters dialog box, under Available Counters, expand Network Interface, and then select Bytes Sent/sec. You will have to scroll up to find Network Interface. 8. In the Instances of selected object scroll box, select Intel Based PCI Fast Ethernet Adapter (Emulated), click Add and then click OK. 9. In the Performance Monitor window, in the middle pane at the bottom, select the Bytes Sent/sec counter to highlight it and activate the Last and Maximum statistics boxes. Notice the little scroll buttons to the right of the counters. You may need to scroll down to see the Bytes Sent/sec counter. 10. In the Console1 menu, click File and then click Save As. 11. In the Save As dialog box, in the Save in: drop-down box select Desktop. In the File Name: text box type My Console and then click Save. 12. Leave My Console open and maximized. You should now have a Performance Monitor console shortcut on your desktop. Perform a test upload In this task you will map a drive to the file share on DC1 and perform a netbios test upload, using the monitoring tools to observe network utilization. 1. On the Client1 Start menu, in Start Search type cmd then press ENTER. 2. In the Command Prompt window, type net use x: \\DC1\files /persistent:yes then press ENTER. 3. In the Command Prompt window type copy /y C:\Windows\Media\*.wav x: then press ENTER to start uploading the *.wav files. 4. Quickly toggle back to My Console, and select Performance Monitor to observe the Last and Maximum number of Bytes Sent/sec being reported. 5. In My Console, select Performance Diagnostic (Local). 6. In the Resource Overview pane, observe the moving Network graph, and repeat Step 3 to cross-reference your findings with the Performance Monitor report. In our test lab, Performance Monitor reported a maximum rate of approximately 2 megabytes/sec. Performance Diagnostic Tools reported a peak rate in excess of 10 megabits/sec. Your numbers may be different. 7. Close My Console. If prompted to save changes, click No. 8. Close the Command Prompt. Create and deploy a bandwidth-throttling Group Policy In this task you will use the Group Policy Object Editor to create a policy to throttle netbios file transfer bandwidth. You will then use Group Policy Manager to link the policy to the Active Directory organizational unit that contains the client computer account.

5 Bandwidth with Policy-Based Quality of Service Page 5 of On the Client1 Desktop, launch My Console. 2. In the My Console window, click File, and then click Add/Remove Snap-in. 3. In the Add/Remove Snap-in dialog box, select Group Policy Management, click Add, and then click OK. 4. In the My Console window, expand Group Policy Management, expand Forest: contoso.com, expand Domains, expand contoso.com. 5. Under contoso.com, right click Group Policy Objects and click New. 6. In the New GPO dialog box, type Bandwidth Throttling Policy and click OK. 7. Under contoso.com, expand Group Policy Objects. 8. Right click Bandwidth Throttling Policy and click Edit. 9. In the Group Policy Object Editor window, under Computer Configuration, expand Windows Settings. It is important that you perform this under Computer Configuration, not User Configuration. 10. Right click Policy based QoS and create a new policy with the following information and then click Finish.: Policy Name: File Transfer Bandwidth Throttling Specify DSCP Value: 0 Specify throttle Rate: 64 KBps This QoS policy applies to: All Applications This QoS policy applies to: Any source IP address Only the following destination IP address: Select the protocol this QoS policy applies to: TCP Specify the source port number: From any source port Specify the destination port number: Close the Group Policy Object Editor. 12. In My Console, under the contoso.com domain, expand the Managed Objects organizational unit, and then expand the Client Computers organizational unit. 13. Right click the Desktops organizational unit, then click Link an Existing GPO. 14. Select Bandwidth Throttling Policy then click OK. 15. Close My Console. If prompted to Save changes, click Yes. Perform a new test In this task you will apply your new bandwidth throttling group policy and perform a new file transfer test, comparing the results to your earlier test. You will also verify the selectiveness of the policy by performing another file transfer using a different protocol. 1. On the Client1 Desktop, on the Start menu, in Start Search type cmd and then press ENTER. 2. In the Command Prompt window type gpupdate /force /target:computer, then press ENTER. Wait for the message that the refresh has completed successfully.

6 Bandwidth with Policy-Based Quality of Service Page 6 of Type gpresult then press ENTER to verify that the policy has been applied. 4. Scroll through the results. Under COMPUTER SETTINGS, under Applied Group Policy Objects you should see the policies listed in this order: 1. Bandwidth Throttling Policy 2. Default Domain Policy 5. In the Command Prompt window, type copy /y C:\Windows\Media\*.wav x: then press ENTER to start uploading the *.wav files. 6. On the Desktop quickly launch My Console and select Performance Monitor to observe the results. Has the bandwidth been throttled back to approximately 64 Kilobytes per second? 7. The answer should be yes. 8. In My Console select Performance Diagnostics (Local). 9. In the Resource Overview pane, observe the moving Network graph. Crossreference your findings with the Performance Monitor report. If necessary, repeat Step 3 to re-capture statistics. Wait until the file transfer is complete. 10. Verify that the bandwidth throttling policy does not apply to other kinds of traffic. In the Command Prompt window, type ftp When prompted for a username, type anonymous. When prompted for a password, press ENTER. 12. Type bin then press ENTER. 13. Type prompt then press ENTER. 14. Type mput c:\windows\media\*.wav then press ENTER 15. If Windows Security Alert asks if you want to keep blocking this program click Unblock. 16. Quickly switch to My Console, Performance Monitor, and then to Performance Diagnostics (Local) to observe the results. If necessary, repeat Steps 7 11 to recapture statistics. 17. Does the Bandwidth Throttling Policy also apply to an ftp upload? 18. The answer should be no, because ftp uses tcp port 20 to transfer data. 19. Close all windows. If prompted to Save My Console, click No. 20. Log off of Client1.

7 Bandwidth with Policy-Based Quality of Service Page 7 of 11 Exercise 2 Set the DSCP Value of a Line-Of-Business Application Using the QoS Policy Wizard Windows Vista QoS Policy Wizard gives the administrator new flexibility to manage traffic from the source. In this exercise, you will capture network traffic generated by a non-qos aware application named Newapp.exe to observe its default IP Type of Service priority setting. You will then create a group policy changing the differentiated services code point (DSCP) value of Newapp.exe to a high priority value. The local router can then use this value to place Newapp.exe s traffic in a high-priority queue. You will also create a new group policy setting the priority of all other traffic to a low best effort value. You will link these policies to the Client Computers organizational unit where the client computer account resides. You will then use Network Monitor to verify the results. Measure the default QoS setting for Newapp.exe traffic In this task you will use Network Monitor on DC1 to capture traffic generated by a line-ofbusiness application named Newapp.exe. You will examine the packets to determine the default priority value in the IP header s Type of Service field. Note: Perform these steps on DC1. 1. Log on to DC1 as administrator@contoso.com with a password of P@ssw0rd. 2. On the Start menu, click Administrative Tools, and then click Network Monitor. Note: If a message box pops up asking for a specific network, click OK. 3. In the Select a Network dialog box, expand Local Computer, click Internal, and then click OK. 4. In the Network Monitor window click Capture, and then click Start. 5. Leave Network Monitor running. Note: Perform these steps on Client1. 6. Log on to Client1 as administrator@contoso.com with a password of P@ssw0rd. 7. On the Start menu, in Start Search type cmd then press ENTER. 8. In the Command Prompt window type c:\testnewapp.cmd then press ENTER. For the purposes of our lab, testnewapp.cmd is a batch file that runs newapp.exe (a renamed copy of ftp.exe) 9. If Windows Security Alert notifies you that it is blocking this program, click Unblock. 10. The batch file tells you that newapp is running. When prompted, press any key. Wait until newapp is finished. Note: Perform these steps on DC1.

8 Bandwidth with Policy-Based Quality of Service Page 8 of On DC1 in the Network Monitor window, click Capture, and then click Stop and View. 12. In the Capture: 1 (Summary) Window, scroll down and double click any frame where: Dst Mac Address = LOCAL, Protocol = FTP, Description = Data Transfer to Server 13. In the middle pane, expand IP: Protocol = TCP. 14. Expand IP: Type of Service. 15. What is the IP Precedence? 16. The answer should be Routine, with a value that looks like this: IP: 000. = Precedence Routine 17. Close Network Monitor. If you are prompted to Save the capture, click No. Create and deploy the DSCP policies In this task you will use the Group Policy Object Editor to create a policy that will change the DSCP value of Newapp s traffic from a low best effort to a high priority. You will also create a new policy setting all other traffic to best effort. You will link both policies to the Active Directory organizational unit that contains the client computer account. You will then refresh the policy on the client. Note: Perform these steps on Client1. 1. On the Client1 Desktop launch My Console. 2. In the My Console window, expand Group Policy Management, expand Forest: contoso.com, expand Domains, and then expand contoso.com. 3. Under contoso.com right click Group Policy Objects, and then click New. 4. In the New GPO dialog box, type Newapp DSCP Policy, and then click OK. 5. Under contoso.com, expand Group Policy Objects, right click Newapp DSCP Policy, and then click Edit. 6. In the Group Policy Object Editor window, under Computer Configuration, expand Windows Settings. It is important that you perform this under Computer Configuration, not User Configuration. 7. Under Windows Settings, right click Policy-based QoS and create a new policy with the following information and then click Finish: Policy Name: DSCP for Newapp Specify DSCP Value: 18 Specify Throttle Rate: unselected Only applications with this executable name: newapp.exe This QoS policy applies to: Any source IP address This QoS policy applies to: Any Destination IP Address Specify the protocol this QoS policy applies to: TCP

9 Bandwidth with Policy-Based Quality of Service Page 9 of 11 Specify the source port number: From any source port Specify the destination port number: To any destination port 8. Close the Group Policy Object Editor. 9. In the My Console window under Group Policy Management, under contoso.com right click Group Policy Objects and then click New. 10. In the New GPO dialog box, type Default DSCP Policy, and then click OK. 11. Under Group Policy Objects, right click Default DSCP Policy, and then click Edit. 12. In the Group Policy Object Editor window, under Computer Configuration, expand Windows Settings. It is important that you perform this under Computer Configuration, not User Configuration 13. Under Windows Settings, right click Policy-based QoS and create a new policy with the following information and then click Finish: Policy Name: DSCP for All Other Traffic Specify DSCP Value: 0 Specify throttle Rate: unselected This QoS policy applies to: All applications This QoS policy applies to: Any source IP address This QoS policy applies to: Any Destination IP Address Select the protocol this QoS policy applies to: TCP Specify the source port number: From any source port Specify the destination port number: To any destination port 14. Close the Group Policy Object Editor. 15. In the My Console window, under Group Policy Management, under the contoso.com domain, expand the Managed Objects organizational unit, and then expand the Client Computers organizational unit. 16. Right click the Desktops organizational unit, then click Link an Existing GPO. 17. Select Newapp DSCP Policy then click OK. 18. Right click the Desktops organizational unit again and click Link an Existing GPO. 19. Select the Default DSCP Policy then click OK. 20. Click the Desktops organizational unit to highlight it. 21. In the middle Desktops pane, in the Linked Group Policy Objects tab, use the up/down arrow buttons to the left of the list to arrange the policies in the following Link Order: 1. Newapp DSCP Policy 2. Bandwidth Throttling Policy (created in the previous exercise) 3. Default DSCP Policy It is very important that the Newapp DSCP Policy be at the top of the list, with the Default DSCP Policy at the bottom. If they are not in this order, the test will not work as expected. If you no longer have the Bandwidth Throttling Policy, that s ok.

10 Bandwidth with Policy-Based Quality of Service Page 10 of Open the Command Prompt. 23. Type gpupdate /force /target:computer, then press ENTER. Wait for the message that the refresh has completed successfully 24. Type gpresult then press ENTER to verify that the policies have been applied. 25. Scroll through the results. Under COMPUTER SETTINGS, under Applied Group Policy Objects you should see the policies listed in this order: 1. Newapp DSCP Policy 2. Bandwidth Throttling Policy (created in the previous exercise) 3. Default DSCP Policy 4. Default Domain Policy 26. Close all windows Perform a new test In this task you will perform a new file transfer test, comparing the results to your earlier test. You will then verify the selectiveness of the policy by performing another file transfer using a different protocol. Note: Perform these steps on DC1. 1. On the DC1 open Network Monitor. 2. In the Microsoft Network Monitor window click Capture, and then click Networks. 3. If the Select a Network dialog box opens, expand Local Computer. Click Internal, and then click OK. 4. In the Network Monitor window click Capture, and then click Start. 5. Leave the Network Monitor packet capture running. Note: Perform these steps on Client1. 6. On Client1, open a Command Prompt. 7. Type c:\testnewapp.cmd then press ENTER. 8. If Windows Security Alert notifies you that it is blocking this program, click Unblock. 9. The batch file tells you that newapp is running. When prompted, press any key. Wait until newapp is finished. Note: Perform these steps on DC In DC1 s Network Monitor window click Capture, and then click Stop and View. 11. In the Capture: 1 (Summary) Window, scroll down and double click any frame where: Dst Mac Address = LOCAL, Protocol = FTP, Description = Data Transfer to Server 12. In the middle pane, expand IP: Protocol = TCP.

11 Bandwidth with Policy-Based Quality of Service Page 11 of Expand IP: Type of Service. 14. What is the IP Precedence this time? 15. The answer should be Immediate, with a value that looks like this: IP: 010. = Precedence Immediate 16. On the Network Monitor menu click File, and then click Close. 17. On the Network Monitor menu, click Capture, and then click Start. 18. If Network Monitor prompts you to save the previous capture, click No. It is important that you start a separate packet capture for the next file upload. In this beta version, trying to capture both uploads in a single packet capture does not work properly. 19. Leave the Network Monitor packet capture running. Note: Perform these steps on Client On Client1, open a Command Prompt. 21. Type copy /y c:\windows\media\*.wav x: then press ENTER. 22. As the files are uploading, check the packet capture on DC You need not wait for the entire upload to complete before moving on to the next step. Note: Perform these steps on DC In DC1 s Network Monitor window click Capture, and then click Stop and View. 25. In the Capture: 1 (Summary) Window, scroll down and double-click any frame where: Dst Mac Address = LOCAL, Protocol = SMB, Description = C Write & X 26. Is the IP: Type of Service now Precedence Routine? 27. The answer should be yes, with a value that looks like this: IP: 000. = Precedence Routine. 28. Close all Windows. If prompted to Save My Console, click No. 29. Log off of DC Log off of Client1.