The Tech Journal

Static IP vs DHCP Reservation

May 072019

In the many years I’ve been providing IT Services, I’ve noticed that whenever taking over a customer from a competitor, or providing consulting services for a company that has IT staff, that I don’t see DHCP reservations being used all that frequently.

I wanted to write a post and create a video to discuss the comparison, when each should be used and the various case scenarios. I’m hoping my readers may provide their own input in the comments.

See below for the video, or read on for the blog post!

As an example: When a customer was purchasing a VoIP PBX, the PBX vendor get angry when I requested that it be configured for DHCP so that a DHCP reservation could be used, I advised I’d prefer this method so I could change the IP when needed for maintenance or network restructuring. They tried to convince me the IP will change on a DHCP Server and the port forwarding will stop working, because they simply had no idea of what a DHCP reservation was. Ultimately when the day came where I had to change the IP and firewall rules for the PBX, I had to log a support call with the vendor since I couldn’t change the IP myself (which resulted in delays, and costs). If we were using DHCP reservations, I could have simply modified the firewall rules, modified the IP address on the reservation, and restarted the device using the buttons on the front panel (I didn’t have any other access to the device).

Just to state the obvious:

A static IP address is an IP address that’s manually set on a NIC (Network Interface Card).
A DHCP Reservation is a pre-set IP that’s provided by a DHCP Server, and given to a NIC when a NIC calls out to a DHCP server for an IP address.

Static IP Addresses

It’s in my opinion that for server, network, core, and all top level infrastructure, all of these devices and services should be configured with Static IP addresses.

These devices which are almost always running, and have other services that rely on them, require a set static IP that should and will not change. Typically, these IP addresses will never change, even when major changes are being made to the core infrastructure.

These addresses should always be logged, documented, and added to network topology maps.

An example of devices commonly seen with Static IPS:

Servers
Storage (SAN, NAS)
Network Switches, Routers, Gateways, Load Balancers
Printers
Wireless Access Points
Computers/Workstations using special services (or requiring firewall exceptions)

DHCP Reservations

DHCP stands for Dynamic Host Configuration Protocol, and was created to dynamically configure hosts networking configuration on the fly for easy deployment.

In it’s most simplest explanation, when a computer (or device) that is configured to use DHCP reaches out to the network, the DHCP server will assign and provide an IP address for the computer to use.

In home networks, pretty much every computer and device will get it’s IP address from the DHCP server running on the router.

In business networks, pretty much every computer and device that isn’t hosting services will get it’s IP address from the DHCP server running on one of their servers or routers.

DHCP Servers support something called a “DHCP Reservation”, which essentially allows you to provide a pre-set IP address to a specific client based on it’s physical MAC address. This means that the device will always get the same IP address and it will never change (whereas they typically do on occasion).

I’m surprised I don’t see these used more often, as they can become quite the powerful tool on the IT tool belt when used properly. I’ve listed some pros and cons below.

The Pros:

Manage IP addresses (IP reservations) from a single console
Ability to change IP addresses on the fly easily from a single console without having to log in to the device.
Manage network topology for ROBO (Remote Office, Branch Office) remotely, easily, and efficiently.
Manage IP addresses for 3rd party devices that you don’t normally have access to modify (tell the vendor to set to DHCP), reducing support calls for external services.
Ability to create different PXE boot environments as each reservation can have it’s own PXE boot options assigned.

The Cons:

Device must support DHCP Configuration.
The device MUST RELY on a DHCP Server once set to use DHCP. If the DHCP Server is down, so is the device.
If rogue DHCP servers appear on your network, it may disrupt communication (this can also happen with static IPs and conflicts).

So with the list above, DHCP reservations look pretty powerful. The next question, is where do we use DHCP reservations. Let’s finish off with the devices we’d use them on, and what use case scenarios apply.

Devices:

Wireless Access Points
Printers
2nd Level (non core) Routers and Gateways
IoT Devices
IP Phones
IP PBX Systems (VoIP, Traditional with IP Management, etc).
Thin Clients and Zero Clients

Use Cases:

Remote Offices (remote sites with limited access)
Remote Support environments
Branch Offices
IP Phone Networks
Wireless LAN Access Point VLANs

DHCP Reservation Use Cases

I use DHCP reservations frequently with customers that have remote or branch offices in remote geographical areas. When supporting these users and troubleshooting issues, it’s awesome to be able to just log in to the DHCP server to change IP addresses of printers, phones, and wireless access points.

Also, when configuring, shipping, and deploying new devices to these offices, I can simply log and write down the MAC address, configure the DHCP reservation, and the device will get the IP address I’ve chosen once it’s connected to the network and powered on.

Using DHCP reservations, you can easily make big changes to these remote networks without having to be present. If you were to use Static IPs and something was misconfigured, this might cause a physical visit to the site to resolve.

If by change a vendor directly dropships equipment to the remote site, I can simply call someone at that office to get the MAC address. Most devices with a NIC (printers, MFPs, wireless access points), all usually have their MAC addresses printed on the outside of the box. With this information provided, I can login to the remote server, create a DHCP reservation, configure drivers, and push the device config out to the network.

DHCP reservations add to the whole concept of a centrally managed environment, which further helps ease of maintaining, and supporting it.

Leave a comment and let me know your thoughts!

Using DUO 2FA/MFA with 10ZiG Zero Clients on VMware Horizon View

10ZiG, Duo MFA, End User Computing, Omnissa Horizon, VDI, VMware, Zero Clients/Thin Clients 3 Responses »

May 062019

10ZiG 5948qv Zero Client VMware Horizon View

You have VMware Horizon View deployed along with Duo Multi-Factor Authentication (2FA, MFA), and you’re you having user experience issues with 10ZiG Zero Clients and multiple login dialog boxes and planning on how to deal with the MFA logins.

I spent some time experimenting with numerous different settings trying to find the cleanest workaround that wouldn’t bother the user or mess up the user experience. I’m going to share with you what I came up with below.

If you’re interesting in 10ZiG products and looking to buy, don’t hesitate to reach out to me for information and/or a quote! We can configure and sell 10ZiG Zero Clients (and thin clients), help with solution design and deployment, and provide consulting services! We sell and ship to Canada and the USA!

The Issue

When you have DUO MFA deployed on VMware Horizon, you may experience login issues when using a 10ZiG Zero Client to access the View Connection Server. This is because the authentication string (username, password, and domain) aren’t passed along correctly from the 10ZiG Login Dialog Box to the VMware Horizon View Client application.

Additionally, when DUO is enabled on VMware View (as a RADIUS authentication), there is no domain passed along inside of the DUO login prompt on the view client.

This issue is due to limitations in the VMware Horizon View Linux Client. This issue will and can occur on any system, thin-client, or Zero Client that uses a command string to initialize a VMware View session where DUO is configured on the View Connection Server.

Kevin Greenway, the CTO at 10ZiG, reached out to say that they have previously brought this up with VMware as a feature request (to support the required functionality), and are hopeful it gets committed.

At this point in time, we’d like to recommend everyone to reach out to VMware and ask for this functionality as a feature request. Numerous simultaneous requests will help gain attention and hopefully escalate it on VMware’s priority list.

The Workaround

After troubleshooting this, and realizing that the 10ZiG VMware login details are completely ignored and not passed along to the VMware View client, I started playing with different settings to test the best way to provide the best user experience for logging in.

At first I attempted to use the Kiosk mode, but had issues with some settings not being passed from the 10ZiG Client to the View Client.

Ultimately I found the perfect tweaking of settings that created a seamless login experience for users.

The Settings

On the 10ZiG Zero Client, we view the “Login” details of the “VMware Horizon Settings” dialog box.

10ZiG Zero Client VMware Horizon Settings Login Settings Dialog Box — 10ZiG Zero Client VMware Horizon Settings Login Settings

Login Mode: Default
Username: PRESS LOGIN
Password: 1234
Domain: YourDomain

Please Note: In the above, because DUO MFA is enabled, the “Username”, “Password” and “Domain” values aren’t actually passed along to the VMware View application on the Zero Client.

We then navigate to the “Advanced” tab, and enable the “Connect once” option. This will force a server disconnection (and require re-authentication) on a desktop pool logoff or disconnection.

10ZiG Zero Client VMware Horizon Settings Advanced Settings Dialog Window — 10ZiG Zero Client VMware Horizon Settings Advanced Settings

Please Note: This option is required so that when a user logs off, disconnects, or get’s cut off by the server, the Zero Client fully disconnects from the View Connection Server which causes re-authentication (a new password prompt) to occur.

So now that we’ve made the modifications to the Zero Client, I want to outline what the user experience will look like from Boot, to connection, to disconnection, to re-authentication.

Turning on the 10ZiG Zero Client, you are presented with the DUO Login Prompt on the View Connection Server.
You then must pass 2FA/MFA authentication.
You are then presented with the desktop pools available to the user.
Upon logging off, disconnecting, or getting kicked off the server, the session is closed and you are presented to the 10ZiG VDI Login Window.
To re-establish a connection, click “Login” as instruction by the “Username” field.
You are presented with the DUO Login Window.
And the process repeats.

As you can see it’s a simple loop that requires almost no training on the end user side. You must only inform the users to click “Login” where the prompt advises to do so.

Once you configure this, you can add it to a configuration template (or generate a configuration template), and then deploy it to a large number of 10ZiG Zero Clients using 10ZiG Manager.

Let me know if this helps, and/or if you find a better way to handle the DUO integration!

10ZiG Manager – Deploy Configuration Template to 10ZiG Zero Client(s)

10ZiG, End User Computing, VDI, Zero Clients/Thin Clients 4 Responses »

May 062019

You’ve created some 10ZiG Manager configuration templates, modified them to reflect the settings you need, and now you want to deploy the configuration template to your 10ZiG Zero Clients using the 10ZiG Manager.

In this post, we’ll be going over how to deploy an existing configuration template that is stored inside of your 10ZiG Manager management software.

This allows you to push out configs on the fly to either a single device, or 10,000 devices at once. This is a MUST for managing small, medium, and large sized 10ZiG deployments.

This post is part three of a three part 10ZiG Manager Tutorial series:

Please Note: we are going to assume you have created a configuration template, have modified it to the settings you required, and have your network properly configured for 10ZiG Manager to function.

Instructions

Open the 10ZiG Manager.
Choose the 10ZiG Zero Client(s) that you’d like to deploy the configuration to. You can “CTRL + Click” or “SHIFT + Click” to select more than one 10ZiG Zero Client.
In the menu, expand “Configuration” -> and select “Apply Template”.
A “Configuration Template Note” is displayed. Please read and understand this, then click “Ok”.
In the “Configuration Templates” window, select and highlight the configuration template you’d like to deploy, and then click “Ok”. In my example, I’m choosing “DA-MainTemplate”.
The “Configuration Cloning Target” dialog box is displayed. Here you can change the target hostname, and choose to immediately push the configuration. Select “Ok”.
And now the “Reboot” dialog box is displayed. Here you can choose how you’d like the reboot to be handled once the configuration is pushed to the device(s). Select your preference, or leave as default and select “Ok”.
You’ll be brought back to the 10ZiG Manager interface. Here you’ll see a new task in the tasks list at the bottom of the window.
Once completed, you have successfully deployed the configuration.

You’re done! You have successfully pushed the configuration template to your 10ZiG Zero Client(s).

You can maintain, edit, and use multiple templates for different users, organizational units, or geographical units.

10ZiG Manager – Add hardware to USB Redirection in Configuration Template

10ZiG, End User Computing, VDI, Zero Clients/Thin Clients 4 Responses »

May 062019

Let’s say you manage numerous 10ZiG Zero clients and your users all have similar USB hardware that needs to be redirected to the VDI session. In most cases the hardware will be redirected without any configuration necesary, but what about when that doesn’t happen. You need to push a configuration template with the device information to your 10ZiG Zero Clients.

In my case, I use a YubiKey Security Key. I regularly use this for logins in Chrome and noticed that it wasn’t being directed via USB redirection.

This post is part two of a three part 10ZiG Manager Tutorial series:

Now there’s two ways to do this:

On the 10ZiG Zero Client, go to settings, USB redirection, and change the preference from “Default” to “Include”. This must manually be done on every Zero Client inside of your infrastructure (time consuming).
Add the USB hardware ID to your configuration template inside of the 10ZiG Manager and then push this to all your 10ZiG Zero Clients that you manage (super fast, can be deployed to thousands of devices in seconds).

In this post we’re going to cover the later, and show you how to add this to a config template. In my example, we’ll be adding the YubiKey security key with a hardware identifier (USB Product ID/PID) of 1050/0120 (Vendor ID: 1050, Product ID: 0120). We’ll be manually adding the hardware ID/PID to the config template in this tutorial.

Please Note: You can also add the settings on a 10ZiG Zero Client, and generate a template by pulling the config from that client. You can then push this to others as well.

To find out the Hardware ID/PID, you can either use the “Device Manager” on Windows, or plug in the device in to a 10ZiG Zero Client, go to settings, USB Redirection, and you should see the device name, along with the HID/PID info.

Instructions

Open the 10ZiG Manager.
Randomly choose a 10ZiG Zero Client from the list, right-click on it to open the menu. Expand “Configuration” -> Select “Manage templates”.
In the “Configuration Templates” window, right-click on your existing template (or create a new one), and select “Edit”.
In the “Template Configuration – Template Name” window, double-click on “USB Device Redirection”.
In the “USB Device Redirection” window, click on “Add”.
Enter in a friendly name, and enter your Vendor ID and Product ID in to the fields. For a YubiKey Security key, I did the following.
Click OK on all the fields, save the template. The configuration has been saved to the configuration template.

You’re done! You can now deploy this template to a single 10ZiG Zero Client, or deploy it as a batch to many 10ZiG Zero Clients.

10ZiG Manager – Create Configuration Template from 10ZiG Zero Client

10ZiG, End User Computing, VDI, Zero Clients/Thin Clients 4 Responses »

May 062019

So you’ve purchase some 10ZiG Zero Clients, configured the 10ZiG Manager, and want to create a configuration template to deploy to all your devices.

In this post, we’ll be going over how to create a configuration template from a manually configured 10ZiG Zero Client, so that you can edit it, and then deploy it to other 10ZiG Zero Clients (whether it’s a single unit, or 10,000).

Once you have a configuration template, you can add certificates, modify the VDI configuration, configure keyboard/mouse input, USB Redirection, and more! Doing all this with a configuration template allows you to manage and maintain a large amount of 10ZiG Zero Clients with ease.

This post is part one of a three part 10ZiG Manager Tutorial series:

Please Note: We are going to assume that you have manually configured at least one of your 10ZiG Zero Clients as a base configuration that you want to generate a template from. If not, make sure you do this before generating a template. We are also assuming that you have configured the 10ZiG Management software so that the Zero Clients can connect to it.

Instructions

Open the 10ZiG Manager.
Choose the 10ZiG Zero Client that you have already configured in the list and right-click on the unit.
In the menu, expand “Configuration” -> and Select “Generate Template”.
A warning explaining how the configuration is merged is presented, please read and understand this.
In the “Configuration Templates” window, type in a template name in to the “Template Name” field, and then select “Ok”. I’m calling mine “DA-MainTemplate”.
A warning explaining changes is presented, please read and understand this.
You will be brought back to the 10ZiG Manager, and will see the “Generate configuration template” task in the tasks list at the bottom of the window. It should eventually complete and be marked as successful.
The configuration template has been created.

You have now created a configuration template inside of 10ZiG Manager! You can edit this, and eventually deploy it to other 10ZiG Zero Clients on your network.

Older Entries Newer Entries

Static IP Addresses

An example of devices commonly seen with Static IPS:

DHCP Reservations

The Pros:

The Cons:

DHCP Reservation Use Cases

The Issue

The Workaround

The Settings

The Login User Experience

Instructions

Now there’s two ways to do this:

Instructions

Instructions