Deploying image to workstations with different IP subnet from Windows Server 2012 R2 WDS Virtual Machine ?

People,

I'd like to know what do I need to do to allow new OS image deployment using Windows Server 2012 R2 and WDS+MDT component to my HQ office with different IP subnet ?

I'm using VMware vSPhere 5.1 U1 as the Virtual Machine platform.

Note:
Data Center IP Subnet is 10.1.1.0/24
HQ Office IP Subnet is 10.1.100.0/24

Do I need to allow certain change or modification on the router / Data Center Switch to allow certain packet or ports to allow the boot image to be recognized on the HeadQuarter Office workstations ?
LVL 11
Senior IT System EngineerIT ProfessionalAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Robin CMSenior Security and Infrastructure EngineerCommented:
Could be lots of things, depending on how your network is setup.
To save me typing it all out, check all the stuff in here: http://community.spiceworks.com/topic/271704-windows-deployment-services-accross-subnets
Especially stuff like dhcp helper and ip helper and dhcp snooping, plus check your DHCP options are set correctly.
Also check https://social.technet.microsoft.com/Forums/en-US/9fafd205-8219-491e-81b7-156795b08d41/wdsmdtpxe-work-on-different-subnet-seperated-via-a-hw-firewall?forum=mdt
Senior IT System EngineerIT ProfessionalAuthor Commented:
Ok but it is possible right with MDT or WDS ?

Not sure if this is the limitation or not.
Robin CMSenior Security and Infrastructure EngineerCommented:
Yes it's possible, the people in those two articles all got it working! :-)
Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Robin CMSenior Security and Infrastructure EngineerCommented:
As I originally stated though, it may depend on how your network is setup, and the willingness or ability of your network guys to change configs for various reasons. Worst case, just stick a WDS server on the second subnet.
Senior IT System EngineerIT ProfessionalAuthor Commented:
Ah I see, because it was working with SCCM in my previous company.

At the moment I can only deploy similar solution with the free alternative such as MDT or WDS.
Robin CMSenior Security and Infrastructure EngineerCommented:
SCCM still needs PXE boot to work.
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
1. You will need to change DHCP settings to make sure Clients (PXE) get the correct settings for the TFTP server.

2. Do clients have a network route to the WDS Server ?

e.g. can clients ping and traceroute to the server ?
Senior IT System EngineerIT ProfessionalAuthor Commented:
Yes Andrew,

The client IP subnets can ping the data center IP range.

My understanding is The dhcp scope from the Windows Server 2012R2 options only works when the operating system is fully loaded. If it is still booting under the BIOS / POST mode, does the dhcp scope on windows server DHCP must be pointed to the PXE server in data center ?
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
DHCP answers the PXE request, with optional parameters, e.g. boot filename, and TFTP server IP Address.
Robin CMSenior Security and Infrastructure EngineerCommented:
DHCP option 66 should be the IP address of the WDS server, option 67 should be the path of the boot file/image (Network Boot Program or NBP), e.g. \boot\x86\wdsnbp.com
This stuff is in the spiceworks link I posted originally.
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
that's what we use...066 and 067 in the scope options.
Senior IT System EngineerIT ProfessionalAuthor Commented:
Thanks Robin.

So in this case the WDS/MDT Server can be in the data center but the Boot Image must be in each branch office same subnet with the workstations ? is that mandatory ?

@Andrew: do I need to upgrade to ESXi 5.1 Update 3 to use WDS on VM ?
https://www.vmware.com/support/vsphere5/doc/vsphere-esxi-51u3-release-notes.html

Microsoft Windows Deployment Services (WDS) might fail due to PXE boot virtual machines that use the VMXNET3 network adapter
Attempts to PXE boot virtual machines that use the VMXNET3 network adapter by using the Microsoft Windows Deployment Services (WDS) might fail with messages similar to the following:
Windows failed to start. A recent hardware or software change might be the cause. To fix the problem: 1. Insert your Windows installation disc and restart your computer.
2. Choose your language setting, and then click "Next.".
3. Click "Repair your computer.".
If you do not have the disc, contact your system administrator or computer manufacturer for assistance. Status: 0xc0000001 Info: The boot selection failed because a required device is inaccessible.
This issue is resolved in this release.
Robin CMSenior Security and Infrastructure EngineerCommented:
The WDS server can be anywhere as long as you put its IP address in your DHCP option 66.
The VMware PXE boot thing is only a problem if you're configuring WDS-deployed VMs to use the VMXnet3 adapter (which personally I do, but then I deploy my VMs via vSphere templates and not WDS as that is near instant with my lovely Tintri VM storage). You however said you were deploying workstations via WDS, not VMs, so the issue is not relevant to you.
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
E1000 or VMXNET3 will do, we use VMXNET3. Always recommended.

I would always encourage you to be on the latest build of ESXi. If there is a documented bug, I would follow the advise.
Senior IT System EngineerIT ProfessionalAuthor Commented:
Ok, so it seems that the problem stemmed from the Router Configuration or switch that must be opened just like DHCP Helper when setting DHCP server over various subnet.

But the problem here is I do not know hat exact settings that I need to tell my network team to change and allow in each router to allow this WDS packet to go through ?
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Does your network team, not know how to apply DHCP info to other subnets ? e.g. via router config ?
Senior IT System EngineerIT ProfessionalAuthor Commented:
@Andrew: Does it the same concept like the DHCP-helper ?

Is it by allowing the following rule:
Source IP: All IP subnet
Destination IP: IP address of the WDS server.
Port Number: 4011/UDP
Rule: Allow broadcast packet to be through into the detination server IP address only.

Because the network team only accept the work when it is completely detailed & exact of which information to be modified like above.

IS there anything that I missed ?
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
It's almost a relay in effect, the router listens, rewrites the dhcp info, for the local subnet.

We just pass to our Network Operations, can you configure a DHCP Helper, to pass our DHCP server from Subnet A to Subnet B, and they say, yes okay....

This lab may help you....

http://www.freeccnaworkbook.com/workbooks/ccna/configuring-an-ip-dhcp-helper-address

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/12-4t/dhcp-12-4t-book/config-dhcp-relay-agent.html

http://cisconet.com/tcpip/dhcp/107-how-to-use-ip-helper-address-to-connect-remote-dhcp-server.html

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Senior IT System EngineerIT ProfessionalAuthor Commented:
Thanks !
Senior IT System EngineerIT ProfessionalAuthor Commented:
OK, so once the setting is already put in place for all of the switches and routers it is definitely possible to perform WDS deploy to different subnet ?

Note: my switch in the HQ is H3C not Cisco, I wish that it was Cisco.
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
Yes, we do it here! and at many clients.

Our WDS Server is on our Server Production LAN, and all our clients/desktops, are on another 6 LANs, different subnets.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.