Networking

Forest vs domain vs tree — when to use each

Domain naming — get this right on day one

OU structure design patterns

Sites & Services — the WAN-aware part of AD

Active Directory Sites and Services (dssite.msc) tells AD about your physical network so replication and client logons make sane choices. A site = one or more IP subnets that are well-connected (LAN-speed). Everything else describes the slow connections between sites.

• Create a site per physical location. Name it after the office, not the subnet (Site-Chicago).
• Assign subnets to sites (e.g. 10.10.0.0/16 → Site-Chicago). Unassigned subnets land in Default-First-Site-Name and clients pick DCs randomly — the #1 cause of "logons are slow at the branch."
• Site links: connect sites with a cost (lower = preferred) and a replication schedule. Default cost 100 every 180 min is fine for most SMB; drop to 15–60 min for hub sites.
• One writable DC + GC + DNS per site with more than ~10 users.

FSMO roles — the five single masters

Most of AD is multi-master — any DC can take a write. Five jobs are single-master to prevent conflicts. In a healthy single-domain SMB forest, all five live on one DC and nobody thinks about them until that DC dies.

Procedure per Microsoft Learn "Transfer or seize Operation Master roles" and Dell support KB 000193715.

Domain controller placement and sizing

Read-only domain controllers (RODC)

A DC holding a read-only copy — replication flows inbound only. The only reasons to deploy one: a branch with poor physical security (stolen RODC exposes only explicitly cached credentials — privileged groups are denied by default and cannot be allowed), untrusted local admins (delegate RODC-local admin without Domain Admins), or DMZ-adjacent authentication. An RODC still needs a writable DC reachable — it is not a substitute for a second writable DC in your main site.

Functional levels

DFL can be higher than FFL, never lower. Raising is one-way. Rule: raise only after every DC in scope runs a supporting OS.

The full story on redundancy — why two DCs minimum

• Two writable DCs, separate hypervisor hosts
• Both run DNS with AD-integrated zones; both listed in DHCP option 006
• Both are Global Catalogs
• Replication healthy — repadmin /replsummary shows zero errors
• FSMO roles on the intended holder — netdom query fsmo
• Time hierarchy sane: PDC → external NTP; all DCs → PDC
• System-state backups of at least one DC; restore procedure documented and tested

How DHCP actually works — DORA

Scope design — sizing, exclusions, reservations

DHCP failover — hot standby vs load balance

Two Windows DHCP servers share scope/lease state over TCP port 647. Both can serve the same scope; leases, reservations, and options replicate. Per Microsoft Learn "Understand and Deploy DHCP Failover".

DHCP platform comparison

Top 5 DHCP misconfigurations

• DHCP failover configured (or documented single-server risk accepted for micro-sites)
• IP helpers on every VLAN except the server VLAN
• Option 006 = DCs only on domain VLANs; guest VLAN gets public DNS
• Exclusions for all static infrastructure; reservations for printers/APs/cameras
• Scope sized at 2× devices; utilization alerts at 80%
• Lease times: 8 days wired, ≤24 h guest; rogue detection via DHCP snooping

Zone types

Forwarders vs root hints

Split-brain / split-horizon DNS

The same zone name resolves differently inside vs. outside: internally www.contoso.com → 10.10.20.25; externally → 203.0.113.25. Two zone copies, two truths. Needed when you host internally what the public also reaches. Run it without pain: the internal AD-integrated zone holds only the records that differ + internal-only names — don't clone the entire public zone. Document which names are split and who updates each side. Classic outage: website migrated, external updated, internal forgotten → "works on my phone but not the office."

Aging and scavenging — killing stale records

DHCP leases expire but DNS A records linger — eventually two machines claim one name. The three timers (defaults 7 / 7 / 7): No-refresh (7d) — record can't be refreshed again for 7 days (prevents replication storms). Refresh (7d) — owner may refresh; if nothing does, the record goes stale. Scavenging period (7d, per-server) — how often cleanup runs. A record can live up to No-refresh + Refresh + Scavenging period past its last refresh.

Reverse lookup zones & conditional forwarders

DNSSEC in plain English

Classic DNS answers can be spoofed — nothing proves an answer is genuine. DNSSEC adds cryptographic signatures so resolvers can verify authenticity (trust chains upward to the pre-trusted root key). It answers "is this answer real?" — it does not encrypt queries (that's DNS-over-HTTPS/TLS, a different thing). For MSPs: internal AD signing is "know it exists" territory; enable DNSSEC at the registrar for client domains where identity matters; enabling validation on internal resolvers is low-risk. Failure mode: expired signatures = "DNS is down" — check dig +dnssec / Resolve-DnsName -DnssecOk.

Diagnostic workflow

Top 5 DNS failures

The layered design, scaled for SMB

Access (endpoints plug in, VLANs assigned) → Distribution (aggregates access, applies policy, routes between VLANs) → Core (high-speed backbone, no endpoints). You don't build three tiers for 60 users — you collapse.

Standard server roles — and where each lives

VLAN design and segmentation patterns

IP addressing schemes that scale

Physical topology patterns

Redundancy everywhere

Inter-VLAN routing

Routing protocols — what an SMB tech must understand

Static routes carry 90% of SMB networks. You've outgrown them at ≥3 sites with redundant paths, or anywhere a link failure should automatically reroute.

Firewall placement and rules philosophy

• Default deny, explicit allow. Start from nothing; each rule has a business reason.
• Top-down, most-specific first. A misplaced "allow any" above your denies is an open door — audit the order.
• Least privilege: constrain source, destination, and service. "Allow 10.10.30.0/24 → 10.10.20.15:443", not "allow VLANs to talk."
• Every rule gets a name, a ticket, and an expiry review date. Quarterly audits; disable-before-delete (30-day disable catches the "wait, that was load-bearing" cases).
• Log denies. The deny log is early-warning radar — scans, misconfigs, and malware show up there first.
• Change control: no firewall change without a rollback plan. Export config before touching production.

VPN — site-to-site and remote access

Wi-Fi design fundamentals

• Placement: ceiling-mount, central to the coverage cell, 10–15 ft. APs radiate like a flattened donut — wall-mounting wastes half the pattern.
• Design for -65 dBm or better at the 5/6 GHz cell edge for voice/video; turn 2.4 GHz power down, not up (sticky clients, interference).
• Channels: 2.4 GHz → only 1, 6, 11. 5 GHz → non-overlapping 20/40 MHz; 80/160 MHz only in clean, low-density environments. Avoid DFS channels for voice.
• Survey: predictive for design, validation walk with a real client device after. Deliverable: heatmap showing -65 dBm 5 GHz coverage, SNR ≥ 25 dB in work areas.
• Wiring: home-run Cat6A to each AP (2 drops for Wi-Fi 6E/7 dual-uplink APs), PoE+ minimum — check the AP's spec, not the switch's marketing.
• SSIDs: 2–3 max (Corp with 802.1X, Guest with portal/isolation, maybe IoT). Every extra SSID burns airtime in beacons.
• Security: WPA3 (transition mode for legacy clients); 802.1X/RADIUS for Corp with dynamic VLAN assignment. Never the staff Wi-Fi password on a sticky note.

Cisco — Catalyst (classic) and Meraki MS (cloud)

Catalyst = traditional CLI-managed (IOS/IOS-XE), full control. Meraki MS = cloud-dashboard-managed, subscription per switch, zero-touch. Same parent, different religions: Catalyst for deep CLI/automation needs; Meraki when the MSP manages everything and wants dashboard uniformity.

Aruba / HPE — Instant On (SMB) and CX (enterprise)

Instant On = SMB, mobile-app + cloud-portal managed, no subscription for basic management. CX = enterprise, AOS-CX OS, CLI/API/Central, full L3. Instant On for the 10–75-user client; CX from ~75 users up or wherever stacking/L3/10G aggregation matters.

Ubiquiti UniFi

Everything managed through the UniFi Network application (Cloud Gateway, Express/Host, or self-hosted). No per-device CLI culture — the controller is the product. Watch the tier names — Ubiquiti renames/reshuffles often; verify at ui.com before quoting.

NETGEAR

No-nonsense SMB switching in three management tiers, plus optional Insight cloud management. Lifetime hardware warranty (ProSAFE) is the brand's calling card — register it.

Dell PowerSwitch (N-series for campus)

Open-networking campus switches running OS6 (Cisco-like CLI), strong stacking (up to 12 units), lifetime warranty. Dell's play: the server vendor's network — attractive when the client is already a Dell shop.

TP-Link Omada

The budget disruptor — Omada SDN controller (hardware OC200/OC300, software, or cloud) manages switches, APs, and gateways from one dashboard, mirroring UniFi's playbook at lower price points. Standalone web/CLI management also available.

Brand comparison at a glance

Subnetting — with cheat sheet

The idea: an IP is 32 bits; the mask says how many leading bits are the network vs. the host. CIDR (/24) just counts the network bits. The only math you need: hosts = 2^(host bits) − 2. /24 → 8 host bits → 254. Subnets from splitting = 2^(borrowed bits): split a /24 into /26s → 4 subnets of 62 hosts.

CIDR

"Class A/B/C" is dead trivia; CIDR is how the world works. 10.10.30.0/23 = "the first 23 bits are network." It lets you carve and summarize: advertise 10.10.0.0/16 instead of 14 individual /24s. Senior tech says: if your VPN crypto-maps or firewall rules list 30 individual /24s, you failed CIDR — summarize.

NAT / PAT

STP / RSTP

Switches flood unknown unicasts and broadcasts out every port. Loop two cables between the same switches and broadcasts circle forever — a broadcast storm that melts the network in seconds. Spanning Tree finds loops and blocks redundant ports, unblocking them if the active path dies. STP (802.1D): original, 30–50s convergence — historic. RSTP (802.1w): ~1–6s — the one you run. MSTP/PVST+: multiple instances for load-sharing VLANs across links.

• PortFast (edge ports): access ports to endpoints skip the 30s delay. Never on ports facing other switches — a PortFast trunk can create a temporary loop.
• BPDU Guard: PortFast port receives a switch hello → shut the port down. Enable globally on all access ports — prevents most "someone brought a hub from home" outages.
• Root Guard / Loop Guard: protect the top of the tree on distribution ports.
• Root bridge placement: the core/distribution switch should be STP root (lowest priority, e.g. 4096) — set it explicitly, don't let a closet switch win on lowest MAC.

PoE budgets

Power over the same Ethernet cable, negotiated between switch (PSE) and device (PD). The budget is the total watts the switch can deliver across all ports — the number that actually matters.

SFP / QSFP

MTU / jumbo frames

MTU = largest packet a link carries; standard Ethernet = 1500 bytes. Jumbo frames (9000) help only when every device in the path supports them — one 1500 device in the middle = fragmentation or black-holed traffic. Senior tech says: enable jumbos only on dedicated storage/backup VLANs where you control both endpoints — never on user/voice VLANs. VPN overhead: IPsec adds ~50–80 bytes; set tunnel MTU/MSS clamping to ~1400–1420. "VPN connects but RDP/large transfers stall" = MTU until proven otherwise.

QoS basics

When a link congests, something has to wait — QoS decides what waits. It doesn't create bandwidth; it rations it. Marking: DSCP values — memorize EF (46) = voice bearer, CS3/AF31 (24/26) = voice signaling, AF41 (34) = interactive video, CS0 (0) = best-effort. Trust boundary: classify near the source (phone marks EF via LLDP-MED), then queue on congested egress ports. What matters in SMB: (1) voice VLAN with EF honored end-to-end, (2) priority queuing on WAN egress, (3) 4–5 classes max. Marking without queuing on the bottleneck is decoration. Wireless QoS (WMM) maps DSCP to 4 Wi-Fi access categories — without it, a laptop backup can starve a Teams call on the same AP.