5. Install Router and Firewall
After you’ve reconfigured
your existing SBS to use a single network card, you need to reconnect it
to the Internet. You need to insert a router into the network if you
don’t already have one, and configure it for the network address range that you’ve chosen for your SBS network.
In many cases, you’ll already
have a router in place—we did. But that router is likely not a
full-fledged firewall. Now is the time to replace it or add an
additional firewall appliance. When you do, you’ll need to configure the
firewall for your SBS network. The port’s SBS 2003 uses include
25 Simple Mail Transfer Protocol (SMTP). Used by Microsoft Exchange for incoming and outgoing email.
80
Hypertext Transfer Protocol (HTTP). Outbound, this port is used to surf
the web. Inbound, it can be used to initially connect to the Remote Web
Workplace site.
443
Hypertext Transfer Protocol Secure (HTTPS). It’s used outbound for
connecting to secure websites and inbound for connecting to Remote Web
Workplace.
444
Companyweb. This port is used to connect to the SharePoint Companyweb
intranet site. Open this port only if your users connect to Companyweb
when working remotely.
3389
Remote Desktop Protocol (RDP). This port is used only if you allow
direct RDP connections from remote locations to your SBS server. If you
do enable this for remote management, you should limit the IP addresses
that are allowed to connect to specific, known, IP addresses.
4125 Remote Web Workplace (RWW). This port is used by RWW for connecting remote users to their desktops.
Additional ports might be in use
for specific applications on your network, but these are the basic
incoming ports that are used by SBS.
After you’ve installed and configured your router, connect it to your SBS network as shown earlier in Figure 7-2.
Verify that you have connectivity from the server and from your
workstations to a known site. If a workstation doesn’t have
connectivity, reboot and try again. Verify that the DHCP-assigned IP
address is in the correct range.
|
The requirements for migrating
SBS 2003 Premium Edition networks that are using ISA Server are
somewhat different. The basic premise is the same—you need to
reconfigure your network to use a single NIC. But you’ll also need to
remove the ISA Firewall Client from computers on your network. Microsoft’s migration
guide says that you can leave ISA in place during the migration as long
as you are running at least ISA 2004 SP3, but we think this is a bad
idea. You need to install a real firewall on your network to protect it
and the new SBS 2011 server, and leaving ISA in place on the source SBS
2003 server just confuses the issue and leaves additional places where
there could be problems during the migration.
We started to write up a full
set of steps for uninstalling ISA and reconfiguring the workstations on
your network, but then we found an excellent resource from Kevin Weilbacher, an SBS MVP. He has posted a step-by-step guide to removing
ISA 2004 from SBS 2003, and he is actively maintaining it and updating
it to cover issues as they’re reported, with input from many of the
other SBS MVPs. For full details on how to remove ISA 2004, see http://msmvps.com/blogs/kwsupport/archive/2008/09/07/uninstalling-isa-2004.aspx.
|
5.1. Disable VPNs
Before you begin the migration, you need to disable virtual private networking to the SBS server. If you need VPN
access, you should choose a router/firewall that can act as a VPN
endpoint. Ultimately, however, we think a better overall solution is to
use Remote Web Access (RWA) and avoid VPNs whenever possible.
To disable VPNs on the existing SBS server, follow these steps:
Log on to the server with the main Administrator account.
Open the Server Management console if it doesn’t open automatically.
In the left pane of the Server Management console, click Internet And E-mail. The Manage Internet And E-mail page opens.
Click Configure Remote Access to open the Remote Access Wizard.
Click Next on the Welcome page to open the Remote Access Method page as shown in Figure 13.
Select Disable Remote Access, click Next, and then click Finish.
When the wizard completes, click Close to return to the Server Management console.
This completes the
network reconfiguration for your SBS migration. Now is a good time to
verify that all the computers and devices on your network are working as
you’d expect and can connect properly. Pay particular attention to
devices such as printers, wireless access points, and web cams that have
a fixed or DHCP reservation address to make sure that they are
communicating correctly with the rest of the network.
6. Configuring Active Directory
Before you can complete the migration to SBS 2011, you need to raise the domain
and forest functional levels of your current SBS 2003 Active Directory.
The migration requires that the Active Directory forest and domain
functional level be Windows Server 2003. The default for SBS 2003 is the
Microsoft Windows 2000 functional level.
You can’t move to a
Windows Server 2003 functional level if there are any Windows 2000 or
earlier domain controllers in your SBS domain. If there are, you must
first demote them from being domain controllers. For Windows 2000, run Dcpromo.exe
as a domain administrator to demote the legacy Windows 2000 domain
controller. If you still have Windows NT 4 domain controllers in your
network, you’ll need to rebuild these servers as non–domain controllers
or remove them from the network entirely. Given that Windows NT 4 is no
longer supported by Microsoft and won’t get any updates or security
patches, you need to remove any remaining Windows NT 4 computers.
To raise the domain and forest functional level of your SBS 2003 Active Directory, follow these steps:
Log
on to the SBS 2003 server with an account that has both Domain Admins
and Enterprise Admins privileges. The Administrator account is a good
choice for this.
Click
Start, then click Administrative Tools, and then click Active Directory
Domains And Trusts to open the Active Directory Domains And Trusts
console shown in Figure 14, or you can type domain.msc at the Run menu.
Note:
Raising the domain functional level is an irreversible change. You can’t later lower the functional level.
Click the domain (example.local in Figure 14), and select Raise Domain Functional Level from the Action menu to open the dialog box shown in Figure 15.
Select
Windows Server 2003 from the drop-down list (this should be the only
choice in most SBS networks) and then click Raise to raise the domain
functional level.
Note:
If the Current Domain Functional Level is shown as Windows Server 2003, you won’t be able to change the functional level.
Click OK at the warning that this change can’t be reversed, and click OK again at the success message.
Click Active Directory Domains And Trusts in the left pane at the top of the tree.
Click Raise Forest Functional Level on the action menu to open the Raise Forest Functional Level dialog box shown in Figure 16.
Note:
Raising the forest functional level is an irreversible change. You can’t later lower the functional level.
Click Raise. You’ll see the warning message that this change is irreversible as shown in Figure 17.
Click OK. If the raise was successful, you’ll see the informational message in Figure 18.
Click OK to close the message, and then close the Active Directory Domains And Trusts dialog box.
