Study Lab for AZ-800 Training Course

Aspects of one of the lab environments used for AZ-800 study course training.

This lab version is based on Hyper-V running on a Windows 11 ThinkPad P72 Xeon laptop with 64GB RAM.

Setup

# will prompt for default realm, dc, admin server
apt install python3-virtualenv krb5-user libkrb5-dev

# set up virtualenv
virtualenv venv && source ./venv/bin/activate && pip install -r requirements.txt

# upgrade virtualenv PIP
python3 -m pip install --upgrade pip

# check Ansible version
ansible --version

# upgrade Ansible version (using upgraded PIP)
pip install --upgrade ansible

# initialize upgraded Ansible
deactivate && source ./venv/bin/activate

Network

Ansible doesn't run under Windows. If you use it in a WSL instance, you might need to create a route to the lab network with a command such as: New-NetRoute -DestinationPrefix "10.51.0.0/24" -NextHop "10.51.0.2" -InterfaceIndex 46

Interface index 46 refers to a Hyper-V virtual switch used for DMZ traffic. The associated virtual ethernet device on the Windows host on my system is named ixlo-dmz with an assigned IPv4 address of 10.51.0.2

The router for the virtual network should have an interface connected to the ixlo-dmz switch, with an assigned address like 10.51.0.1. The router will forward packets between all subnets that its interfaces are configured with. Therefore it's possible to ping 10.1.1.5 via the 10.51.0.0/24 subnet.

It's best to configure and test networking on the Windows host before testing with WSL.

My Windows host .wslconfig contains these (among other) entries:

networkingMode = NAT
ipv6 = true
firewall = false
autoProxy = false
dnsProxy=false

Inside my WSL Linux host, /etc/wsl.conf contains:

[network]
hostname = myhostname
generateHosts = false
generateResolvConf = false

Under this configurationv, it should not be necessary to add any routes in WSL to access the lab subnets.

Name resolution

Configure the WSL guest DNS to use a nameserver for the AD domain. Here's an example for systemd-resolved pointing to AD domain nameserver 10.1.1.5 and Cloudflare DNS servers as fallback:

[Resolve]
DNS = 10.1.1.5
FallbackDNS = 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001
Domains = local home.ixlo.io lab.ixlo.io research.lab.ixlo.io lab.example.org

Here is a sample resolv.conf:

nameserver 10.1.1.5
nameserver 1.0.0.1
nameserver 2606:4700:4700::1111
search local
search home.ixlo.io
search lab.ixlo.io
search research.lab.ixlo.io
search lab.example.org

Inventory

Use microsoft.ad.ldap for dynamic inventory

Set Ansible read access to Active Directory Global Catalog domain controller:

1. Create a global security group like PDC_ReadOnly_Access
2. AD Sites & Services > Site > Servers > > Properties > Security > add PDC_ReadOnly_Access, Permissions: select read-only
3. Create a user like Ansible_PDC_Query, member of PDC_ReadOnly_Access
4. Edit microsoft.ad.ldap.yml

Get dynamic inventory with microsoft.ad.ldap plugin: ansible-inventory -i microsoft.ad.ldap.yml --list

Configuration Scripts

There are some example configuration scripts here some of which are intended to be available from a web server, for example https://provision.ixlo.io They can be invoked via:

iex (New-Object System.Net.WebClient).DownloadString('https://provision.ixlo.io/CreateWinrmHttpsListener.ps1')