Help Creating Test Network within Work Domain

[Darren]

So this might not be the best forum to post this but since I'm here...

Short and sweet, I work IT for a healthcare practice with a handful of locations. These are all connected via a centralized network on one domain and one forest. I've tasked myself with testing System Center Configuration Manager for potential deployment to assit with IT management. Primarily I want to evaluate how it handles Windows updates on 10 machines as we transition off 7. Given my pretty recent intro into the professional IT world (8 months) I'm also learning by fire a lot of networking and adminny stuff. This is roughly what I'm following.

https://docs.microsoft.com/en-us/sccm/core/get-started/set-up-your-lab

Ideally I want to have 2 servers, a domain controller running, Active Directory, DNS and DHCP, and a second for SCCM, SQL (for SCCM) and WSUS. Then probably 3-5 machines to test with.

My issue lies in that being at work I'm already part of our domain we have here. I'm trying to find a way to create a virtualized network that is able to handle its own domain separate from our main one while still maintaining internet connectivity (for downloading updates). I can create an internal VLAN and run all the machines thru Hyper V but I lack internet connectivity since it's restricted to the VMs. I tried installing Server 16 on a separate machine (rather than virtually) and then was going to virtualize the rest but I also need to run DNS and DHCP on the DC without it conflicting.

Any guidance here? @beers @voyagerfan99 ?

Of course I could simply do this at home but I wouldn't get paid for that now would I?

 

[Darren]

 

[beers]

You could probably just run a virtual router on the edge of your internal VM-only switch (with a separate router interface that goes out to your real network). You'd just have to route whatever lab subnets you're using back to the virtual router from your physical edge and allow that in the NAT to the internet.

Most people use a vrf or firewalled dmz style segment to isolate that from the rest of your network while still allowing internet access.

 

[Darren]

Yeah what you described is a lot of what I was finding. Thankfully we actually have a whole second connection with its own modem. So I just hooked into that and configuring the domain controller.right now.

Not exactly a solution but it works. We were discussing a DMZ until we remembered this connection. We had used it for initial network setup when we moved into this new building but it's been unused since.

 

[voyagerfan99]

Get your manager to sign off on a cheap server you can use as an ESXi/Hyper-V host and just put it on its own vLAN and test. Once you're ready, you can setup a new build in prod.

 

[Darren]

Get your manager to sign off on a cheap server you can use as an ESXi/Hyper-V host and just put it on its own vLAN and test. Once you're ready, you can setup a new build in prod.

Yeah that's what I'm doing. I'm copping out with just a spare workstation we had laying around, I think I might have a real server to play with soon but for doing what I'm doing this should work.