Whats best, Fixed or Dynamic IP?

[ninjabeaver]

Hi,

 

I'm just wondering whats best to use. Fixed IP addresses for the school client PC's or dynamic addresses.

 

I'm using Norton Ghost and Webmarshal (like censornet).

 

Just after opinions.

[tarquel]

Well what I've started to do, is use the reservations in the DHCP system.

 

Of course, this does mean having to get all the MAC addresses (various tools for that) and then adding them to DHCP.

 

In case you dont know, this means you still can leave the client pc's set to automatically obtain their IP address, but then the DHCP server gives them the same IP address each time

 

It seems to me a good way to organise things but the snag is freeing them all up to do this and having 98 pc's causes me a few probs with this lol

 

(nothing major, its just a bit o' manual processing )

 

In my mind, its better than fixed IP addresses and exclusions in the DHCP range(s) and you can even do it with Print Servers - the ones that support DHCP o' course lol Havent changed them yet but I will. Of course this will rely on the DHCP server a bit more but I've found it not to trip up at all yet

 

Cheers,

N

[StewartKnight]

I have the server dishing out via DHCP for when I ghost, then, when the machine is a happy bunny, I assign it a static IP. I find static much easier, because at a glance I know which room a computer is in.

[MkII]

Funny I'm doing EXACTLY the same thing Nath!!! The aim is to eventually completely lock down the network so that nothing can get on without me setting it up first.

 

That's the issue for me with DHCP - security.

[StewartKnight]

I've got it dishing out DHCP, on a slightly different range (i.e. I don't point it to the switch or the server), so any new device can't access the server, and if you don't know the proxy address (only I do) then you can't even access the internet.

[tarquel]

I have the server dishing out via DHCP for when I ghost, then, when the machine is a happy bunny, I assign it a static IP. I find static much easier, because at a glance I know which room a computer is in.

 

This is the same principal as what I mean Stewart

 

I didnt think ninjabeaver was refering to ghost primarily (were you? lol doh!) but now I guess, when I use ghostcasting (or whenever/whatever requests a IP from a client) due to the reservations, it will always assign the right IP address to the right computer.

 

Handy when doing anythin' I wud have thought

 

if you don't know the proxy address (only I do) then you can't even access the internet

 

I wouldnt rely on this fact btw lol proxy addy's can be found out lol

 

Cheers

Nath

[Geoff]

I've always found static ip's to be a nightmare to manage. If I was at all worried about network access I'd use 802.1X or IPSEC. If your thinking about this you might want to read the whitepapers on the microsoft w2k3 server site about network access protection.

 

http://www.microsoft.com/windowsserver2003/technologies/networking/nap/default.mspx

[tarquel]

Agreed Geoff (and ta for the link)

 

I used to have to manually setup client's on the admin network with specific manual ip's - a nightmare indeed (wasnt in control of the DHCP either if your wondering why).

 

But DHCP reservations are easy and useful too

 

I shall not rant further on this....

 

...well....

 

N.

[ChrisH]

Just use hostnames according to location to determine where they are ie :

IT30-1, IT30-2, LIB-10, Tech-23 etc.

 

My log in script also uses these names to determine which printers to add. Easy.

[Ric_]

I use DHCP for all clients (with sensible names as Chris mentioned, so that printers can be added easily).

 

Print servers, WiFi APs, etc. are then given reservations so that I know 'where' they are.

 

I also use authentication on my proxy and I tend to air on the side of paranoia with permissions.

[browolf]

I use static for classrooms, e.g. 192.168.12.x would be a classroom 2 in building #1

 

we use dynamic for staff laptops and random single machines. It's fortunate we didnt roll out dhcp for classrooms like we wanted to since ISA 2004 needs static to be able to control the internet properly. with over 500 machines it would be a big job to convert to mac reservations.

[KeithFermor]

Naming PCs with sensible room/location conventions works well, I then use IPSCAN to grab a list of all PCs on sub-net to show IP/name/MAC/User. DHCP provides all my student PC IPs... and most importantly... with scopes set up correctly a ton of administration is removed.

 

Static IPs are fine when you want to lock down, but like most things they be prone to finger trouble... it only takes a moment in a busy environment to err, and then lots of time to diagnose and track.

 

So, its up to you to decide when the situation demands a specific solution and then how to distribute that to potentially many disparate systems!

[tarquel]

...ok I shall rant a "tad" more...

 

Just to expand a bit further, I use both reserved IP's and naming the computers with "some" order too.

 

The reason for the reserved ip's are not mainly for organisation - as you say, why bother when you can use a decent hostname stategy.

 

The reason is primarily if I install XP from a custom unattended cd quickly (for those odd machines that are dotted around the place), install a few apps, but then forget to change the hostname, at least I'll know what and where it is as the IP addy will be the same as it was before the "wipe" of the machine.

 

Also, if a user "does" manage to be able to attempt a change of ip, tho I havent tried it - I would have thought it wont work and then it'll only conflict with the IP they change it to (the one that already exists) which I'll know what and where it is (probably too tired to properly make sense there lol)

 

I'd imagine that once I've locked down and reserved the lot - I should be able to deny any people trying to "add their machine" to the network also i.e. wont assign them a IP. I imagine there is some sort of option for this somewhere only allow mac reservations - like WAP's have

 

Cheers,

N.

[unedugeek]

Has anyone experienced 'Bad Address' issues with DHCP reservations?

[oldbaritone]

Two tricks I've used -

 

Reserve a block of IP addresses in DHCP, and then exclude the lot of 'em.

Then only the MACs with reservations get in.

 

The alternative I've also done is to exclude all but one or two IP's from DHCP, and then monitor them for activity. It gives me a "generic" address to bring the new machine up online before I enter a reservation for it - especially true with a laptop/notebook with a dock that has both a wired and a wireless connection.

 

It also allows an exec to "play" with a "new toy" and get onto the intranet but not the internet. They're happier that way, and then I go over and tell them "you're supposed to bring new toys to us first..." and ipsec blocks against anything important for the "generic" address.

 

But troubleshooting if you need to go to a sniffer (wireshark) is a lot easier if you have addresses in zones like classrooms or buildings. It also makes it easier to manage restrictions - IP blocks assigned to student areas, IP blocks assigned to teacher/professors, which may be in an office attached to a classroom, and IP blocks assigned to administration, even if the total-network topology is "flat."

 

Of course, IP by userid (802.1x) works well for that, too.

[tmcd35]

Two questions to think off before using Static IP's or Reserverd DHCP Addresses:

 

How big is your school, how many clients machines do you have?

How many laptops do you have?

 

Where I am now, I have around 300 machines and very few laptops. This is doable. At the last school - 700ish machine, over half are now laptops. They'd find fixed IP a management nightmare.

 

I've never come across a scenario where I'd need static IP's on the desktop (admin staff and VNC excepted). If you use a good naming strategy then DHCP + DNS properly set up will give you all you need IMHO.

[oldbaritone]

Absolutely I agree that sheer quantity of machines is a big question, but I delineate differently when the group size is large, breaking staff/admin/VPN out into the reservation groups/blocks, and leave the laptops/student machines and "wild cards" in the generic DHCP pool.

 

My point mostly is that by using DHCP with reservations on the machines, rather than putting static settings on individual clients, network change control and administration is centralized and much easier. Simply make a single scope-level change at the DHCP server, and within a matter of hours the change will push out to all of the clients, without having to touch every single client machine. Keep the DHCP lease time reasonable; I usually use 8 hours. Within 4-6 hours the update is fully deployed.

 

The students get different (and lower-priority/restricted) name servers and proxies; higher-priority is reserved for staff and admin, with student requests serviced on a resource-available basis. IPsec limits the access to the higher-priority (privileged) proxies to the staff/admin reserved address block only. Then add authentication and encryption layers, and security is relatively tight. Sure, the MAC can be spoofed, but then the kids run into the encryption and authentication, which gets alarmed and tarpitted on multiple failed attempts. Floating encryption keys and mandatory password changes keep things about as secure as an open campus can be. (Hmmm... why is a hardwire MAC from Administration trying to connect to a wireless AP in a dorm???... unsuccessfully, we hope...)

 

But more importantly, DHCP with reservations keeps the end-users happier, because network-level technical changes are automatic and transparent to them. And that's a LOT less work for me.

 

Happy Users + Less Work = Bliss!

[Michael]

I find it much easier to adjust the DHCP Pool instead of creating reservations. For example, lets take a Class C network 192.168.x.x. I adjust the available DHCP Pool to 192.168.1.101 to 192.168.1.254, which means DHCP won't give out any IP below 101.

 

I then give servers static 192.168.1.5x , network printers 192.168.1.6x, access points 192.168.1.7x and admin workstations 192.168.1.9x.

[mac_shinobi]

Two tricks I've used -

 

Reserve a block of IP addresses in DHCP, and then exclude the lot of 'em.

Then only the MACs with reservations get in.

 

prolly being a bit dense here but can you run how you do the exclusion part.

[mac_shinobi]

I find it much easier to adjust the DHCP Pool instead of creating reservations. For example, lets take a Class C network 192.168.x.x. I adjust the available DHCP Pool to 192.168.1.101 to 192.168.1.254, which means DHCP won't give out any IP below 101.

 

I then give servers static 192.168.1.5x , network printers 192.168.1.6x, access points 192.168.1.7x and admin workstations 192.168.1.9x.

 

I like the above idea - good thinking

[oldbaritone]

"I then give servers static 192.168.1.5x , network printers 192.168.1.6x, access points 192.168.1.7x and admin workstations 192.168.1.9x."

 

which tells me that you have less than 10 network printers, less than 10 AP's, and less than 10 admin workstations. When it's that small, almost anything will work, and it's not too big a deal to make a static change station-by-station.

 

No matter how you look at it, the amount of information that needs to be entered, whether static IP at a workstation or DHCP reservation on the server, is about the same. DHCP offers advantages like scope-level entries (such as name servers) so that a single entry in DHCP affects many clients. And when a particular machine is replaced, only the MAC needs to be reset in the DHCP reservation, and all other parameters will still be correct.

 

When the clients are all in the DHCP reservation list, you don't miss updating one static client because someone forgot to enter it in their spreadsheet. You don't find yourself dependent on a "guru" who "has it all in his head" and "will write it up by the end of the week." (He doesn't.) You don't end up with two machines on the same static address because of a typo, trying to troubleshoot a phantom problem on two machines because the one turned on first works and the other one doesn't. (Tomorrow they get turned on in the other order, and machine #1 works fine, so you close the trouble ticket. Try troubleshooting THAT one between two different buildings, miles apart, with the other machine turned off!) DHCP won't LET you create a 2nd reservation for the same IP. It also won't let you have the same MAC in two different reservations. If a client pops up in the reserved address block that doesn't have a DHCP reservation, you can identify that something is wrong, immediately. Conversely, when an admin client shows up in the general pool, again it's immediately apparent that something is wrong.

 

IMHO, it's all about keeping the control of the network at the network level, on the network server, rather than scattering important network control parameters across a wide topological (and perhaps geographic) area. It's about letting existing systems help you avoid errors and improve reliability. It's about handling change control in a centralized environment, rather than traveling to many remote sites and hoping to be able to get access to every machine on the first trip. (Somebody's always out of their office.) Static IP is simple, straightforward, and doesn't need a network server, DHCP server, or DNS server to work. But DHCP has obvious advantages for centralized control, accuracy, monitoring and security.

 

In SOHO, it doesn't matter much. A complete top-down do-over (because the guru quit over a salary dispute) is only a couple of hours. But the SOHO owner won't be happy about the bill. In a larger environment, reverse-engineering the guru's IP structure can take weeks or months. And the alternatives in that situation are 1) outages until static IP's are all reset, 2) low reliability while you're figuring out who gets what access and why, and/or 3) security gaps during the update process. And again, the customer won't be happy about the bill. Been there. Done that. Got a tee-shirt. Don't need another tee-shirt.

 

But I can't count the number of SOHO applications that have "grown" from two or three computers, one AP and one shared printer in a flat architecture, into a significant network with dozens of clients, many printers, and several independent departments who "want" to share among themselves, but "don't want any other department to see my machine or printer." Easy with DHCP, tough with static. Hotel/Motel and restaurant are other examples where networks may contain "privileged" subnets (reservations, billing or order processing) mixed in with "Free WiFi" for the customers. (AKA Security nightmare, just like student/faculty/admin issues)

 

DHCP reservations are self-documenting if you fill in the "comment" field. Then the guru doesn't have leverage. Let him quit, the next administrator can pick up the pieces. And if guru tries malicious destruction of the DHCP server, the tables are backed up every day. Most local workstations don't get their static IP settings backed up overnight, because they're turned off when the backup runs; and that's only if you DO periodic backups of local hard drives.

 

Whats "best", Fixed or Dynamic IP? - It depends on what you want to do.

DHCP with reservations gives you an opportunity to get the best of both.

 

What's the "best" car? Well, a Ferrari is cool, but if you want 50 MPG, Ferrari won't do it. A Prius might get 50 MPG or more, but it's not at the top of the "chick magnet" list. If you already have 5 kids, neither one will do what you need. And what if you want to tow your boat to the lake?

 

My point is that you should understand both the benefits and shortcomings of whatever solution you choose. There's always more than one way to do something, but there's rarely "the best" or "the right" way. Any solution is based on assumptions and compromises. Make the decision with awareness and understanding, not just a quick-and-dirty "this will work."

 

In my experience, front-end homework pays off later. And "experience is what you get when you didn’t get what you wanted." I've had LOTS of experience.

 

Just my $0.02 - for whatever that's worth.