Sanity check and how to 2 DHCP servers

[titch]

Hi all

 

We've got a standard windows DHCP server dishing out IPs to our different VLANs. All working fine and as it should.

 

We are getting closer and closer to being fully intune and what I would naively call "zero trust"

 

We would like to move to having our Untrusted VLAN having it's IPs dished out by our firewall instead (Palo Alto).

 

We aren't currently in a position to power down our windows DHCP server yet so we would end up with 2 devices dishes out IPs albeit on 2 different VLANs.

 

This would then mean our domain joined devices stay being dished IPs by our windows server and any Untrusted or unknown devices get a straight through to the internet via the firewall which has also given it an IP.

 

Does this sound sensible/possible

 

How can I set this up without killing my network with 2 DHCP servers [emoji848]

 

Thanks In advance

[Simcfc73]

My network is pretty simple and has 2 dhcp's.

 

Window server for all my domain machines and

My Sophos FW has 2 ranges for wifi guest access which are on seperate vlans.

 

My Sophos box does the routing of very limited intervlan stuff.

[Aprice]

Pretty easy to do, just remove the scope on the Windows Server for that subnet. Remove the IP Helper / DHCP relay to the Windows server from that subnet as well. (just doing that should stop it working, assuming that's how it's setup)

 

Activate the DHCP server for the new VLAN on the firewall.

[dmj]

It doesn't sound like a great idea to me: Having two systems doing the same job on two networks doubles your likelyhood of failure.

A much better solution would to have a HA setup whereby a single service controls both networks with a failover to another DHCP server: you half the risk and not double it.

[TheHyperTechie]

I would probably wait until you are in a position to migrate all DHCP scopes for each subnet to the firewall. It sounds like things could get messy... If you decide to proceed, I imagine it's just a matter of removing the scope for the specific subnet you want to migrate from the Windows DHCP server. Additionally, you might want to consider adjusting lease times to ensure devices pick up an address smoothly from the firewall.

 

I did a similar thing a while ago, glad I did as DHCP/DNS seems to be solid on our juniper box.

Edited March 26, 2024 by HyperTech

[howartp]

We have two DHCP servers.

 

Windows DC does all the wired vlans.

Smoothwall does the WiFi/BYOD; wifi traffic can't get at wired network except where firewall bridge rules allow.

 

Works fine and hasn't caused us any issues.

[timbo343]

As long as you have VLANs and your firewall / router is configured to give out addresses via DHCP on each VLAN you should be fine.

 

We have hsd this setup for years! Must be around 12 years and starting to push it out to our primaries that we now support.

 

I have found out recently that Meraki switches are a PitA and you have to block DHCP servers that you dont want the switches to look at otherwise they can be issued a DHCP address from other VLANs - i'm starting to dislike Meraki kit!!