Multiple Windows DHCP Servers

[geohanson]

Hi all,

 

We are currently running multiple DHCP servers on our network and ideally want to amalgamate these into one VM, then setup DHCP failover to a 2nd VM

Most of our DHCP is provided from one VM, with DHCP relay configured on our Firewall.

We also have a few other DHCP servers which just provide DHCP on that specific subnet -EG Our 'main network' has DHCP running on DC1

 

So the question is, on which subnet should the actual DHCP server (and soon to be DHCP failover server) sit?

Do we run multiple DHCP servers for better security? EG - our Guest WiFi has its own DHCP server that lives on the Guest WiFi subnet. Probably better from a security standpoint but then it becomes difficult if you have lots of DHCP servers.... 

Is there a security risk having Guest WiFi DHCP served from the vlan that contains all the servers? 

 

Any thoughts would be much appreciated

Thanks!

 

[speakercon]

I used to have DHCP on the server vlan however I now do DHCP on the firewall or core switch. I'd at least run the guest on the firewall if that's what your using for routing.

[StephenPink]

2x DHCP Servers in Load Balance mode, on the standard server VLAN. Guest WiFi is completely separate - DHCP/DNS directly from firewall.

[Julian]

I have 2 virtual servers, running load balanced DHCP, DNS, and A/D, each server on a diffrent vmware host.

 

 

[Olliedawg]

Two DC's here on seperate hosts, each running DHCP/DNS service. DHCP setup in failover.

 

DHCP for Guest network runs on the firewall

[psydii]

as per @olliedawg @julian and @StephenPink.

 

DHCP logs can be useful for cross referencing when investigating incidents, so make sure you have logging enabled what ever platform you choose.

 

If you don't already have it set up you will also need to configure an IP/UDP/DHCP Helper/Relay in the config of each vlan/ip interface on the core-switch/router so that DHCP traffic from each VLAN to be served is relayed between the clients and the servers.  You will need both DHCP servers in the config otherwise one wont be used *and* a random-but-non-trivial amount DCHP requests will timeout.

[geohanson]

Thanks for the replies

 

So, I will move the Guest WiFi DHCP to something else that just lives on the Guest WiFi subnet. 

 

Are there any issues having the DHCP servers (with DHCP relay configured on the firewall) on the main network with them serving up DHCP for everything other than guest WiFi? What about BYOD? Should that be separated as well? We've got one WiFi (802.1X) subnet per year group, plus sixth form, plus staff which are currently all served from the DHCP VM (which sits on one of the WiFi subnets), but I'd like to put this on the main network and keep everything together other than guest WiFi which I'll keep separate. 

 

 

 

 

 

 

[Jcx500]

2 dhcp vms per domain, i try not to run them on a dc where possible 

[GeneMoody-Action1]

You asked "So the question is, on which subnet should the actual DHCP server... sit"

and the answer is that it is completely arbitrary as long as it is properly configured for each subnet / vlan / nic or you are condensing into a single supernet. 

Remember DHCP is not IP aware, it is subnet aware, Id est, broadcast domain aware.
If they are in the same broadcast domain, they will have no problem racing to serve IPs to anyone asking; and that can get very messy.

And a rogue DHCP server on your network will learn you fast NEVER do that again. 

Do you have a diagram?

 

[KK20]

On your DHCP server, ensure you have your subnets setup, makes no difference on the VLAN/subnet as long as each can ROUTE to your server.  The DHCP server will give an address to a subnet requesting, let your router do the routing (and ip helpers set appropriately).  Look at implementing DHCP snooping on your switches, this can stop rogue DHCP or misconfigured VPN appliances messing things up.  As for failover, this is what we do, you can even tarpit the secondary response if you like on active-active should you prefer a server.

 

I have my server doing all of our DHCP for all subnets, even though the core switch can DHCP, I prefer to keep it under one console.