Pros/cons of using switches vs server for DHCP

[itskdog]

Hey everyone,

 

We're in the process of preparing for a summer job of retiring our server almost entirely and move to Autopilot+Intune (we can't move printing to the cloud just yet as we're using RISO MFDs, and we want copying to impact credit balances, but the DirectPrint integration doesn't support that yet, so one more year of PaperCut MF it is), and considering how we're going to manage DHCP.

 

We're torn between keeping our existing DHCP settings on Windows Server 2016 for the time being, or moving it onto our core switch stack via Meraki L3 routing, but with no routing, just a DHCP server.

 

Naturally, third-party support contractors (RM in our case, who are also managing the cloud configuration for us) would be able to aid us with the server-based DHCP more, but Meraki do quote 24/7 phone support if there are issues.

 

Does anyone have any experience using switch-based DHCP, on Meraki or anything else, and could advise on the pros & cons of that compared to a traditional setup?

[Koldov]

We have DHCP on the switches. I'm not an expert in any of this so can't give you any actual help, however...

 

Unfortunately ours (old CISCO kit) have no helpful GUI, all done by CLI... they were set-up like this before I started (BSF funded). The IT support here at the time was minimal (half a day a week or something) and I'm guessing they thought it was better that way as the new BSF cabling, switches and WAPs came with a fully funded support contract for a few years.

 

Never bothered to take it off to put it on the server as never really had any issues with it as such (only pain was when we needed a whole new IP addressing scheme and VLANS re-created).

Edited July 3, 2025 by Koldov

[MatthewL]

How are you doing DNS on site with no server?

 

Depending on what firewall solution you have you could potentially use DHCP on there which I would personally go for if its an option.

[itskdog]

As we'd be

5 minutes ago, MatthewL said:

How are you doing DNS on site with no server?

 

We'd have no need for on-side DNS with no AD, so I believe the plan from RM was just to put LGfL's DNS servers in the DHCP config.

 

6 minutes ago, MatthewL said:

Depending on what firewall solution you have you could potentially use DHCP on there which I would personally go for if its an option.

 

Our firewall is managed by Wavenet (who acquired AdEPT Education, who acquired Atomwide) as part of our LGfL broadband, we don't have any control over it other than logging a service call with Wavenet to open ports as needed, and even then they can be a bit funky about it. Just had to get a firewall swap so they could open ports by FQDN for O365 HVE, and still it's not entirely reliable as I think they still just did it by IP address... 🤷‍♂️

[psydii]

Firewalls have to convert the hostname to an IP address at somepoint, because unless the filtering is via a proxy, ultimately firewalls make their decisions at the IP/Protocol  level.

 

0365 HVE DNS records have a TTL of 2 seconds,  and in systems that are already processing a lot, changing firewall rules every two seconds is going to be a struggle to get reliable.   I think this is something Microsoft might have to revisit before the service comes out of preview.

[psydii]

To speak to your initial question though,  if you've got rid of on prem manamgement and authentication, then the tight integration of MS DHCP and DNS (and AD) is no longer relevent.... so having your switch handle both (if its got enough oomph) and configured to pass queries to LGFLs DNS seems like a no-brainer. But if considering having no on-prem dns server, bear in mind that you find it of benefit  to have on prem devices registering in local dns (printers, building management system, doors controllers, wifi APs, switches, phones, ups, franking machines, cashless catering tills, etc) for ease of management  and troubleshooting. 

[dmj]

The question is really migrating Windows DHCP -> *nix DHCP. I've done this many times without regret. 

Forget that they are 'switches' they are just 'computers'

[psydii]

A *nix box would be my initial plan, I think, if I were getting rid of the windows infrastructure in anything but the smallest of LANs. 

 

Running on a linux server you get to pick and choose the actual dns and dhcp servers to suit your specific needs, but with a switch (like Windows) you have to take what ever the vendor baked in. 

 

Though, if solution is to have a standalone DNS/DHCP server, how do you monitor and maintain it? When you have servers you probably have a monitoring and maintenance platform of some kind. But when you've just got a single little nuc or Pi with two services, what do you do that doesn't further violate the *intent* that drove the decision to go serverless?

 

But with a goal of eliminating "servers" (that run software) you are forced to use what ever the remaining vendors made available in  the "firmware" of the switches/aps/routers or portal (in LGFL's case)

 

Also once you pop a server into the mix, I could see myself sliding into having radius and a CA (to eliminate all those cert errors when managing all those network devices with embedded web servers)... at which point from a "time is money" perspective - I might as well just pay for two perpetual Windows server 2025 licences, and keep the core of the old AD infra running in perpetuity. (less *fun*, but orgs don't want core infra to be fun). 

 

Now since *any* step away from the goal of "serverless" clearly results in you either replicating the Windows network infrastructure  capabilties on a new linux server, or just keeping you old core Windows AD servers, the only correct* solution is to stick with what is available on the switches/aps/firewall/LGfL portal.

 

 

*YMMV.

 

 

[mavhc]

Your switch is now a server, it's running a dhcp server, if you want to go serverless you must use IPv6 stateless configuration

 

Serverless is a stupid term

[dmj]

12 minutes ago, mavhc said:

Your switch is now a server

Always was...

[DWilson1997]

We're using our Meraki core stack for our DHCP. DNS forwards to either our firewall (then onto PDNS) or directly to PDNS. Haven't had any issues with the setup since it was implemented. 

[mavhc]

6 minutes ago, dmj said:

Always was...

It has open ports, no! wrong kind of ports!

[STK91]

37 minutes ago, mavhc said:

Your switch is now a server, it's running a dhcp server, if you want to go serverless you must use IPv6 stateless configuration

 

Serverless is a stupid term

🙄

[TwistedHelixis]

I was thinking about getting a Synology NAS (plus version) to do our DHCP. If needed, they can also do DNS