DHCP on an S2D Cluster vs. Domain Controllers: What's the Best Practice?

[Jaan]

 

Hey everyone,

I'm looking for some advice on a network configuration decision. I have a 3-node Storage Spaces Direct (S2D) cluster and two domain controllers.

My current setup has the DHCP role running on both of my domain controllers. I'm considering migrating this to the S2D cluster instead. The primary reason for this is that I'm planning to implement VLANs on my currently flat network, and I'm wondering if having the DHCP role on the cluster would be a better, more robust solution.

 

I'd appreciate any insights or experiences you can share in your setups! Thanks in advance.

 

I also use veeam to backup the nodes and the vms..... not sure how veeam handles "roles" that have been clustered.

 

Thanks

[ThatBoringBloke]

I know that this isn't answering your question but we moved DCHP from the servers to the switches when we set up VLAN's.

In an age of services, not servers it seemed to make more sense.

[ThomL]

Domain controllers shouldn't be running DHCP, they should run the minimum about of roles to serve their purpose as DC's... At least this has always been what I've read online, in books and taught to me many years a go. Sure they can serve other purposes, but they really shouldn't, making them are easier to replace, maintain, etc. 

 

I wouldn't move the role to the cluster nodes either - again, these serve a very particular purpose, especially when configured as an S2D cluster.

 

What firewall are you using? You'll be wanting to build some policies surround inter-vlan routing and traffic, we use a clustered FortiGate solution for this - it also handles DHCP for vlans that don't contain domain joined Windows devices (e.g. BYOD wifi, building access, printers, alarm/building management system/etc.). For the windows domain joined clients we have 2 'services' virtual servers that we use to cluster/distribute roles/services between. These servers contain the DHCP roles, NPS roles, and other various things that need a generic services type server to run and clustered/distributed between the servers where possible to allow for redundancy. It worth remembering for each client that leases an IP from your Windows DHCP server you need to have a license, this is why we only use the Windows Server DHCP servers for domain joined Windows clients.

 

 

[Jaan]

We have a Sophos XGS, but also have a layer 3 core.

 

Fs.com aggregation core l3 /edge l2+ switches and Sophos APX. We also have a HPE switch stack that is just the cluster. it connects into the fs.com aggregation "core". We could prob do away with the hpe switches to be far and just have a collapsed core consisting of just the fs.com switches.

 

i've got Gemini AI to draft a guide for me, based my what i think i want to achieve as well as a little interactive site

 

Guide and interactive site attached in case it's useful for someone else. 

 

EDIT can't attach the interactive site site won't allow me to attach.

 

VLAN Transition Framework with FS.com Switches.docx

Edited September 18, 2025 by Jaan

[ThomL]

Follow a ransomware incident we also implemented a more service based approach to our vlans/network segmentation - we no longer have a generic 'servers' vlan - AD servers are in their own vlan, file servers are in their own vlan, services servers are in their own vlan, etc. all policed by the FortiGate firewall cluster with strict policies attached to control the inter-vlan routing. We have more Vlans for our domain joined servers alone than total vlans you have in the document, on top of the server vlans we have the various other vlans you have in your document for clients, management etc. Might be something you want to architect in to the plan? 

[Davit2005]

Agree, Just adding vlans on their own without an ACL/firewall does not improve security, It ends up been security via obscurity. But I don't see anything wrong with running DHCP on a DC as long as firewall rules are configured correctly.

 

I have a different view of 3rd party Apps on DCs. If an app needs to be installed on a DC you need to ask why. And if need be install on a read-only DC. I would only run DHCP, DNS and Domain services on a DC.

 

Edited September 18, 2025 by Davit2005

[Davit2005]

I also understand that to have a separate domain for the cluster is best for security. I've never really got into HyperV, TBH, always considered it too much of a backwards step compared to VMWare, yep you have got licensing options that are cheap. An OS designed for Virtualization is a better choice INMO, i.e. ProxMox (ok so it does use Debian underneath), VMWare was before it was taken over and prices sky rocketed, XCP-NG (never tried personally but have done some work on ZenServer). Early support of Linux was not great on HyperV (wonders why, lol)

Edited September 19, 2025 by Davit2005

[Aprice]

Yep, would always suggest a separate domain for the cluster, also makes troubleshooting easier. 

I'd say minimising the services that are on a DC is a good idea, from a security practice anyway. The downside of running it on switches / routers often is that it's a pain to manage over the Windows DHCP utility.