1

I have a question about correct isc-dhcp configuration. I want to lease ip addresses to users based on switch port. For this I use DLink DES-3200 series switches. Everything works well, but recently I've decided to lease particular subnet to all unknown user, i.e. not explicitly specified in dhcpd.conf file. Here is a config example: # dhcpd.conf

default-lease-time 30;
max-lease-time 60;
authoritative;
log-facility local7;
option domain-name-servers 8.8.8.8;

include "/usr/local/etc/dhcpd/dhcpd.classes";

shared-network "clients"
{
    subnet 10.5.20.0 netmask 255.255.255.0 {}
    include "/usr/local/etc/dhcpd/dhcpd.networks";
}

dhcpd.classes

class "10.5.20.4_2" { match if ( substring(option agent.remote-id,2,15)="10.5.20.4" and binary-to-ascii(10, 16, "",  substring(option agent.circuit-id, 4, 2)) = "2" ); }
class "10.5.20.4_1" { match if ( substring(option agent.remote-id,2,15)="10.5.20.4" and binary-to-ascii(10, 16, "",  substring(option agent.circuit-id, 4, 2)) = "1" ); }
class "10.5.20.2_1" { match if ( substring(option agent.remote-id,2,15)="10.5.20.2" and     binary-to-ascii(10, 16, "",  substring(option agent.circuit-id, 4, 2)) = "1" ); }
class "10.5.20.2_3" { match if ( substring(option agent.remote-id,2,15)="10.5.20.2" and binary-to-ascii(10, 16, "",  substring(option agent.circuit-id, 4, 2)) = "3" ); }
class "10.5.20.2_2" { match if ( substring(option agent.remote-id,2,15)="10.5.20.2" and binary-to-ascii(10, 16, "",  substring(option agent.circuit-id, 4, 2)) = "2" ); }
class "10.5.20.2_4" { match if ( substring(option agent.remote-id,2,15)="10.5.20.2" and binary-to-ascii(10, 16, "",  substring(option agent.circuit-id, 4, 2)) = "4" ); }

dhcpd.networks

subnet 172.30.20.0 netmask 255.255.255.0
{
   option subnet-mask 255.255.255.0;
   option routers 172.30.20.1;
    pool {range 172.30.20.3; allow members of "10.5.20.4_2"; }
    pool {range 172.30.20.2; allow members of "10.5.20.4_1"; }
}
subnet 172.30.160.0 netmask 255.255.255.0
{
   option subnet-mask 255.255.255.0;
   option routers 172.30.160.1;
    pool {range 172.30.160.3; allow members of "10.5.20.2_1"; }
    pool {range 172.30.160.4; allow members of "10.5.20.2_3"; }
    pool {range 172.30.160.10; allow members of "10.5.20.2_2"; }
    pool {range 172.30.160.12; allow members of "10.5.20.2_4"; }
}

So if add add let's say:

subnet 172.20.111.0  netmask 255.255.255.0 {
                        option routers 172.20.111.1;
                        max-lease-time 60;
                        min-lease-time 30;
                        range 172.20.111.10  172.20.111.20 ;
                        }

at the end of dhcpd.networks file (which I include into shared-network 'clients' clause, see above), all my clients start getting ip addresses from 172.20.111.0 range, regardless if they have a class specified for their port.

Is there a way to make dhcpd server first look at class declarations and then subnet ?

Improve this question
2
  • How is the DHCP server attached - is it via a helper-address on a router on a per-VLAN basis, directly connected to a single VLAN where all of these addresses are potentially out there or something else entirely? It may be that you need to encapsulate this in a shared-network statement.
    – rnxrx
    May 29, 2012 at 13:37
  • I have multiple VLANs on the server, vlan per network. I place all of them into shared-network clause, which is logically incorrect, but works and simplifies my configuration.
    – Alec T
    Jun 1, 2012 at 7:57

3 Answers 3

Reset to default
1

You write that you added the new subnet at the end of the dhcpd.conf file. You need to add it to the shared-network, otherwise dhcpd will not consider these networks as alternatives.

Improve this answer
1
  • Actually I add it to shared network clause. Sorry, I did not say it right, now I have corrected my question. And it still leases me 172.20.111.10
    – Alec T
    Jun 1, 2012 at 7:53
1

After reading man dhcpd.conf and playing around I've managed to achieve my goal by making the following ammendments to my dhcpd.networks file:

subnet 172.20.111.0  netmask 255.255.255.0 {
    pool {
        option routers 172.20.111.1;
        max-lease-time 60;
        min-lease-time 30;
        range 172.20.111.10  172.20.111.20 ;
        deny members of "10.5.20.4_1";
        deny members of "10.5.20.4_2";
        deny members of "10.5.20.2_1";
        #  .... etc
}

}

Now it works the way I want it, although I'm not sure if it's going to scale well.

Improve this answer
1
  • Of course, that looks good!
    – Oliver
    Jun 1, 2012 at 13:36
1

Just an addition to this old but still valid thread. It simplifies the subnet section but adds one line per fixed IP.

class "FastIP"{
      match pick-first-value (option agent.circuit-id);
}

class as before:

class "IP-10.1.2.3" {
       match if option agent.circuit-id = "YourOp82Value";
}

Add this for each Op82 value to exclude the fixed IP customer from the free pool: subclass "FixedIP" "YourOp82Value";

In the subnet:

deny members of "FixedIP";
pool { 
        allow members of "IP-10.1.2.3" ; 
        range 10.1.2.3 10.1.2.3;
}

This way you don't have to crowd the subnet section with lots of deny-lines. One will do.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .