Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

We've got a problem with our network here but first I'll give a bit of background info:

DHCP running on a windows server 2000 box is configured to hand out 2 IP Ranges 10.25.104.xxx and 10.25.106.xxx The network infrastructure runs on a Cisco Catalyst 4506 of which are linked via fibre. The network team has configured 1 of the 4506's to only allow 10.25.104.xxx traffic and the other 4506 to only allow 10.25.106.xxx traffic.

Everything works fine apart from when you wish to move a PC/laptop from one end of the building to the other. Then the IP isn't released or renewed as DHCP constantly trys to give it the same IP again that won't work on the other VLAN (lease times have been set to minimums but still no use).

What we really want to allow is for users that move around and presentation laptops to be able to obtain an IP that works with both IP ranges on either of the 4506's.

Does anyone know why this happens? is it the way DHCP is configured? or is it the 4506 and the way it has been configured? Is it to do with VLANs? Can more than 1 vlan be setup(or have access) on 1 port?

Sorry for all the questions, dont know that much about VLANs and the like - any help much appreciated!

Thanks,

John

share|improve this question
Re-read your question carefully. You are missing some words, I think. – Evan Anderson Jul 7 '09 at 14:04
Have you talked to your network engineers? There might be a good reason they don't have it setup the way you are requesting. – Russ Warren Jul 7 '09 at 14:05
Hi sorry, I rushed this yesterday as I was leaving the office - yes we've spoken to our network engineers and they are saying its DHCP. I personally don't think it is. We have 1 DHCP server serving to the 2 super scopes. – John Jul 8 '09 at 8:22

4 Answers

up vote 2 down vote accepted

It sounds like you don't have two separate layer 2 broadcast domains when you say "IP isn't released and renewed as DHCP constantly trys to give it the same IP again that won't work on the oppsite network".

It's difficult to know what you mean when you say "The network team has configured 1 of the 4506's to only allow 10.25.104.xxx traffic and the other 4506 to only allow 10.25.106.xxx traffic." The phrase "configured to allow" could mean access-control-lists, or it could mean a VLAN configuration.

My guess is that you're running both DHCP servers in a single layer 2 broadcast domain. Talk to your "network team" about putting in an "ip-helper" statement into the layer 3 entity that routes between the 10.24.104.xxx and 10.24.106.xxx subnets, pointing DHCP traffic to the Windows 2000 DHCP server, and ask them to be sure that there's no layer 2 broadcast permitted between the subnets.

Edit:

Since it appears that you are using a DHCP superscope, I'll go ahead and edit my answer a bit.

My guess is that your "network team" has already configured the layer-3 entity routing between the subnets with an "ip-helper" setting for your DHCP server. You can confirm that with them to be sure.

Assuming the "ip-helper" is in place all you need to do is delete that superscope (which will break the child scopes back apart into two separate DHCP scopes) and you'll have the functionality you're looking for. The DHCP server, by way of the "ip-helper" will hand out subnet-appropriate addresses for clients.

share|improve this answer
He said he only has 1 DHCP server? – Izzy Jul 7 '09 at 14:49
Yeah. Serving two (2) scopes. My guess is that broadcasts aren't being isolated between the subnets, somehow. I'm not even exactly sure how I'd configure that, but it sounds messy. – Evan Anderson Jul 7 '09 at 14:58
Sorry, we have no control over the 4506's as they are managed by a 3rd party. We've requested in the past why this happens and they said it was the way DHCP had been setup? I thought it had more to do with the VLANs/access control lists? – John Jul 8 '09 at 8:19
You could do some sniffing to see what's going on. Which subnet is the DHCP server computer living in? – Evan Anderson Jul 8 '09 at 13:14
Hi Evan, its on the 10.25.104.xxx subnet – John Jul 8 '09 at 14:33
show 4 more comments
up vote 0 down vote

They might have bind the ip address with mac address in dhcp configuration. when it connected and tries to renew from another pool when it will not work.
Remove the mac address binding from dhcp configuration & make it dynamic.
Create 2 pools one for desktop machines and another for laptops. I these tips might work.

share|improve this answer
up vote 0 down vote

Seems as if both ranges are served from the same scope (or actually have two scopes configured, but super-scooping enabled). The laptop will (usually) send the IP it last had as part of the initial request and as that is within the range and either unallocated or allocated to the same MAC, the DHCP server doesn't see an issue with letting the laptop have the same IP again.

The solution is to have one scope per VLAN, so that an IP from the other VLAN is not considered valid and a new IP is allocated.

share|improve this answer
Hi thanks, this exactly what I think needs done however could you explain a bit more? For example would I need to install another DHCP server on the other VLAN? Thanks! – John Jul 8 '09 at 13:24
up vote 0 down vote

I think your network guys might need to look into using the "ip helper-address" parameter for each of the vlans you have setup.

The ip helper-address command tells the switch where to send DHCP requests, if the DHCP server is on a separate network.

interface Vlan250
description Office Workstation VLAN
ip address 10.0.250.1 255.255.255.0
ip helper-address 10.0.100.12

interface Vlan253
description Wireless at office
ip address 10.0.253.1 255.255.255.0
ip helper-address 10.0.100.12

I am also assuming that as the user roams around your campus they are either going to restart there system, or at a minimum expect to issue a IPCONFIG /RELEASE and /RENEW?

Otherwise the client system is still going to have a DHCP lease that is valid, but with an old IP address that can no longer be routed through the new switch they are connecting to.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.