2

So we're running single DHCP servers (at each location, we have 3 locations) that serves up IP addresses to our employees/staff as well as our student body. We have a single DHCP server that connects to our switches in our core switch area.

As I've been redesigning our network and been looking into DHCP problems we've been having over multiple connected campuses with their own DHCP servers, we basically as of this question have a gigantic hub in which whatever DHCP server responds first gives out that IP address. Problem is, we're getting routing issues and a godawful mess of other issues because of DHCP leases. The functions of the DHCP servers at each remote location is simply IP lease and printer file hosting for both employee/staff and students.

This December, we are creating "islands" within the 3 networks and routing will be handled by some some L3 switches and actual firewalls. My question is with this change in the network, is it time to break free and have independent DHCP servers for the students? I'm trying to design all of this with as much convenience and security in mind which is a nightmare considering I've inherited a broken system with huge gaping holes only 3 IT people to do the job.

After reading a whole bunch of articles on BKM's from TechNet, I wanted some real-world expertise from everyone here.

2
  • this could all be handled with a single dhcp server, if there are no network acl's in the way. This would be the simpilist configuration and mostly likely the most reliable. I'd run netmon\wireshare at each location to see what dhcp was doing.
    – tony roth
    Sep 20, 2011 at 13:28
  • Hey Tony, see below.
    – Aaron H
    Sep 20, 2011 at 23:05

1 Answer 1

2

Some elaboration on what you mean by "routing issues and a godawful mess of other issues because of DHCP leases" might help us understand more about where you're coming from. There's no inherent reason that a central DHCP server can't do what you want.

I believe I have a similar situation to yours in one of Customers. They have a campus of 5 buildings with around 1,000 fixed wired clients and 200 wireless clients (some of which move between the buildings). We use a pair of central DHCP server computers (running Windows Server 2008 R2) to provide DHCP for the entire network. I'm quite happy with the configuration.

The individual buildings have layer 3 switches that perform the intra-VLAN routing and inter-building routing. There aren't firewalls in the buildings, but there are some ACLs on the layer 3 switches that provide some firewall functionality.

I'm relying on features in my wireless access points (Ruckus) and layer 2/3 switches (Dell and Cisco) to prevent clients from exhausting the DHCP scopes with bogus requests and to identify and lock-out ports with rogue DHCP servers. If I wanted to get really fancy I might consider using MAC address-based filtering on the DHCP servers for sensitive scopes, locking down specific switch ports to only known MAC addresses, and / or other tricks to be more draconian. (We are splitting off the DHCP for the public wifi subnets to a pair of ISC DHCPd servers, but we're doing this because of discrepancies from Microsoft in statements about whether or not a CAL is required for DHCP, not because of any architectural issue.)

I don't have secure space in each building for server computers, so putting DHCP servers in each building wasn't possible from a pure physical security perspective. I didn't see any functional advantage to having distributed DHCP servers, either. If the inter-building links are down having DHCP in any given building isn't going to help because they've got no on-site resources to access anyway. Having 5 single points of failure instead of the pair of central DHCP servers also seemed like a bad idea. Likewise, putting 2 DHCP servers into each building to provide in-building redundancy and increasing the server count to 10 seemed like creating a lot of administrative burden and server computer hardware / software licensing expense.

1
  • I second your 1st paragraph!
    – tony roth
    Sep 20, 2011 at 13:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .