I currently administer a Windows 2008 domain network with DHCP running on the DC. Clients obtain addresses dynamically and servers are assigned static addresses.

In the case that the DC fails overnight and workers come in the morning, they will not have an IP address and won't be able to connect to the internet. I figured that if I move the DHCP to the firewall, people would still be able to login to the internet and the network would still be basically functional, without AD features.

Am I incorrect with my logic? What are pros and cons of having DHCP on the firewall in an Active Directory network?


There are no real pros or cons to having a DHCP server in a firewall vs on a server. As long as it is correctly configured, it doesn't matter a whole lot. In some cases, hardware firewalls have finite resources that are better used for NAT, packet filtering, and even VPN termination. Adding DHCP, DNS, and other superfluous roles can reduce performance.

With Windows Server 2012, you can do HA DHCP without using clustering, so that you have hot standby failover partners. This is the new best practice for HA DHCP as opposed to the old method of DHCP clustering which is complicated and cumbersome. If you're really worried about this you should grab a few copies of Server 2012 or 2012 R2 and set this up.

It also sounds like you have a single domain controller. This is really bad for a number of reasons. Please have more than one DC in your environment.

  • +1 for the info on Windows 2012. I do have two DC's actually. – blizz Oct 14 '13 at 6:00
  • BTW do you know how to have the internal DNS records automatically updated when the firewall assigns a new address to an existing client? I have heard some firewalls support DNS updates through Kerberos but mine does not. – blizz Oct 14 '13 at 6:03
  • Windows clients will update themselves in DNS directly when they receive a new IP. There is no need to configure your firewall to do anything other than set the client DNS servers properly. – MDMarra Oct 14 '13 at 12:02

In addition to the answer DNUCKLES provided, assuming that your DC is also your DNS server and that you are correctly only pointing domain clients to the DC/DNS in their DNS client settings then having DHCP on the firewall isn't going to do the clients a whole lot of good if they don't have DNS name resolution from the DC.

That being said, you could (should) set up a second DC/DNS server and then you could run DHCP on this second server as well. Using the DHCP split scope wizard will allow you to split your DHCP scope between the two server so that if one is down the other is still able to provide AD, DNS and DHCP services to the clients.


I just saw your windows-server-2008 tag. The DHCP split scope wizard was introduced in Windows Server 2008 R2. You can still split your DHCP scope between 2 Windows Server 2008 DHCP servers but you have to do it manually (50-50 split, 80-20 split, etc).

  • If I set up DHCP on a second server, will it stay in standby mode until the first server is down, or will both servers be responding to requests? – blizz Oct 14 '13 at 4:18
  • 1
    DHCP servers don't go into "standby" but you could have the DHCP service disabled until it's needed (I don't recommend doing it this way). That being said, the purpose of splitting your DHCP scope between 2 servers is so that they can both serve clients simultaneously so that you don't have a single point of failure for the DHCP service. More importantly you should have at least 2 servers providing AD/DNS services to the clients. – joeqwerty Oct 14 '13 at 4:37

At the risk of splitting hairs, it should be noted that there are no longer PDC's, but rather PDC emulators, which is a FSMO role. With that said asking to provide a pro's and con's list for this would depending on what you're hoping to use as your firewall appliance.

Perhaps the most notable difference and disadvantage to using your firewall as opposed to Windows DHCP is that your client addresses won't register dynamically on your DNS server anymore.

  • 2
    -1 Perhaps the most notable difference and disadvantage to using your firewall as opposed to Windows DHCP is that your client addresses won't register dynamically on your DNS server anymore. By default, Windows clients self-register their records in DNS and it has nothing to do with DHCP. How do you think that servers with static IPs have dynamic records in AD DNS zones? Very few installations are configured for DHCP proxy DNS registration and it's definitely not the default or recommended behavior. – MDMarra Oct 14 '13 at 4:22
  • Why would someone minus 1 that and not explain why? I actually really need to know if what MDMarra is saying is correct or not. – blizz Oct 14 '13 at 6:21
  • 2
    I did explain why I -1'd @blizz. If you would like to know more about he dynamic DNS update process, read this: technet.microsoft.com/en-us/library/cc771255.aspx – MDMarra Oct 14 '13 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.