Before I joined the company I work at, someone decided to make use of the range for the company LAN (despite the company not having nearly that many devices). I think their idea at the time was to use the 3rd IP byte (10.150.X) to separate various infrastructure types while keeping them all on the same network. As such, critical hardware components (routers, APs, main HyperV hosts) are on 10.150.0.X, main servers are on 10.150.1.X, secondary servers seem to be on 10.150.2.X, and then there's the DHCP which assigns IPs from to

That's a pretty wide range, and quite frankly, it's a bit of a mess. Especially with the DHCP assigning IPs to everything from PCs, laptops, to mobile phones and even development servers.

I was hoping I could try and clean things up a bit. I'd like to make use of the NPS to set up various policies (so, for example, main domain servers would have a different policy than development servers and these would have a different policy from WiFi connected devices) and then use that information to assign different IP ranges. Except, I'm not sure if this is at all possible, given the wide net mask. Simply trying to set up a second DHCP scope for another IP range (say, with the same netmask throws an error in Windows DHCP, which makes sense in a general way.

So, is what I'm trying to do at all possible? Or is my only course of action redesigning and reconfiguring the entire network?

  • What's the error you're getting when trying to add the new scope? And what's the actual existing scope and what is its subnet mask? You might be able to go ahead and add the new scope by first editing the old scope. Also, is there no internal routing and/or no VLANs set up? – Todd Wilcox Nov 18 '17 at 13:59
  • @ToddWilcox There are no VLANs and the current routing is almost non-existent as everything's on one network anyway. The current scope has the same subnet, i.e. /16, and adding a new scope (different IP range, but same /16 subnet) ends with with the error The address range and mask conflict with an existing scope. This error prevents the creation of the scope entirely. – Shaamaan Nov 18 '17 at 15:16
  • The address range and mask conflict with an existing scope - Right. You can't create a scope that overlaps another scope. If you look at your existing scope you'll see that it is and you'll see that the address pool (range) for the scope is Trying to create another scope for any "address range" within would create an overlapping scope with the existing scope, which can't be done. – joeqwerty Nov 18 '17 at 16:41

You are correct that /16 with 65,536 IP addresses is an awfully huge subnet for your purposes. If it's ok to have every device on the same subnet, every IP address mentioned here fits within with 2,048 addresses. That would be relatively easy variable to change, at first. Just remember to change it everywhere at once.

If you need to separate the networks and use more than one DHCP scopes, you'd use /24 and /23 subnets and arrange routing between them. That enables you to make router level firewall rules and intrusion detection between servers/clients and wired/wireless without accessing their configuration and even with BYOD. For this, with W2008R2 DHCP, you have two options:

  1. Have one network interface per subnet directly on your server i.e. the server on all subnets.
  2. Support multiple subnets with one DHCP server by configuring DHCP relay agents.
| improve this answer | |
  • What about using NPS rules I've mentioned? – Shaamaan Nov 18 '17 at 15:23
  • 1
    AFAIK DHCP assigns IP addresses within the same subnet and there can only be one scope per subnet. The linked article works on opposite direction: assigns NPS rules based on DHCP scope, not DHCP scopes based on NPS rules. – Esa Jokinen Nov 18 '17 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.