0

Before I joined the company I work at, someone decided to make use of the 10.150.0.0/16 range for the company LAN (despite the company not having nearly that many devices). I think their idea at the time was to use the 3rd IP byte (10.150.X) to separate various infrastructure types while keeping them all on the same network. As such, critical hardware components (routers, APs, main HyperV hosts) are on 10.150.0.X, main servers are on 10.150.1.X, secondary servers seem to be on 10.150.2.X, and then there's the DHCP which assigns IPs from 10.150.3.1 to 10.150.4.254.

That's a pretty wide range, and quite frankly, it's a bit of a mess. Especially with the DHCP assigning IPs to everything from PCs, laptops, to mobile phones and even development servers.

I was hoping I could try and clean things up a bit. I'd like to make use of the NPS to set up various policies (so, for example, main domain servers would have a different policy than development servers and these would have a different policy from WiFi connected devices) and then use that information to assign different IP ranges. Except, I'm not sure if this is at all possible, given the wide net mask. Simply trying to set up a second DHCP scope for another IP range (say, 10.150.6.1-10.150.6.254) with the same netmask throws an error in Windows DHCP, which makes sense in a general way.

So, is what I'm trying to do at all possible? Or is my only course of action redesigning and reconfiguring the entire network?

3
  • What's the error you're getting when trying to add the new scope? And what's the actual existing scope and what is its subnet mask? You might be able to go ahead and add the new scope by first editing the old scope. Also, is there no internal routing and/or no VLANs set up? Nov 18, 2017 at 13:59
  • @ToddWilcox There are no VLANs and the current routing is almost non-existent as everything's on one network anyway. The current scope has the same subnet, i.e. /16, and adding a new scope (different IP range, but same /16 subnet) ends with with the error The address range and mask conflict with an existing scope. This error prevents the creation of the scope entirely.
    – MBender
    Nov 18, 2017 at 15:16
  • The address range and mask conflict with an existing scope - Right. You can't create a scope that overlaps another scope. If you look at your existing scope you'll see that it is 10.150.0.0 and you'll see that the address pool (range) for the scope is 10.150.3.1-10.150.4.254. Trying to create another scope for any "address range" within 10.150.0.0/16 would create an overlapping scope with the existing scope, which can't be done.
    – joeqwerty
    Nov 18, 2017 at 16:41

1 Answer 1

1

You are correct that /16 with 65,536 IP addresses is an awfully huge subnet for your purposes. If it's ok to have every device on the same subnet, every IP address mentioned here fits within 10.150.0.0/21 with 2,048 addresses. That would be relatively easy variable to change, at first. Just remember to change it everywhere at once.

If you need to separate the networks and use more than one DHCP scopes, you'd use /24 and /23 subnets and arrange routing between them. That enables you to make router level firewall rules and intrusion detection between servers/clients and wired/wireless without accessing their configuration and even with BYOD. For this, with W2008R2 DHCP, you have two options:

  1. Have one network interface per subnet directly on your server i.e. the server on all subnets.
  2. Support multiple subnets with one DHCP server by configuring DHCP relay agents.
2
  • What about using NPS rules I've mentioned?
    – MBender
    Nov 18, 2017 at 15:23
  • 1
    AFAIK DHCP assigns IP addresses within the same subnet and there can only be one scope per subnet. The linked article works on opposite direction: assigns NPS rules based on DHCP scope, not DHCP scopes based on NPS rules. Nov 18, 2017 at 15:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .