Sophos UTM with SFP Modules
In the many years I’ve been providing IT Services, I’ve noticed that whenever taking over a customer from a competitor, or providing consulting services for a company that has IT staff, that I don’t see DHCP reservations being used all that frequently.
I wanted to write a post and create a video to discuss the comparison, when each should be used and the various case scenarios. I’m hoping my readers may provide their own input in the comments.
See below for the video, or read on for the blog post!
As an example: When a customer was purchasing a VoIP PBX, the PBX vendor get angry when I requested that it be configured for DHCP so that a DHCP reservation could be used, I advised I’d prefer this method so I could change the IP when needed for maintenance or network restructuring. They tried to convince me the IP will change on a DHCP Server and the port forwarding will stop working, because they simply had no idea of what a DHCP reservation was. Ultimately when the day came where I had to change the IP and firewall rules for the PBX, I had to log a support call with the vendor since I couldn’t change the IP myself (which resulted in delays, and costs). If we were using DHCP reservations, I could have simply modified the firewall rules, modified the IP address on the reservation, and restarted the device using the buttons on the front panel (I didn’t have any other access to the device).
Just to state the obvious:
It’s in my opinion that for server, network, core, and all top level infrastructure, all of these devices and services should be configured with Static IP addresses.
These devices which are almost always running, and have other services that rely on them, require a set static IP that should and will not change. Typically, these IP addresses will never change, even when major changes are being made to the core infrastructure.
These addresses should always be logged, documented, and added to network topology maps.
DHCP stands for Dynamic Host Configuration Protocol, and was created to dynamically configure hosts networking configuration on the fly for easy deployment.
In it’s most simplest explanation, when a computer (or device) that is configured to use DHCP reaches out to the network, the DHCP server will assign and provide an IP address for the computer to use.
In home networks, pretty much every computer and device will get it’s IP address from the DHCP server running on the router.
In business networks, pretty much every computer and device that isn’t hosting services will get it’s IP address from the DHCP server running on one of their servers or routers.
DHCP Servers support something called a “DHCP Reservation”, which essentially allows you to provide a pre-set IP address to a specific client based on it’s physical MAC address. This means that the device will always get the same IP address and it will never change (whereas they typically do on occasion).
I’m surprised I don’t see these used more often, as they can become quite the powerful tool on the IT tool belt when used properly. I’ve listed some pros and cons below.
So with the list above, DHCP reservations look pretty powerful. The next question, is where do we use DHCP reservations. Let’s finish off with the devices we’d use them on, and what use case scenarios apply.
Devices:
Use Cases:
I use DHCP reservations frequently with customers that have remote or branch offices in remote geographical areas. When supporting these users and troubleshooting issues, it’s awesome to be able to just log in to the DHCP server to change IP addresses of printers, phones, and wireless access points.
Also, when configuring, shipping, and deploying new devices to these offices, I can simply log and write down the MAC address, configure the DHCP reservation, and the device will get the IP address I’ve chosen once it’s connected to the network and powered on.
Using DHCP reservations, you can easily make big changes to these remote networks without having to be present. If you were to use Static IPs and something was misconfigured, this might cause a physical visit to the site to resolve.
If by change a vendor directly dropships equipment to the remote site, I can simply call someone at that office to get the MAC address. Most devices with a NIC (printers, MFPs, wireless access points), all usually have their MAC addresses printed on the outside of the box. With this information provided, I can login to the remote server, create a DHCP reservation, configure drivers, and push the device config out to the network.
DHCP reservations add to the whole concept of a centrally managed environment, which further helps ease of maintaining, and supporting it.
Leave a comment and let me know your thoughts!
While most of us frequently deploy new ESXi hosts, a question and task not oftenly discussed is how to properly decommission a VMware ESXi host. Some might be surprised to… Read More
This guide will outline the instructions to Disable the VMware Horizon Session Bar. These instructions can be used to disable the Horizon Session Bar (also known as the Horizon Client… Read More
Normally, any VMs that are NVIDIA vGPU enabled have to be manually migrated with manual vMotion if a host is placed in to maintenance mode, to evacuate the host. While… Read More
You may experience GPU issues with the VMware Horizon Indirect Display Driver in your environment when using 3rd party applications which incorrectly utilize the incorrect display adapter. This results with… Read More
Today we're going to cover a powerful little NAS being used with VMware; the Synology DS923+ VMware vSphere Use case and Configuration. This little (but powerful) NAS is perfect for… Read More
Today we'll go over how to install the vSphere vCenter Root Certificate on your client system. Certificates are designed to verify the identity of the systems, software, and/or resources we… Read More
View Comments
Very good information. Thanks for sharing.
Would you create a DHCP reservation for your network switches? I have about 15 -
Hi Kevin,
Typically static IPs would be used for switches, as they would generally always need to be accessible, even when a DHCP server is down.
There might be a few odd non-standard use cases where non-backbone switches may use reservations in remote sites, but I could only see this ever being used in geographically remote sites that aren't easy to visit.
Stephen
Hi Kevin,
Your explanations are so easy to follow.
Thank you for not assuming that we're all IT professionals!
Regards,
Jerry
Hi Stephen,
So sorry to address you as "Kevin"...my bad. I had just read your reply to Kevin.
Jerry
No problem Jerry! Cheers!
I’m trying to set up parental controls via a dns server. I realized that it was possible to get around the dns server by changing the dns server on each device. I’m trying to figure out how to force all devices on my network to go through the dns server I have chosen. I’ve come across port forwarding a few times but am struggling to nail down the steps to make it work. Could you possibly help me with this? Thanks in advance!
In Christ,
Kenny Sparks
Thank you for the thorough, easily understandable explanation, Kevin.
I agree whole heatedly. It's astonishing to think that any vendor supplying network equipment wouldn't know DHCP. I've known about reservations for a long while, but it's never really been showcased as a solution. Whatever makes our lives easier I always say.
This is fantastic info, but when you are a 3rd party vendor that has the only remote access to a device, static is best. It allows for NAT IP configs as well as other VPN server options the hospitals (in my case) use. In other cases, when a reservation or reservations aren't documented properly, remote access becomes a problem when DNS and anything else is changed. Obviously this can happen with static as well, if the hospital doesn't notify the 3rd party of the changes, however, this is generally, at least in my teams experience not the case. Hope that improves things.
I follow basic rules for when to use static IPs and DHCP reservations:
1) Router or Core switch - Static IP
2) Server - Static IP
3) All other infrastructure is DHCP w/reservations (switches, APs, printers, cameras, DVRs, time clocks, appliances, etc)
I contemplated using DHCP for most servers, but since DHCP servers have to be static and some applications might have problems if an IP changes unexpectedly (like due to a DHCP server failure or even a bad switch vLAN change), I decided to keep all servers static.
I've had many vendors tell me they don't support DHCP, but 100% of the time they don't understand DHCP w/reservations is effectively the same as a static IP. I've never come across a device connected to the network that doesn't support DHCP even though I've been told by a vendor on multiple occasions their equipment doesn't support it. I do not budge on this, and force them to learn their equipment better. I'm sure something exists out there that doesn't support DHCP, but do I really want to use something with that bad of a network implementation? What else can't it do?
The cons are minimal and can mostly be mitigated via a robust DHCP server infrastructure.
1) DHCP server must be available - Redundant DHCP Servers make this robust
2) Nothing can interfere with requests between client and server
This one is obvious, but the only problem I've had in the past 15 years using DHCP reservations was our MPLS provider all of a sudden stopped passing DHCP requests from one site to our data center. The work-around was to install a local DHCP server with the reservations defined until the problem was resolved. Once the provider fixed the problem, I just re-pointed the routers to the data center DHCP servers again.
3) A rogue DHCP server can cause problems. It's pretty quick to identify this is happening and doesn't take long to find it. If you disable or isolate unused switch ports, then this has very little chance of happening.
It's important your lease times are long enough to give you time to respond to DHCP server problems.
The pros are massive:
1) All IPs are authoritatively documented in DHCP (minus routers and servers). This makes managing the IP space so much easier. I put in dummy reservations for servers just so DHCP includes those as well.
2) There is almost no chance of an IP conflict
3) Infrastructure setup can be done in one location (like corporate) and moved to its final destination without any reconfiguration required. It's convenient to setup switches, APs, and printers at corporate while on the network, and as soon as you plug them in at the remote location they just work (setup the IP reservation ahead of time).
4) Reconfiguration of IP scheme is trivial. I've done this many times to correct poor IP schemes I've inherited, and by setting the lease time to 5 minutes before the change, all devices pull new IP information almost immediately. If there's a mistake on vLANing, the correct IP will be pulled in only a few minutes once fixed. When the project is complete, set the lease times back to normal values.
5) It's trivial to replace a device because there will never be an IP conflict. Modify the IP reservation when it's time for the new device to be installed, and the new device will take over the IP and the old device can still be connected if necessary as it will just pull a random IP at this point (or a set IP if you want to setup another reservation).
6) The IP scope range can be used more efficiently because IPs are managed centrally on the back-end, and it's not reliant on devices being configured with the correct IP. I never have to guess what device has what IP and wonder if something was set to the wrong IP. I can look at my DHCP server to know what's what.
7) If you need to make a default gateway change (either temporary or permanent), it's trivial. This has come up before because we needed to change the destination of traffic outgoing from a location temporarily while service was being performed on the primary equipment. It's an unusual event because normal redundancy usually addresses problems like this, but I've had larger failures to deal with that required temporary installations to cover until repairs to utility infrastructure is completed. Once the repair is done, updating the default gateway again gets everything flowing properly.
I'm an adamant supporter/enthusiast for DHCP reservations. :)
Ben, you're awesome! Thanks for contributing to the discussion! Excellent advice!
Hi Steven,
If a device has a static IP address should that address be included in the DHCP Scope, and then 'dummy reserved' out, or should the static IP address be outside the DHCP Server Scope?
Say the network is not too big - can I set a scope of 192.168.1.2 to 192.168.1.99, then Fix the IP addresses of my Printers, Accesspoints etc into the 192.168.1.100 to 192.168.1.150 range, say, which won't require any reservations as the fixed IP devices wont request IP addresses anyway, or should I Fix the IP addresses inside the scope, and just give them reservations, so no other device is accidentally given the address belonging to a fixed device. The advantage I see for the second method is that the connected devices all exist within the DHCP scope, and can be documented.
Thanks for your article - just wondering about best practice - pros and cons of the two methods.
Hi Robin,
For best practice, I wouldn't recommend using Static IPs inside of the DHCP pool range. For example, you'd want to have your DHCP range from .100 to .199 and then have your servers in .10 to .19 and printers from .20 to .30, etc... It just avoids problems...
As for DHCP reservations, you can have those within or outside of your DHCP scope.
Cheers,
Stephen
This exercise asks you to create a DHCP reservation on the current scope, to ensure one of our servers will have the same IP assigned to it.
Create a reservation on your DHCP server to ensure that one of your servers (for instance SRV02) will always have the same IP assigned to it. We want to assign ip 10.1.1.200, for instance
Once you create the reservation print the output of the command:
Get-DhcpServerv4Reservation -ComputerName "dhcp01" -IPAddress 10.1.1.200 | fl *, (the IP is merely for illustration purposes)
kindly answer me asap.
Hi, is there a way to reserve a range of IP addresses for specific manufacturers? I have 15 Hickvision security cameras, currently configured for static IP. I would like to reserve a DHCP IP range on X.X.X.180-199. So I know the cameras will always be in this scope, by the same token I could have all my Apple devices in X.X.X.150-170 ... etc.
Thanks
MS best practice is to use Dual DHCP servers with either fail over or load balance and use DHCP reservations vs setting static IPs now for servers. The only thing you set static is core networking / hypervisors / routers
THANK YOU! It's sadly "acceptable" to interchange these terms. I have to just cringe and let it go, I've even seen a router with a "Static DHCP" settings. wtf- static - dynamic, that's really sad.
Could you explain what "hard wired" explicitly means?!? An RJ45 port - removable jack is not hard wired! A removable is not a hard wired connection... yet so many "tutorials" interchange these as well
I believe people just use the term "hard wired" in reference to a hardware wired network connection, versus something like wireless.
One subtle disagreement: You said "The device MUST RELY on a DHCP Server once set to use DHCP. If the DHCP Server is down, so is the device." Not quite true, as many devices can utilize a self-assignment method for addresses when no static address is configured and the device is set for DHCP service. Windows calls this Automatic Private IP Addressing (APIPA). OS X also does the same thing (not sure what it's called there).
APIPA addresses will be self-generated in the private IP range 169.254.0.0 to 169.254.255.255, with a subnet mask of 255.255.0.0
To the uninitiated, this can be very confusing and pointless. But it's actually pretty cool because it allows the creation of ad-hoc networks: Just plug two (or more) computers into each other, and they will have a functioning network between them. Think file sharing here for example.
The other thing is a machine with a self-assigned address can easily be found on your LAN by using IPCONFIG, a scanner, or looking at ARP tables.
Self-assigned addresses are also noteworthy in that if your computer has one, it means it cannot find a viable DHCP server on your network,
Hey Joseph,
Thanks for the post with all the information!
Cheers,
Stephen