Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Networking

DHCP Management Across a Diversified Network? 100

Posted by timothy from the send-that-packet-that-way dept.
ET Admin writes "I work for a small Wireless ISP, where we are deploying new network hardware to allow for growth and contain broadcast traffic. All routing/switching equipment is Cisco. We use Linux stand-alone boxes and VMs (running on Win 2003 boxes). We have decided on a hybrid VLAN layout where we have certain VLANs limited by location, and other VLANs that are global across the network. And I want DHCP served across it all. Does anyone have experience with IPAM software that handles multiple DHCP servers? Our network is small so spending a couple grand is overkill at this point. Any recomendations to help me decide between serving DHCP from the Nix boxes, or from the Cisco gear? Knowing that a single DHCP server will handle from 100-500 hosts."
This discussion has been archived. No new comments can be posted.

DHCP Management Across a Diversified Network? More

DHCP Management Across a Diversified Network?

Comments Filter:

  • DHCP Relaying (Score:5, Informative)

    by Anonymous Coward on Wednesday June 17, 2009 @05:49PM (#28366801)

    setup DHCP Relaying on the switches to forward/relay all dhcp request across the vlans and subnets to one (or two) dhcp servers

    • Re:DHCP Relaying (Score:4, Informative)

      by TaliesinWI ( 454205 ) on Wednesday June 17, 2009 @05:55PM (#28366869) Journal

      Done in one. You can even train ISC DHCP to give out different pools based on the primary IP address of the gateway for a particular VLAN. At that point all you have to worry about are keeping the pools "fed".

    • Re:DHCP Relaying (Score:5, Informative)

      by Anonymous Coward on Wednesday June 17, 2009 @05:56PM (#28366893)

      DHCP Relay Agent in Cisco Routers

      Cisco Routers support DHCP Relay Agents with ip helper-address command. To enable the ip helper-address on an interface that will receive client BOOTP/DHCP broadcasts.

      From the Global configuration mode,

      Router(config)# interface fa 0/0

      Router(config-if)# ip helper-addres 10.10.10.1

      Router(config-if)# ip helper-addres 10.10.10.2

      • Re: (Score:2, Interesting)

        by ET Admin ( 1579083 )
        I am definitely leaning this way. I currently have 2 hosts on the new network, and I just set them up as DHCP pools on the cisco gear to get them up and running, which got me looking at the capabilities of the Cisco gear. DHCP databases served via TFTP to all the field routers (3550's serving DHCP) was the other option I was looking at, but using ip helper to point to a central linux box sure seems easier. One of my main goals in this design is to limit broadcasts outside of each subnet, and ip helper ob

        • Re:DHCP Relaying (Score:4, Informative)

          by Curien ( 267780 ) on Wednesday June 17, 2009 @11:54PM (#28369409)

          One of my main goals in this design is to limit broadcasts outside of each subnet, and ip helper obviously punches a hole in that philosophy.

          ip helper doesn't forward as broadcasts. When the router on the host's segment detects the broadcast DHCP request, it forwards it directly to the next hop (just like any router does with a non-broadcast packet).

      • Re: (Score:1)

        by Moxon ( 139555 )

        We're using ip helper forwarding to two ISC dhcp3 servers (on linux) with a load balance / failover setup. Works just dandy for a few thousand users and 200+ subnets.

        Separate pools and subnets per vlan and all that stuff, of course. I'm sure there are howtos on the web..

    • Re: (Score:2)

      by oatworm ( 969674 )
      That's what I'm thinking, too. Also, make sure conflict detection is turned on. Serving DHCP isn't particularly processor-intensive, so I doubt it'll matter much if you're hosting it from your *NIX boxes or from your Cisco equipment.

    • Re: (Score:3, Informative)

      by Curien ( 267780 )

      This is definitely the way to go. If for some reason you cannot do this (as was once the case for me*), you can set up a PC on the network segment to act as a DHCP relay (the ISC DHCP distribution comes with a relay agent). On a network where we had more control, we set up a tunnel between the routers to forward the DHCP packets.

      * The network involved military encryption devices which could not be configured to forward broadcast packets. I put together a Linux system that booted from a floppy, used arping t

  • I have the solution you need... (Score:4, Informative)

    by poptix_work ( 79063 ) on Wednesday June 17, 2009 @05:52PM (#28366843) Homepage

    http://lmgtfy.com/?q=cisco+dhcp+relay&l=1 [lmgtfy.com]

    You can easily run hundreds of thousands of hosts off a single DHCP server. It is not cpu intensive particularly if you have a decent lease duration.

    • Re: (Score:3, Interesting)

      by rmadmin ( 532701 )
      I concur.. I have over 2000 hosts covered with my DHCP server, 24 hour lease, the server never breaks 0.00 loads. We also use DHCP-Relay in about 5 places across the network. Its tasty :)

      • Re: (Score:2)

        by Sabalon ( 1684 )

        We have about 1400 regular hosts and a large migrant (student notebook) population. ie. more hosts than IPs so we have a much shorty lease time (30 minutes I think) and dhcp relay. The machine is bored to tears. Not sure of the 100-500 hosts line in the post.

      • I'll do better than that. ~10 years ago I visited the racks of a major cable internet provider in the Netherlands. There stood a lonely old Pentium 3 tower, in fading brown/beige colors, between the fancy rackmounted Cisco equipment, providing DHCP for a ~750,000 resident area in which that provider was basically the monopoly for cable internet.

        True story.

        • That probably worked just fine, too.

          Constrast that to the horror story I found at an ISP. I was the manager of the technical staff (servers and network) at a medium-sized ISP that went through a rash of acquisitions before being acquired itself. One ISP we bought had a Pentium 133 in an AT desktop case with 256 megabytes of RAM. It ran NT 4, and it did pretty much everything but offer the network ports. It was serving primary and secondary RADIUS for auth and logging. It did primary and secondary DNS, both

    • Re:I have the solution you need... (Score:5, Informative)

      by poptix_work ( 79063 ) on Wednesday June 17, 2009 @05:58PM (#28366925) Homepage

      Also, here's a small sample config for serving a particular pool on a particular interface (which would be the vlan "interface" on the Cisco), easily found on Google:

      class "vlan1234"
      {
                      match if
                      (
                                      (binary-to-ascii(16, 8, ".", option agent.remote-id) = "0.15.63.ab.52.16") # This is the MAC of the switch
                                      and
                                      (binary-to-ascii (10,8, ".", option agent.circuit-id) = "0.0.0.47") # This is the interface number
                      );
      }

      pool {
                      range 192.168.100.5 192.168.100.254;
                      max-lease-time 300;

                      option subnet-mask 255.255.255.0;
                      option routers 192.168.100.1;
                      allow members of "vlan1234";
      }

    • Re: (Score:3, Insightful)

      by calmofthestorm ( 1344385 )

      It's interesting because lmgtfy is as much about knowing waht to google as to google it. Oftne if I ask a dumb quesiton, all I need are google keywords.

    • Re: (Score:2)

      by Helmholtz ( 2715 )

      Even better, run it from a [open]solaris zone.

  • phpdhcpadmin (Score:3, Informative)

    by Anonymous Coward on Wednesday June 17, 2009 @05:54PM (#28366855)

    Someone in house here created it, and we use it across multiple vlans from a Gentoo box. It uses the ISC DHCPD server.

    http://phpdhcpadmin.sourceforge.net

    • Thanks for the tip. We currently use the ISC DHCPd on a Centos VM and this will allow me to start with our current conf files.

  • DHCP not used in IPV6 protocol

  • Use the Unix/Linux boxes.... (Score:5, Interesting)

    by Fallen Kell ( 165468 ) on Wednesday June 17, 2009 @05:57PM (#28366915)
    Seriously, do not use the Cisco gear to handle the DHCP. There are several ways to handle this, either have a system with an interface on all the networks, or setup your Cisco gear to forward the HDCP requests to the one subnet that does have your system.

    With using Unix/Linux you can setup failover servers so that if one does not respond, the other will take over the requests and that way you will not lose DHCP across your entire network due to hardware/software issues on a single system. Go read up on dhcpd, it is not too difficult to understand, and is really probably your best low cost solution.

    • Agreed. ISC dhcpd is so trivial to setup, and places hardly any load on the system at all, that I don't use why you wouldn't use it in that case. I've personally ran dhcpd servers serving 1,000 nodes or more without a lick of trouble running on old PCs that were just lying around. We had a couple of failover servers on each VLAN and ultimately we never had any DHCP downtime, ever. Well, actually we did once, but that's because the POS Cisco switch the DHCP servers were plugged into totally failed for re

    • Fixed your title for you.

  • You need Cisco gear (Score:3, Interesting)

    by Anonymous Coward on Wednesday June 17, 2009 @06:06PM (#28367021)

    You need to use DHCP snooping to block rogue DHCP servers and block packets with forged MAC addresses on untrusted interfaces

    You need IP source guard to block forced IP addresses on untrusted interfaces

    Otherwise, you are at risk of DOS and/or compromise from malicious users, and at risk of instability and insanity caused by users who plug a rogue DHCP server (even something as simple as the LAN side of a Linksys gateway) into your gear.

    • Re: (Score:1, Interesting)

      by Anonymous Coward

      You can do this with Procurve too... and Enterasys.

      Don't be a crony ;)

    • HP Procurve equipment supports both DHCP helper addresses and DHCP snooping. So yes, you need to do it properly, but you can do it properly (and with a free lifetime warranty) without Cisco.

      • Why the hell should he buy new equipment? He's already got Cisco, and Cisco does it.

        Man, do you normally buy new gear that does exactly what your current gear does, just because the new gear has a cheaper price tag on it? What a complete waste of money.

        You sound like a project manager for my company, only they usually go from less expensive perfectly capable current equipment to more expensive less capable new equipment.
        PM: "We need "
        Engineer: "Why?"
        PM: "Because, it does X, Y, and Z, and we need that!"
        E: "

        • Damn my lack of previewing!!

          The missing information is, from top to bottom:
          "new expensive product A"
          and
          "older currently installed less expensive but more functional product B"

          Kudos if you find where the second goes, it might not be blatantly obvious at first. ;)

    • Re: (Score:3, Insightful)

      by mysidia ( 191772 )

      That's not an absolute. You should use VLAN segmentation (and possibly private VLANs) to separate untrusted networks.

      That way if there is a rogue DHCP server, its effects are isolated to the untrusted LAN it came from.

      The L2 filtering features you are thinking of are actually inadequate to stop a sophisticated attacker, because those features can be defeated, or don't address all possible Layer 2 spoofing and traffic hijacking tricks.

    • Thanks for the tip. We require our customers to have their own routers, and so far our wireless devices have protected us from this. But I did learn the hard way that VMWare Server enables DHCP by default when initially installed.

  • DNSMasq (Score:4, Informative)

    by TheRealMindChild ( 743925 ) on Wednesday June 17, 2009 @06:16PM (#28367145) Homepage Journal
    DNSMasq [thekelleys.org.uk]. Nuff said.

  • Nice answer Slashdotters. (Score:5, Insightful)

    by bluephone ( 200451 ) <greyNO@SPAMburntelectrons.org> on Wednesday June 17, 2009 @06:19PM (#28367171) Homepage Journal
    To everyone who tagged this "domyjobforme", I hope every single one of you gets the same response the next time you ask for help doing you job. At least this guy had the sense to say, "Hey, there's a community of people that contains a multitude of experts in many fields, I bet someone might have some good suggestions." And guess what else? Maybe some readers will find the suggestions helpful too. Ask Slashdot is for questions that the general community might find interesting and helpful, not just one guy. It's not just about the submitter, and it's certainly not about your need to be snide to those who recognize their shortcomings and try to expand their base of knowledge.
    • I've got no problem with the guy trying to get up to speed. I have respect for someone who admits a shortcoming and works at fixing it. Slashdot is hardly a great place to do it though. He should go to his boss and admit that he's in over his head and needs to either get some training/credentials or get a decent consult with an expert. The money or resources spent on the education or quality advice wil pay off down the road when they avoid a major security incident.
      • We do have a paid consultant working with me on this. He is doing his job, of teaching me, very well. When I asked him this question, his response was, "personal preference". And so it is that preference that I am searching for.
  • Don't use your cisco gear to manage dhcp. It's better utilized doing it's primary function of routing and switching. Set up a Linux box to do dhcp. Setup multiple subnets and use the "ip helper-address" command on the interfaces of your Cisco router's to forward the dhcp requests to your Linux dhcp server. It's simple to do. Once upon a time I setup a 5000k node network doing that very same thing.

  • I don't know enough about your environment but hopefully you know that that isn't a possibility across Layer 3 devices (and when I say VLAN's, I assume that you are talking about an IP segment and not just a VLAN number). That said the "ip dhcp helper" or DHCP relay I think is what you are looking for. This way you can have 1 DHCP server serving numerous VLAN's or L3 IP segments. If you have more specific questions feel free to reach out to me.

    Carl Fugate
    carl@iprouteradmin.com
    BLOG: www.iprouteradmin.com
    R

    • Our 3550s are conf'd to "ip route" and most of our nat'ed, private ip, customers will be on these layer 3 Vlans which are seperated by location (per tower). But we offer a public IP for customers, who can be anywhere on our network, and their traffic will be on a separate layer 2 Vlan that is configured globally through our network. The key to this, is that we are injecting the 802.11q tag at each customers wireless subscriber module, and that tag defines which vlan they are on.

      • Re: (Score:3, Funny)

        by fluffy99 ( 870997 )

        I get the strong impression you might be in way over your head with less than 3 years experience. You're asking about implement technologies which you don't fully understand yet. The risk here is that you might get a solution that works, but it will be horribly insecure.

        VLANS are layer 2. Subnetting is at the layer three level and normally coincidence with the layer 2 vlans you create (but not always). While you can have vlans spread across large regions, you defeat most of the benefits of using a vl

        • We have a paid consultant guiding me through this (20 yrs exp). Just on this point his response was "personal preference". He is running similar set ups in much larger environments such as our local hospital where he has hundreds of vlans setup.
    • A VLAN is a layer 2 technology and can span across multiple switches. In Cisco IOS you can create a layer 3 interface to a VLAN.

  • Using one or two of your Win2003 boxes, create multiple DHCP scopes for your multiple networks/subnets. Then just use the "ip helper-address" on your cisco gear to allow the DHCP requests to make it to your servers. Done. I do this at my company with 50+ VLANs.

    Cost = $0.

  • Cisco make (or at least did make some time ago) a DHCP server (Cisco Network Registrar) based on Windows that does handle option 82. So you do not have to run DHCP on IOS, you can relay back to a central server. I have even been able to "script" CNR by sending command line commands to administer scopes (yes, thank god it has a command line). But in all honesty, it's far easier to automate the configuration of a standard linux or *BSD dhcpd.

  • I have to ask, who will be monitoring and supporting this architecture?

    • Me! I have only been in this line of work for three years, and I have been sitting at the helm of someone else's network design for that period. Hence my thirst for knowledge.

      • I meant 24/7 type monitoring ... ie: some system bites the dust, etc.

        • We have spare pieces in house. I have all configs backed up. I can paste a config and plug it in easily. Our servers also offer some redundancy. We have 2-2003 server boxes running the VMs. The 2003 boxes are (going to be) fully isolated with only the VMs exposed, and providing the network services. We monitor everything with Cacti (SNMP) and a local college student is developing some nice plugins to map all of our hosts by gps coords (look at the Cacti forums if this interests you).

  • Carnegie Mellon's NetReg (Score:3, Informative)

    by vitroth ( 554381 ) <vitroth@cmu.edu> on Wednesday June 17, 2009 @10:55PM (#28369091)
    Carnegie Mellon's NetReg [cmu.edu] is an open source system that provides a pretty complete IP Address Management toolset, including management of DNS & DHCP configurations for ISC bind/dhcpd. It can manage ISC dhcpd's failover configuration, and multiple server groups, etc.

    Rather then just repeating what I've said before when the subject of IP Address Management came up on slashdot, I'll just link to it [slashdot.org].

    Note: While the project has been pretty quiet for quite some time now, thats mostly because its the system is very stable and there hasn't been a lot of major new development in the last couple of years. I used to be one of the core developers of the system before I moved on to another job, but its still in active use by many sites.

  • I would have a look at http://www.weird-solutions.com/ [weird-solutions.com]

    They produce some cutting edge DHCP and provisioning software for amongst others the ISP market. Furthermore their staff are incredibly knowledgeable.

  • I'll throw out my solution.

    As many people here have suggested, ISC DHCP server has no trouble with this and can handle many subnets and pool combinations from one or more servers. Then with the combination of ip helper-address on Cisco platforms you can control which server(s) handle the network. Throw DHCP-Failover into the mix and make it redundant.

    To manage all this I'd suggest OpenNetAdmin [opennetadmin.com]. It is geared to manage as any IPAM would, your address space. It can also be instructed to manage mult

Slashdot Top Deals

Neutrinos have bad breadth.

Close