Two DHCP in one physical network
-
Hello.
1 DHCP Server 10.0.0.0
Deny unknown clients
Static ARP2 DHCP Server 192.168.1.0
Allow unknown clients3 One physical network
How use IPFW completely block a request from an unknown MAC address?
The answer DHCPNYK from first server interfere obtain an address for the user DHCP 2
PS: yes, i know, use two dhcp server in one network this bad idea, but…
Thank you.
-
What exactly are you trying to accomplish here? So your going to run multiple layer 3 on the same layer 2? Borked!!!
-
IPFW operates with the 2 layer, is not it so?
-
PS: yes, i know, use two dhcp server in one network this bad idea, but…
Actually, it's not. It's often done on large networks for redundancy. You just have to ensure they don't try to hand out the same address. There are some automatic mechanisms to prevent this, but the easiest method is to spit the address block among the servers so that they don't overlap. However, you do configure them to hand out the same info for default route, DNS, NTP etc.
-
They hand out addresses from different subnet, the problems only when it 1 server DHCPNAK response, client linux system does not receive an address from the second server.
-
Dude running multiple layer 3 networks on the same layer 2 (wire) is BORKED!!
Your 10 network should be on a vlan, while our 192 network is on another vlan - you then run dhcp server for each vlan and you don't have to worry about an authoritative dhcp server saying hey that is not my network NAK!!
Your configuration is BORKED! Fix it and you problem goes away then you can run as many different networks and dhcp servers as you want. I have dhcp servers running for all of my networks. But they are isolated with vlans. Not running all on the same wire without isolation/tagging. So dhcp server 1 never see's packets for network 2. Only the dchp server running on that network/vlan sees that traffic.
Do you not have smart/managed switch environment so you can run vlans?
Yes you can run multiple dhcp servers on the same network - but they would be working together to provide the same network space to clients, just in a failover mode, etc.
-
vlan great idea, be work if clients work with a common network switch?
-
huh?? be work if clients what?
Its not a idea dude - its how its done. Running multiple layer 3 networks on the same layer 2 is just borked plain and simple..
-
In general, the only way to make it work, divide the network into 2 parts
-
That is how it should done yes, you DO NOT RUN multiple layer 3 networks on the same layer 2 wire.. It is not meant to work like that.. That is the whole point of vlans.. So you don't have to actually have different network wired to have a different layer 2 network.
You use vlans so you can have different layer 2 networks run on the same wire, and have 1 switch that acts like multiple layer 2 switches in 1 box, etc.
What exactly are you wanting to accomplish? Do you just want specific rules for a subset of your machines? Why can the machines not just be on 1 network, ie 10.x or 192.168.x or 172.16-31.x ? Why do you think you need 2 layer 3 networks on the same wire?
-
IP addresses from the network 10.0.0 all reserved, and 192.168.xx network used for testing software and devices. need use two servers DHCP.
-
Also, conventional switches are used in networks that are not controlled, they can not create a VLAN
-
Agreed dumb switches are used all the time, with 1 layer 2 network and 1 layer 3 network. Attempting to run multiple layer 3 networks over the same layer 2 is borked!
-
I realized, I will buy a manageable switches and configure vlan, thanks for reply
-
Also, conventional switches are used in networks that are not controlled, they can not create a VLAN
But they should be able to pass VLANs.
-
IPFW operates with the 2 layer, is not it so?
No, it works at layer 3 (IP). In fact, some here, myself included, have complained that it doesn't filter on MAC addresses, unlike some other firewalls.
They hand out addresses from different subnet, the problems only when it 1 server DHCPNAK response, client linux system does not receive an address from the second server.
The DHCP client doesn't know to try another server, if NAKed by one. All it does is broadcast the request and accept from the first server to reply.
Agreed dumb switches are used all the time, with 1 layer 2 network and 1 layer 3 network. Attempting to run multiple layer 3 networks over the same layer 2 is borked!
Actually, it works OK with IPv4 and is to be expected with IPv6. Just don't expect DHCP to sort things out, unless the server is configured to do so, matching MAC addresses to IP addresses.. Also, you can easily use static configuration for those IPv4 devices that you want to use another address block. With IPv6, router advertisements help sort things out, with a device getting addresses on each advertised address range. For example, you could have both global and unique local addresses on the same interface.
-
Actually, ipfw can filter on MAC addresses. You might be thinking of pf.
-
^^^^
My mistake. I was thinking of pfSense, which does not have an obvious way to filter on MACs, as can be done with iptables on Linux or some versions of Cisco's IOS.
