VLAN using Microsoft DHCP server

[mikemalter]

I am new to VLANS, so please excuse the newbie question. I want to create several VLANs using Microsoft DHCP server to hand out IP's. I have created the VLANs and the additional scopes in the Microsoft DHCP server. The issue for me is the last configuration bit where the device hits the desired scope on the DHCP server.

Where do I do that? Do I have to match VLANS on our switches and map to specific ports?

Thank you.

[cmcdonald]

@mikemalter unless the MS DHCP server has an interface on each VLAN, you will need to run a DHCP relay on something that does...that something is usually whatever is doing your routing (i.e. pfSense).

https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html

[bingo600]

@mikemalter

That depends ....

Are all your "desired" VLAN's using pfSense for routing the traffic ??

If yes ... I use a similar setup, with the Linux ISC-DHCP server.

In order for the DHCP requests to reach the M$ DHCP server you have to "Relay the packets" on the "Interesting pfSense interfaces"

This solution is an "All or Nothing" solution, as pfSense DHCP Relay and pfSense DHCP Server can't both be running , at the same time.

So all DHCP scopes must be on the on the M$ server using DHCP Relay, and NONE using pfSense DHCP server.

1:
Goto - Services -> DHCP Relay

2:
Enable the service

3: Select the pfSense interfaces you want to Relay

4: I like to add Agent ID

5: Enter ip address of the server to relay to (M$ Box IP)

Done

Well you might want to open up for DHCP to the M$ Server in the firewall.
It will work wo. the opening as pfSense is relaying , but your client would prob try to "renew at halftime" using the M$ IP , and that would fail of there are no opening.
I have specifically deny'ed DHCP to my linux server (DHCP is only via the DHCP Relay function) , and have no "noticable issues".

Edit:
If using Cisco Switches , you could also use the ip-helper function , but then you'd have to enable Cisco L3 routing on each of the "interesting interfaces"
That would IMHO "defeat the use of a firewall" on those VLANS.

/Bingo

[mikemalter]

Bingo600,

Thank you very much for your detailed answer. I am going to try this and might have another question or two.

Thanks again.

Mike

[mikemalter]

Bongo600,

First, thanks again for your answer.

My question is how does the IP request know which scope to go to if I have multiple scopes?

Thanks,

Mike

[johnpoz]

@mikemalter said in VLAN using Microsoft DHCP server:

My question is how does the IP request know which scope to go to if I have multiple scopes?

The relay devices sends that info to the dhcp server.

https://www.computernetworkingnotes.com/ccna-study-guide/how-dhcp-relay-agents-work-explained.html

[mikemalter]

Johnpoz,

I have multiple LAN and VLAN interfaces and multiple DHCP scopes on my Microsoft DHCP server.

[johnpoz]

@mikemalter and?

Why would you have multiple vlans on your dhcp server? Multihoming (interfaces in multiple networks) servers is rarely a good idea.. And leads to asymmetric flow and normally a security issues because it bypasses the firewall that is done at the router, etc.

Without some details of what your actually wanting to accomplish its impossible to help you. But in answer to your question when a dhcp relay or helper as called in ciscoland sends dhcp traffic it sees it sends the source info to your dhcp server so it knows what scope to offer an IP from, etc.

[dotdash]

This shouldn't involve your firewall at all. Create the vlans on the switches, set the DHCP helper/relay on the switches to point to your DHCP server, and create the scopes on your dhcp server.