DHCP: Enterprise Architecture

April 15, 2026·3 min read·585 words

DHCP (Dynamic Host Configuration Protocol) automatically distributes IP settings (address, DNS, gateway, NTP) to endpoints. It supports centralized or distributed architectures, HA through failover or split-scope, and requires careful management of reservation and conflict-detection issues. 2026 enterprise DHCP architecture guide.

DHCP Architecture

DHCP Relay (Recommended)

The L3 router/switch forwards DHCP requests to a central DHCP server
1-2 DHCP servers for the entire campus
Configuration: ip helper-address 10.0.0.10 (on the SVI)
Benefits: centralized infrastructure, simple management, and centralized logs

Local DHCP (Switch)

The L3 switch acts as the DHCP server for its VLANs
Avoids latency when the WAN is down
Difficult to maintain across multiple sites

DHCP HA

DHCPv4 Failover (RFC 2131bis)

Windows Server 2012+: native DHCP failover
Kea DHCP (ISC open source): active-active failover
Active-passive: server B takes over if server A goes down
Active-active: load balancing (50/50 split-scope)

Split-Scope (Simple)

2 servers, each managing 50% of the scope
Server A: 10.0.10.1-100
Server B: 10.0.10.101-200
If one server fails, the other continues serving its addresses
No failover between servers, but redundancy for clients

Important DHCP Options

Option 1: subnet mask
Option 3: default gateway
Option 6: DNS servers
Option 15: domain name
Option 42: NTP servers
Option 43: vendor-specific (e.g., Aruba AP and FortiAP configuration)
Option 60: vendor class identifier
Option 66: TFTP server (IP phone configuration)
Option 67: bootfile
Option 82: relay agent information (DHCP snooping)
Option 150: TFTP servers (Cisco phones)

DHCP Snooping (Security)

The switch verifies that DHCP responses come from 'trusted' ports
Trusted ports: uplinks to the DHCP server
Untrusted ports: access ports (endpoints)
Blocks rogue DHCP servers
Cisco: ip dhcp snooping ; ip dhcp snooping vlan 10-20 ; interface Gi1/0/48 ; ip dhcp snooping trust

DAI (Dynamic ARP Inspection)

Prevents ARP spoofing by validating ARP replies against the DHCP Snooping binding table:

ip arp inspection vlan 10-20
ip arp inspection trust (on trusted ports)
Drops the ARP reply if it is not in the binding table

IP Source Guard

Validates that the source IP address of a packet matches the DHCP-assigned address for the port:

interface Gi1/0/10 ; ip verify source
Blocks local IP spoofing

Scopes and Address Ranges

One scope per VLAN/subnet
Exclusions: static IP addresses (gateway, servers, printers)
Reservations: MAC → fixed IP address (printers, cameras)
Lease time: 24-72h for data networks, 2h for guest WiFi
Sizing guideline: 10 users = /24 scope, 100 users = /23

DHCPv6

Stateful: equivalent to DHCPv4, assigns IPv6 addresses
Stateless: provides options only (DNS, NTP) — address assigned through SLAAC
Prefix delegation: ISP → CPE delegates a /48 or /56
Helper: ipv6 dhcp relay destination 2001:db8::10

Popular DHCP Servers

Microsoft Windows Server DHCP: integrated with AD, free, used by 90% of SMBs
ISC Kea (open source): feature-rich successor to the long-established DHCPd
Infoblox DDI: commercial unified DNS+DHCP+IPAM solution (enterprise market leader)
SolarWinds IPAM: commercial, Windows-based
Cisco DNA Center: integrated solution for SD-Access
phpIPAM: open-source IPAM solution (not a direct DHCP server)

DHCP + NAC Integration

ISE/ClearPass/FortiNAC: VLAN assignment based on identity
DHCP-triggered workflow: client requests an IP address → NAC identifies the client → assigns the VLAN → DHCP provides an IP address from the correct scope
Requires coordination among DHCP, RADIUS, and the switch

Troubleshooting

show ip dhcp binding: active leases
show ip dhcp conflict: detected conflicts
debug ip dhcp server packet (use caution in Cisco production environments)
Wireshark capture on UDP 67/68
On Windows: netsh dhcp show serverdashboard

Order from OPTINOC

Enterprise DHCP architecture: HA, snooping, DAI, and IP Source Guard. NAC integration (ISE/ClearPass/FortiNAC). DHCPv6 migration. Quote within 48 hours.