DHCP: Enterprise Architecture
·3 min read·585 words
DHCP (Dynamic Host Configuration Protocol) automatically distributes IP settings (address, DNS, gateway, NTP) to endpoints. It supports centralized or distributed architectures, HA through failover or split-scope, and requires careful management of reservation and conflict-detection issues. 2026 enterprise DHCP architecture guide.
DHCP Architecture
DHCP Relay (Recommended)
- The L3 router/switch forwards DHCP requests to a central DHCP server
- 1-2 DHCP servers for the entire campus
- Configuration: ip helper-address 10.0.0.10 (on the SVI)
- Benefits: centralized infrastructure, simple management, and centralized logs
Local DHCP (Switch)
- The L3 switch acts as the DHCP server for its VLANs
- Avoids latency when the WAN is down
- Difficult to maintain across multiple sites
DHCP HA
DHCPv4 Failover (RFC 2131bis)
- Windows Server 2012+: native DHCP failover
- Kea DHCP (ISC open source): active-active failover
- Active-passive: server B takes over if server A goes down
- Active-active: load balancing (50/50 split-scope)
Split-Scope (Simple)
- 2 servers, each managing 50% of the scope
- Server A: 10.0.10.1-100
- Server B: 10.0.10.101-200
- If one server fails, the other continues serving its addresses
- No failover between servers, but redundancy for clients
Important DHCP Options
- Option 1: subnet mask
- Option 3: default gateway
- Option 6: DNS servers
- Option 15: domain name
- Option 42: NTP servers
- Option 43: vendor-specific (e.g., Aruba AP and FortiAP configuration)
- Option 60: vendor class identifier
- Option 66: TFTP server (IP phone configuration)
- Option 67: bootfile
- Option 82: relay agent information (DHCP snooping)
- Option 150: TFTP servers (Cisco phones)
DHCP Snooping (Security)
- The switch verifies that DHCP responses come from 'trusted' ports
- Trusted ports: uplinks to the DHCP server
- Untrusted ports: access ports (endpoints)
- Blocks rogue DHCP servers
- Cisco: ip dhcp snooping ; ip dhcp snooping vlan 10-20 ; interface Gi1/0/48 ; ip dhcp snooping trust
DAI (Dynamic ARP Inspection)
Prevents ARP spoofing by validating ARP replies against the DHCP Snooping binding table:
- ip arp inspection vlan 10-20
- ip arp inspection trust (on trusted ports)
- Drops the ARP reply if it is not in the binding table
IP Source Guard
Validates that the source IP address of a packet matches the DHCP-assigned address for the port:
- interface Gi1/0/10 ; ip verify source
- Blocks local IP spoofing
Scopes and Address Ranges
- One scope per VLAN/subnet
- Exclusions: static IP addresses (gateway, servers, printers)
- Reservations: MAC → fixed IP address (printers, cameras)
- Lease time: 24-72h for data networks, 2h for guest WiFi
- Sizing guideline: 10 users = /24 scope, 100 users = /23
DHCPv6
- Stateful: equivalent to DHCPv4, assigns IPv6 addresses
- Stateless: provides options only (DNS, NTP) — address assigned through SLAAC
- Prefix delegation: ISP → CPE delegates a /48 or /56
- Helper: ipv6 dhcp relay destination 2001:db8::10
Popular DHCP Servers
- Microsoft Windows Server DHCP: integrated with AD, free, used by 90% of SMBs
- ISC Kea (open source): feature-rich successor to the long-established DHCPd
- Infoblox DDI: commercial unified DNS+DHCP+IPAM solution (enterprise market leader)
- SolarWinds IPAM: commercial, Windows-based
- Cisco DNA Center: integrated solution for SD-Access
- phpIPAM: open-source IPAM solution (not a direct DHCP server)
DHCP + NAC Integration
- ISE/ClearPass/FortiNAC: VLAN assignment based on identity
- DHCP-triggered workflow: client requests an IP address → NAC identifies the client → assigns the VLAN → DHCP provides an IP address from the correct scope
- Requires coordination among DHCP, RADIUS, and the switch
Troubleshooting
- show ip dhcp binding: active leases
- show ip dhcp conflict: detected conflicts
- debug ip dhcp server packet (use caution in Cisco production environments)
- Wireshark capture on UDP 67/68
- On Windows: netsh dhcp show serverdashboard
Order from OPTINOC
Enterprise DHCP architecture: HA, snooping, DAI, and IP Source Guard. NAC integration (ISE/ClearPass/FortiNAC). DHCPv6 migration. Quote within 48 hours.