DHCP Question...

scottalanmiller

He is explaining to me that this company Cybera is setting up a firewall for him at his location and is curious why they would leave it that wide and open without any reserved Static IPS.

Simply not needed. He's imaging that statics do something that they do not. It's common to use statics, and nothing wrong with it. but it is generally considered "less ideal" to do so.

scottalanmiller

@Dashrender said in DHCP Question...:

He avoids static whenever possible. There are times where you should absolutely use static (hypervisors/iLo/iDrac, etc).

What would make those absolutely static? As long as you have DHCP working, they don't need to be static. When do you want or need any of them during a DHCP outage? DHCP can be fixed in minutes even when HA has failed.

There is no "absolutely need" statics outside of the gateway and DHCP server.

scottalanmiller

@WrCombs said in DHCP Question...:

.1 isn't reserved, but it's the practice that's most used .
Understood.

Reserved "in our minds" But not reserved in DHCP terms.

scottalanmiller

@IRJ said in DHCP Question...:

Yep I agree with others. Just don't use static IPs at all. If you don't have to use reservations that's even better.

Even that is getting more and more rare, for sure.

PhlipElder

@WrCombs said in DHCP Question...:

This is for a friend of mine who asked me ; And Wanted to be able to send him a link to read up on DHCP Best practices and ideas on his situation.

He came to me and said "if you set up a dhcp why do you set up .2-.254 with a gate way of .1
don't you want to keep some open for Static IPs... for example: printers?"

what can I say to him other than ~~.1 is reserved for gateway?~~ .1 is the gateway so it can't be used in the scenario.

He is explaining to me that this company Cybera is setting up a firewall for him at his location and is curious why they would leave it that wide and open without any reserved Static IPS.

I'm sending him the link to this thread to have him read through the answers I get.

Our rule of thumb, and it's a "we've been doing it this way since ... so we keep doing it this way" situation, is to set up the full subnet in DHCP and then set exclusions for what we want to set aside for servers, printers, and the like. We generally set printers via reservation.

Here's a simple scope setup in PowerShell:

Add-DHCPServerInDC
Add-DHCPServerv4Scope -Name "OUR Local Scope" -StartRange 10.100.10.1 -EndRange 10.100.10.254 -SubnetMask 255.255.255.0
Add-DhcpServerv4ExclusionRange -ScopeID 10.100.10.0 -StartRange 10.100.10.1 -EndRange 10.100.10.49
Add-DhcpServerv4ExclusionRange -ScopeID 10.100.10.0 -StartRange 10.100.10.200 -EndRange 10.100.10.254
Set-DhcpServerv4OptionValue -ComputerName DC.Domain.com -DnsServer 10.100.10.254 -DnsDomain Domain.com -Router 10.100.10.1

JaredBusch

The DHCP range is always the full subnet. That is standard, even if Windows lets you do stupid shit.

Here is my home router.
Instead of visibly showing ranges to exclude, outside of windows, you typically tell it hat range to pass out. I'm passing out .31 - .254
Primary DNS is my PiHole on .4
Secondary DNS is the router on .1

Static mapping for things mostly just so I know what they are when looking at pi-hole reports. My Switch on .2, KVM server on .5, and the plex guest on .6, and printer on .7

Kelly

@JaredBusch said in DHCP Question...:

The DHCP range is always the full subnet. That is standard, even if Windows lets you do stupid shit.

Here is my home router.
Instead of visibly showing ranges to exclude, outside of windows, you typically tell it hat range to pass out. I'm passing out .31 - .254
Primary DNS is my PiHole on .4
Secondary DNS is the router on .1

Can you clarify something for me @JaredBusch. You stated that DHCP range is always the full subnet, but yours is from .31 to .254. I feel like I'm missing something.

JaredBusch

@Kelly said in DHCP Question...:

@JaredBusch said in DHCP Question...:

The DHCP range is always the full subnet. That is standard, even if Windows lets you do stupid shit.

Here is my home router.
Instead of visibly showing ranges to exclude, outside of windows, you typically tell it hat range to pass out. I'm passing out .31 - .254
Primary DNS is my PiHole on .4
Secondary DNS is the router on .1

Can you clarify something for me @JaredBusch. You stated that DHCP range is always the full subnet, but yours is from .31 to .254. I feel like I'm missing something.

DHCP always serves the entire subnet it is defined on.

If you tell it the scope is a /24, it serves .1-.254 always.
You then subsequently define which part of the scope you want it to hand addresses out on.

In windows that is done by "excluding" things.
On most other platforms, it is done by telling it what range to supply to clients that ask for an address. Hence the .31 through .254

But regardless of what you specify, either as a range to use or range to exclude, DHCP still serves the entire scope.

This is why you can make reservations outside of the listed range as in my .7 printer and .10 phone.

JaredBusch

Here is a shot from Windows Server 2012 R2.

I have had to explain many times over the years that just because you "exlcude" a range, it does not mean you cannot put a DHCP reservation in that excluded range. Because DHCP is still and always serving the entire subnet defined in the scope.

PhlipElder

@JaredBusch said in DHCP Question...:

@Kelly said in DHCP Question...:

@JaredBusch said in DHCP Question...:

The DHCP range is always the full subnet. That is standard, even if Windows lets you do stupid shit.

Here is my home router.
Instead of visibly showing ranges to exclude, outside of windows, you typically tell it hat range to pass out. I'm passing out .31 - .254
Primary DNS is my PiHole on .4
Secondary DNS is the router on .1

Can you clarify something for me @JaredBusch. You stated that DHCP range is always the full subnet, but yours is from .31 to .254. I feel like I'm missing something.

DHCP always serves the entire subnet it is defined on.

If you tell it the scope is a /24, it serves .1-.254 always.
You then subsequently define which part of the scope you want it to hand addresses out on.

In windows that is done by "excluding" things.
On most other platforms, it is done by telling it what range to supply to clients that ask for an address. Hence the .31 through .254

But regardless of what you specify, either as a range to use or range to exclude, DHCP still serves the entire scope.

This is why you can make reservations outside of the listed range as in my .7 printer and .10 phone.

When we define the DHCP Scope we can s~~et the delivery IPs~~ define it to 10.100.10.31 - 10.100.10.225 or the like. One does not need to define the scope according to the full subnet whatever that may be.

Dashrender

@JaredBusch said in DHCP Question...:

Here is a shot from Windows Server 2012 R2.

I have had to explain many times over the years that just because you "exlcude" a range, it does not mean you cannot put a DHCP reservation in that excluded range. Because DHCP is still and always serving the entire subnet defined in the scope.

OK - that makes sense since you put it that way. But Windows does allow you to specify things other than the whole subnet, i.e. the whole /24, just like your EdgeRouter does

Dashrender

@PhlipElder said in DHCP Question...:

@JaredBusch said in DHCP Question...:

@Kelly said in DHCP Question...:

@JaredBusch said in DHCP Question...:

The DHCP range is always the full subnet. That is standard, even if Windows lets you do stupid shit.

Here is my home router.
Instead of visibly showing ranges to exclude, outside of windows, you typically tell it hat range to pass out. I'm passing out .31 - .254
Primary DNS is my PiHole on .4
Secondary DNS is the router on .1

Can you clarify something for me @JaredBusch. You stated that DHCP range is always the full subnet, but yours is from .31 to .254. I feel like I'm missing something.

DHCP always serves the entire subnet it is defined on.

If you tell it the scope is a /24, it serves .1-.254 always.
You then subsequently define which part of the scope you want it to hand addresses out on.

In windows that is done by "excluding" things.
On most other platforms, it is done by telling it what range to supply to clients that ask for an address. Hence the .31 through .254

But regardless of what you specify, either as a range to use or range to exclude, DHCP still serves the entire scope.

This is why you can make reservations outside of the listed range as in my .7 printer and .10 phone.

When we define the DHCP Scope we can s~~et the delivery IPs~~ define it to 10.100.10.31 - 10.100.10.225 or the like. One does not need to define the scope according to the full subnet whatever that may be.

Right, in Windows, you have a starting point and an ending point.
I suppose he's talking about the Length indicator here. That Windows will serve that entire /24 as long as it has data in that range to provide, i.e. the scope or reservations outside of the scope.

That's cool - I didn't know that, hadn't considered it before.

PhlipElder

@Dashrender said in DHCP Question...:

@PhlipElder said in DHCP Question...:

@JaredBusch said in DHCP Question...:

@Kelly said in DHCP Question...:

@JaredBusch said in DHCP Question...:

The DHCP range is always the full subnet. That is standard, even if Windows lets you do stupid shit.

Here is my home router.
Instead of visibly showing ranges to exclude, outside of windows, you typically tell it hat range to pass out. I'm passing out .31 - .254
Primary DNS is my PiHole on .4
Secondary DNS is the router on .1

Can you clarify something for me @JaredBusch. You stated that DHCP range is always the full subnet, but yours is from .31 to .254. I feel like I'm missing something.

DHCP always serves the entire subnet it is defined on.

If you tell it the scope is a /24, it serves .1-.254 always.
You then subsequently define which part of the scope you want it to hand addresses out on.

In windows that is done by "excluding" things.
On most other platforms, it is done by telling it what range to supply to clients that ask for an address. Hence the .31 through .254

But regardless of what you specify, either as a range to use or range to exclude, DHCP still serves the entire scope.

This is why you can make reservations outside of the listed range as in my .7 printer and .10 phone.

When we define the DHCP Scope we can s~~et the delivery IPs~~ define it to 10.100.10.31 - 10.100.10.225 or the like. One does not need to define the scope according to the full subnet whatever that may be.

Right, in Windows, you have a starting point and an ending point.
I suppose he's talking about the Length indicator here. That Windows will serve that entire /24 as long as it has data in that range to provide, i.e. the scope or reservations outside of the scope.

That's cool - I didn't know that, hadn't considered it before.

Yeah, that's the ticket. Start IP and End IP settings can be whatever so long as they fall in the subnet mask below.

JasGot

@Dashrender said in DHCP Question...:

But Windows does allow you to specify things other than the whole subnet, i.e. the whole /24, just like your EdgeRouter does

You can define more than a /24, but not less.
In the following pic, you can see the subnet is /24, in the 192.168.100.0 scope.
The popout is where you define the DHCP scope to be distributed, not the scope of the subnet.

Be sure not to use "Subnet" and "DHCP Scope" interchangeably like M$ does.
MS Has you define a scope when you create a new subnet to be served by DHCP, you don't really do anything with the DHCP Scope until you start filling in the Start IP and End IP. No matter how restrictive you make the DHCP Scope (11 to 50 in this case), you will still have a subnet of 255.255.255.0. If you were to make the DHCP scope 192.168.100.1 to 192.168.101.254, you would see the Subnet automatically change to 255.255.254.0

PhlipElder

@JasGot said in DHCP Question...:

@Dashrender said in DHCP Question...:

But Windows does allow you to specify things other than the whole subnet, i.e. the whole /24, just like your EdgeRouter does

You can define more than a /24, but not less.
In the following pic, you can see the subnet is /24, in the 192.168.100.0 scope.
The popout is where you define the DHCP scope to be distributed, not the scope of the subnet.

Be sure not to use "Subnet" and "DHCP Scope" interchangeably like M$ does.
MS Has you define a scope when you create a new subnet to be served by DHCP, you don't really do anything with the DHCP Scope until you start filling in the Start IP and End IP. No matter how restrictive you make the DHCP Scope (11 to 50 in this case), you will still have a subnet of 255.255.255.0. If you were to make the DHCP scope 192.168.100.1 to 192.168.101.254, you would see the Subnet automatically change to 255.255.254.0

News to me?

Dashrender

Exactly - you can definitely declare less than /24

You can declare anything that's valid for the given CIDR range
My example shows two scopes with /26 subnet

scottalanmiller

@JasGot said in DHCP Question...:

In the following pic, you can see the subnet is /24, in the 192.168.100.0 scope.

Where does it show that?

JasGot

I guess I am going back subnet school.

scottalanmiller

@JasGot said in DHCP Question...:

I guess I am going back subnet school.

I found it, it's in the faded greyed out area under the red rectangle.