16

Our topology is such that we have two 4510's in our IDF closets. Each switch has a data VLAN and a voice VLAN. The switches are layer 2 trunked to the core, where the VLAN interfaces are, routing happens, and DHCP is forwarded to the DHCP server.

What is the best practice to provide DHCP service redundancy? If there are two dhcp servers, and two "ip-helper" addresses, will the network only forward dhcp requests to the first IP as long as it's reachable from a network perspective? If it goes down, then dhcp goes to the second address?

What if the first server's dhcp service is having a problem - but the server is still reachable via the network (you can ping it, but dhcp service is down)? Or what if the DHCP scope is full? Will the second ip-helper address help? Will the second address only come into play if the first server is hard down?

Is there any way to get the ip-helper to "round-robin" between the two?

PS. Unfortunately, this is a Microsoft only DHCP Server option. I was asked about ideas and I mentioned Infoblox, but that's in the future .... maybe.

Thanks.

Improve this question
2

4 Answers 4

Reset to default
10

The router will forward all DHCP requests to all servers configured with ip helper. The first server to respond with a usable address wins. I'm unaware of a way to round-robin from the router.

Improve this answer
2
  • 3
    To clarify, the responses from both servers are forwarded back to the client and the client makes the choice of which to accept.
    – YLearn
    Aug 14, 2013 at 13:58
  • "The first server to respond with a usable address [usually] wins."
    – generalnetworkerror
    Aug 15, 2013 at 6:17
7

All broadcast traffic (DHCPDISCOVERs and DHCPREQUESTs) will be forwarded to all ip-helper addresses. The order in which the ip-helper statements are configured makes no difference. The device will take an address from the first server it receives a DHCPOFFER from.

The only way to get around a scope being full is to configure a secondary subnet on the interface. In Cisco IOS, the config looks like this:

interface f0/1
ip address 192.168.1.1 255.255.255.0
ip address 192.168.2.1 255.255.255.0 secondary
Improve this answer
4
  • 1
    This isn't the only way to address a full scope, just one of the most expedient. For example, you could adjust the size of the subnet (change the /24 to a /23) or clean up your DHCP config (add unused "reserved" address back into the pool, etc).
    – YLearn
    Aug 14, 2013 at 14:04
  • 1
    True, but those aren't always options. Perhaps I should change my wording to the only consistent way to get around a scope being full.
    – Eric Rochow
    Aug 14, 2013 at 14:16
  • 1
    Just want to point out that adding a secondary subnet isn't always an option either. The danger in this solution is that it is easy to implement and is often the result of a reactionary approach and thought is not given to proper design. In my experience I have generally found that if someone uses this solution regularly the networks tend to be "messy" (too many entries in routing tables, poor IP usage planning, etc). Rather than consistent, I would fall back on the word I chose, which is expedient.
    – YLearn
    Aug 14, 2013 at 17:37
  • I have used the secondary address just long enough to get the fixed IP address printers faxes ad such readdressed, then we get rid of it
    – fredpbaker
    Aug 15, 2013 at 0:17
2

All ip helper-address lines configured in your VLAN take the DHCP broadcast from the client, add the router's (gateway) address into the UDP packet, then unicasts to the DHCP servers. [I'm sure the packet rewrite is only done once, then a copy sent to each DHCP server.] All the listed servers configured receive the DHCPDiscover packet by the router relay.

The redundancy of your DHCP servers not only depends on your OS, but the specific version! For Windows that was mentioned, your options range from a true split-scope in Windows 2008 R2 to active-failover redundancy in Windows 2012. For not-so-robust DHCP servers (i.e., Windows 2003), you can manually configure a split-scope. Common recommendation is the 80/20 rule with 80% of the leases configured on what you (and you alone) consider your primary DHCP server and 20% and the secondary. Exclusions get added to each DHCP server as they have overlapping scopes.

As I'm not a fan of overlapping scopes in Windows 2003 as the exclusions tend to get hidden from view, I prefer to simply split the subnet in half for each DHCP server. A /24 block for client leases becomes two /25 blocks. They key is the subnet mask in the scope is still a /24. Your start and end IP addresses in the range configured in the scope follows the /25. Now I do recommend some exclusions for network devices like VLAN interface IP addr's and HSRP as well as some for static devices (e.g. printers) in the same subnet. So I exclude the first 16 (0-15) addresses -- zero address wouldn't be used, of course, anyway -- and exclude the top 16 (240-255) -- 255 broadcast, of course. You can actually get away with not configuring the exclusion by simply starting and ending the IP address appropriately.

The basic scope information in a manually configured 50/50 split-scope (2x/25=/24) is similar to:

DHCP Primary
  Scope-lower: 192.0.2.0/24, start 192.0.2.16, end 192.0.2.127, no exclusions
DHCP Secondary
  Scope-upper: 192.0.2.0/24, start 192.0.2.128, end 192.0.2.239, no exclusions

Configure identical scopes (2x/24) with appropriate exclusions if you prefer this method:

DHCP Primary
  Scope-full: 192.0.2.0/24, start 192.0.2.16, end 192.0.2.239, exclusions 1-15, 128-254
DHCP Secondary
  Scope-full: 192.0.2.0/24, start 192.0.2.16, end 192.0.2.239, exclusions 1-127, 240-254

As there is an every so slight delay with the duplicate DHCPDiscover packets unicast to each ip helper-address, all else being equal, the first DHCP server listed will usually be the first to respond with a DHCPOffer, and the address chosen by the client when it makes its DHCPRequest -- no guarantee though. So place your primary DHCP server first in your SVI for the VLAN. A client typically receives multiple DHCPOffers and decides on the best which is usually the first one received. The assignment completes only after the client sends a DHCPRequest back to the server -- in case the server changed its mind about the lease or is no longer reachable or ??? -- and the server sends a DHCPACK. 

interface vlan123
  desc svi for vl123 dhcp relay example
  ip address 192.0.2.1
  ip helper-address 192.0.4.1 ! Primary DHCP server
  ip helper-address 192.0.4.2 ! Secondary DHCP server

Between your data and voice VLANs, you may want to alternate what you consider the primary DHCP server for a given VLAN. I do this to help spread the lease load out a bit.

If a DHCP server's scope is full, it won't reply with a DHCPOffer, so the offer would come from another DHCP server, assuming it's not also full. Keep in mind when troubleshooting that a Windows client will remember the IP they had leased last and attempt to get that again. Also keep in mind any reservations you do must be done on both servers and accounted in any ACLs you have such as in firewalls.

See Understanding and Troubleshooting DHCP in Catalyst Switch or Enterprise Networks for detailed explanation and sniffer traces of the DHCP relay process.

Improve this answer
0

The point of all this is that DHCP redundancy is 80% a DHCP server issue, you can do a split scope approach, windows 2012 lets you have active and standby with replication without clustering. We just have daily backups (we use 7 day leases) and then restore to another box or VM. Check what you DHCP server software provides, the helper address is really the least of your worries

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.