Link to home
Start Free TrialLog in
Avatar of IT Guy
IT Guy

asked on

Moving DHCP off of Firewall over to DHCP Server

Hey Folks, were trying to move DHCP off of our Firewall right now over to our Server that is running DHCP. I take it that as long as we have identical scopes including the reserverations and changing lease times for our machines to get new DHCP leases, we shouldn't see any issues arise. Is there anything else to take into consideration before proceeding?
Avatar of Kyle
Kyle
Flag of United States of America image

I would set the lease time on the firewall to something low like 8 or 4 hours to ensure the TTL will expire and minimize the issues arising from clients that still have leases. This assumes the DHCP lease from the firewall is set to X number of Days.

If you have set the proper reservations and scopes you should be good to go.
Avatar of noci
noci

Be sure only one DHCP server is active also after reboots of the DHCP server & Firewall.
Avatar of IT Guy

ASKER

would the device needs to forget the network and re-connect  - some of the devices are wifi and we are trying to make it as seemless as possible to the user.
When a lease expires a new DHCP request will start. with a broadcast, waiting for the first response etc.
THe problem May be you won't get the same address as before because the server either doesn't honour your request for it anyway, or because the address has been taken by antoher system.
Then a new address will be issued, causing existing connections to fail.

Some will be reconnected due to their nature (HTTP f.e.) other will not (SSH, etc.) so the seemlessness might differ between uses.
Avatar of IT Guy

ASKER

The Helper-address is relevant or irrelevant here? If i am moving the Scope off the firewall onto the ONLY single DHCP server, am i configuring the Helper-address to our DNS servers or not at all because, i'm condensing the scopes onto 1 DHCP server? Leases, i understand that part because the computers will drop their leases given out by the firewall and switch to the DHCP server. Is there any other things i have to look out for or snags that might occur switching over?
If you have multiple vlans (subnets )and your firewall was the gateway for those vlans (subnets), being that your server is possibly on a separate subnet than the pc's, you will need helper addresses on the firewall gateway interfaces to forward dhcp requests to the dhcp server.
When a lease expires a new DHCP request will start. with a broadcast, waiting for the first response etc.

Just to clarify the process, a DHCP client will start attempting to renew its lease when 50% of the lease duration has expired. It does this by sending unicast datagrams to the DHCP server it leased from. If there's no response from that server, the client will keep trying to contact it until 87.5% of the lease duration has expired. At that point, it will begin broadcasting its renewal requests, and any DHCP server can respond.

While the whole renewal/rebinding process is happening, the client continues to use the address it originally leased. It doesn't stop using that address unless 100% of the lease duration expires without a DHCP server responding, so there's little to no chance of your clients experiencing a disconnect during this transition from one DHCP server to another.

The helper address is for a DHCP relay, which can relay DHCP requests and responses from one network to another. If everything in your environment is on one network/VLAN, you don't need it.
Avatar of IT Guy

ASKER

Since we have multiple VLANs, are we configuring the IP-helper address on the interface of the firewall that connects to our Next Hop Switch?
Those helpers (relays) need to point to the new server as well.  (they will point to the old one now), and should point to the new one.
IF your firewall can act as a DHCP-relay as well, then you can forward from there to the new one during transition so all stuff keeps on working for now.
@ IT GUY

Did your firewall originally route for the vlans? Did it serve as the default gateway for each vlan or do you have a L3 switch in place that is performing this responsibility. If you have a layer 3 switch. Then the VLAN SVI's is where you would configure your helper address for every vlan interface other than the one where the DHCP server(s) resides.  If you were using the firewall to route the vlan traffic, meaning you either configured subinterfaces on the firewall per vlan, or a separate physical interface per subnet, you will need to configure the dhcp relay on the firewall.
This question needs an answer!
Become an EE member today
7 DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform.
View membership options
or
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.