Configuring and Troubleshooting DHCP

Module Overview Overview of the DHCP Server Role Configuring DHCP Scopes Configuring DHCP Options Managing a DHCP Database Monitoring and Troubleshooting DHCP Configuring DHCP Security 2

Overview of the DHCP Server Role Benefits of Using DHCP How DHCP Allocates IP Addresses How DHCP Lease Generation Works How DHCP Lease Renewal Works DHCP Server Authorization

Benefits of Using DHCP DHCP reduces the complexity and amount of administrative work by using automatic TCP/IP configuration Manual TCP/IP Configuration Automatic TCP/IP Configuration IP addresses are entered manually IP address could be entered incorrectly Communication and network issues can result Frequent computer moves increase administrative effort IP addresses are supplied automatically Correct configuration information is ensured Client configuration is updated automatically A common source of network problems is eliminated

How DHCP Allocates IP Addresses DHCP Client2: IP configuration from DHCP server Non-DHCP Client: Static IP configuration Lease Renewal Lease Generation DHCP Server DHCP Database DHCP Client1: IP configuration from DHCP server IP Address1: Leased to DHCP Client1 IP Address2: Leased to DHCP Client2 IP Address3: Available to be leased

How DHCP Lease Generation Works DHCP client broadcasts a DHCPDISCOVER packet 1 DHCP servers broadcast a DHCPOFFER packet 2 DHCP client broadcasts a DHCPREQUEST packet 3 DHCP Server1 broadcasts a DHCPACK packet 4 DHCP Client DHCP Server1 DHCP Server2 DHCP Server2 DHCP Server1 DHCP Client DHCP client broadcasts a DHCPDISCOVER packet 1 DHCP servers broadcast a DHCPOFFER packet 2 DHCP client broadcasts a DHCPREQUEST packet 3 DHCP Server1 broadcasts a DHCPACK packet 4

How DHCP Lease Renewal Works DHCP Client DHCP Server1 DHCP Server2 DHCP client sends a DHCPREQUEST packet 1 DHCP Server1 sends a DHCPACK packet 2 50% of lease duration has expired DHCP Client DHCP Server1 DHCP Server2 100% of lease duration has expired 50% of lease duration has expired 87.5% of lease duration has expired If the client fails to renew it’s lease, after 87.5% of the lease has expired, then the DHCP lease generation process starts over again with a DHCP client broadcasting a DHCPDISCOVER If the client fails to renew its lease, after 50% of the lease duration has expired, then the DHCP lease renewal process will begin again after 87.5% of the lease duration has expired DHCP Client sends a DHCPREQUEST packet 1 DHCP Server1 sends a DHCPACK packet 2

DHCP Server Authorization DHCP authorization is the process of registering the DHCP Server service in the Active Directory domain to support DHCP clients DHCP Server1 checks with the domain controller to obtain a list of authorized DHCP servers If DHCP Server1 finds its IP address on the list, the service starts and supports DHCP clients Domain Controller Active Directory DHCP Client DHCP Server1 Authorized Services DHCP requests DHCP Server2 Unauthorized Does not service DHCP requests DHCP Server2 checks with the domain controller to obtain a list of authorized DHCP servers If DHCP Server2 does not find its IP address on the list, the service does not start and support DHCP clients DHCP client receives IP address from authorized DHCP Server1

Configuring DHCP Scopes What Are DHCP Scopes? What Are Superscopes and Multicast Scopes? What Is a DHCP Reservation? DHCP Sizing and Availability

What Are DHCP Scopes? A scope is a range of IP addresses that are available to be leased DHCP Server LAN A LAN B Scope A Scope B Scope Properties Network ID Subnet mask Scope name Exclusion range Lease duration Network IP address range

What Is a DHCP Reservation? A reservation is a specific IP address, within a scope, that is reserved permanently for lease to a specific DHCP client Workstation 1 File and Print Server Subnet A Subnet B DHCP Server Workstation 2 IP Address1: Leased to Workstation 1 IP Address2: Leased to Workstation 2 IP Address3: Reserved for File and Print Server

DHCP Sizing and Availability DHCP Clients DHCP Server1 192.168.0.1 DHCP Server2 192.168.1.1 DHCP Sizing and Availability DHCP Server1 has 80% of addresses as follows: Scope range: 192.168.0.2-192.168.0.254 Excluded addresses: 192.168.0.200-192.168.0.254 DHCP Server2 has 20% of addresses as follows: Excluded addresses: 192.168.0.2-192.168.0.199

Configuring DHCP Options What Are DHCP Options? What Are DHCP Class-Level Options? How DHCP Options Are Applied

What Are DHCP Options? DHCP options are values for common configuration data that applies to the server, scopes, reservations, and class options Common scope options are: DNS Servers DNS Name Default Gateway WINS Servers WINS Servers

What Are DHCP Class-Level Options? DHCP class-level options are scope options that apply to a specific type of device DHCP class-level option Description Vendor-class Configured by vendors such as Microsoft, HP, and Sun User-class Set and viewed by the user

Managing a DHCP Database Overview of DHCP Management Scenarios DHCP Server Configuration Options What Is a DHCP Database? How a DHCP Database Is Backed Up and Restored How a DHCP Database Is Reconciled Moving a DHCP Database

DHCP Server Configuration Options

Monitoring and Troubleshooting DHCP Overview of Monitoring DHCP Discussion: Common DHCP Issues What Are DHCP Statistics? What Is a DHCP Audit Log File? Monitoring DHCP Server Performance

Overview of Monitoring DHCP Why monitor DHCP? To observe the dynamic DHCP environment To determine DHCP server performance To facilitate planning for current and future needs DHCP data includes: DHCP statistics DHCP events DHCP performance data

Common DHCP Issues Address conflicts Failure to obtain a DHCP address Address obtained from incorrect scope DHCP database suffered data corruption or loss DHCP server has exhausted its IP address pool 10 minutes

What Are DHCP Statistics? DHCP statistics are collected at either the server level or scope level DHCP Server

What Is a DHCP Audit Log File? A DHCP audit log is a log of service-related events

Monitoring DHCP Server Performance Performance counters What to look for after a baseline is established Packets received/second Monitor for sudden increases or decreases, which could reflect network problems Requests/second Active queue length Monitor for sudden and gradual increases, which could reflect increased load or decreased server capacity Duplicates dropped/second Monitor for any activity that could indicate that more than one request is being transmitted on behalf of clients Create a DHCP performance baseline Check the standard counters for server performance Review DHCP server counters for significant changes in DHCP traffic

Configuring DHCP Security Preventing an Unauthorized Computer from Obtaining a Lease Restricting Unauthorized, Non-Microsoft DHCP Servers from Leasing IP Addresses Restricting DHCP Administration

Preventing an Unauthorized Computer from Obtaining a Lease To prevent an unauthorized computer from obtaining a lease: Ensure that unauthorized persons do not have physical or wireless access to your network Enable audit logging for every DHCP server on your network Regularly check and monitor audit log files Use 802.1X-enabled LAN switches or wireless access points to access the network Configure NAP to validate users and security policy compliance

Restricting Unauthorized, Non-Microsoft DHCP Servers from Leasing IP Addresses DHCP Clients Rogue DHCP server Legitimate DHCP server To eliminate an unauthorized DHCP server, you must locate and disable it from communicating on the network either physically or by disabling the DHCP service

Restricting DHCP Administration To restrict who can administer the DHCP service: Limit the members of the DHCP Administrators group Add users needing read-only access to the DHCP Users group Account Permissions DHCP Administrators group Can view and modify any data about the DHCP server DHCP Users group Has read-only DHCP console access to the server

Summary Overview of the DHCP Server Role Configuring DHCP Scopes Configuring DHCP Options Managing a DHCP Database Monitoring and Troubleshooting DHCP Configuring DHCP Security 35