Windows Forum

Ask something
Discussion Locked

Assigning DHCP from a defined database?

0 helpful
9 replies

by frankl27

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Environment: Windows NT 4.0 SP 6a
Running DHCP on a very limited scale: using static addresses for critical systems that require monitoring and/or remote control.

I've recently been presented with the task of completely redesigning our network of 13 locations scattered across two states. All the machines are currently assigned static IP addresses (mainly due to remote monitoring and support needs).

Is there a way to use DHCP to assign addresses from a table? For example, I want to assign the PC 'Branch1President' to 10.0.0.100, the PC 'SysAdmin' to 10.0.0.68, the machine 'RouterA' 10.0.0.1, and all the other machines in the network in a similiar fashion. For security reasons, I also want to specify that if a machine attempts to get a DHCP request that ISN'T identified in this table I've created, it is denied an address (basically for security reasons -- A rogue janitor plugging in a laptop wouldn't be given an IP address that would allow connections). I'd also like to log these entries so when a machine logs in and gets an address, the MAC, username and the date/time of login/logout).

Am I asking too much? I really hate to drive all over the states reassigning the network addresses if I can get around it.

Also, we are evertually going to a Windows 2000 advanced server environment, so tips on doing it in that OS would be very helpful.

Can DHCP requests pass through my Cisco 1720, or can I enable the DHCP on both sides to do what I'm attempting?

Becauseof the scope of these questions, I've assigned a very high point value to this question (IMHO).

Thank you in advance for your responses.

9 replies

by frankl27

I want to clarify the point about the Cisco 1720:

I know I can enable the DHCP on the router, but I want to be able to use the 'table' I'm referring to.

by gary mcp

You've got a few different issues here. As far as I know, the only way you can give machines specific addresses in DHCP is through Reservations. Basically, you link the MAC address of a pc to an IP address, so that each time the machine requests an address it gets the same one.

It would require some work to set up, but it should save you all those trips.

As for blocking "rogue" machines, it's a bit more complicated. If you're going to use reservations, you can "trim" your DHCP scope so itdoesn't include any open addresses. That way a rogue machine won't get an address.

There was a question similar to this that got some interesting answers a little while ago. It might prove useful. Check out
https://www.techrepublic.com/forumqa/thread_detail.jhtml?thread_id=97651

Hope this helps,
Gary

by frankl27

The reservations isn't exactly HOW I wanted to do it, but it's EXACTLY what I wanted to do. Thanks!

by joseph moore

I think the real question you need to think about is, do you REALLY want all of your machines running with dynamically-assigned IPs?
The "normal" way (that I have seen it and read about it) in using DHCP is to assign servers (machines that run some process(es) that you must be able to connect to and access whenever there is someone in the office or a customer trying to use your service), switches and routers STATIC IP addresses. Other non-mission critical devices (user workstations, for the most part) get dynamic addressing.
If you want to have a router get an IP dynamically, then you're crazy! That would be irresponsible. No safe, secure, reliable network design would include a router with a DHCP-assigned IP. I don't care if you can enable dynamic addressing on Cisco products; it doesn't mean you should do this!
Keep your routers, switches and servers all on static IPs. You can give them new ones, if you are re-IPing your WAN, but don't go about and have your PDC get its IP address dynamically! If you do that, you will have user authentication problems galore, all because user workstation \\BOB1 still has in its NBTSTAT cache the OLD IP address for the PDC when user Bob tries to log in. And since \\BOB1 is looking for the old IP for the PDC, user Bob will NOT be able to log in (probably get the "Domain Controller Not Found" error).
And you will get a phone call from Bob, saying the network is terrible because he can't log in.
And no one needs to get yelled at by Bob!

by joseph moore

Ok, that is the opinion section of my answer.
Now, onto some facts.
Answer1 is correct in that you can set up Reservations in the DHCP scope. You can "assign" a single IP to a single MAC address. That way, when that MAC requests an IP (when the IPlease expires), then it gets the IP from the Reservation list.
But to be honest, this is just a dynamic way of assigning static IPs. So, I don't think this is what you really want. If you need some easy way of dishing out IP addresses, then just cut all the way to DHCP for user workstations and laptops.
YOu can always check the DHCP logs to see what machine got what IP. YOu get the MAC, the Mahcine Name, the IP, and when the IP lease expires.
Set your lease to a short amount of time (3 daysis good) to keep the rotation of IP addresses going. I don't like long DHCP leases. It can cause problems. But, you don't want the leases really short either; that causes too much DHCP traffic. All those DHCPACKs going around!
I do agree with the suggestion of making your DHCP pool only as big as the total number of machines you will need addresses for. But, doing that is no substitue for the need of you looking at the DHCP server logs every day, to make sure strange named machines didn't get on the network and grab an IP!
I am a big supporter in us checking the logs. You can't get away from them.

by joseph moore

And to answer your question of if you can supply a file for DHCP to use, the answer is no. YOu can't write up a text file, import it into DHCP Administration, and have the server use that.
But, you can set up the DHCP scope on your server, with theReservations and the exclusions to the scope, then you can check the logs.
And remember, each DHCP server has its own DHCP server log in the Event Viewer. That is where you can check for reporting on who got what IP at what time. There are plenty of log-monitoring tools out there that you can get that will actively check your logs for anything. Personally, I use a tool called IPMonitor to check some server Event Viewer logs for stuff. You could do the same. Set up alerts when stuff in your DHCP Event Viewer log comes up to notify you.

hope this helps

by frankl27

I don't think you understood the nature of my question. I currently use STATIC IP addressing because of the very reason you stated about routers and such. However, readdressing 13 locations in two different states presented a bit of a challenge. I wanted a way to specify based on some criteria that machine A got this address and machine B got that address and machine C (which I've never seen before) didn't get ANY address. I need defined IP addresses because I actively administrator all theworkstations, servers and routers from a single location. If the addresses changed all the time because of DHCP, my administrative abilities would be severely hindered. Also, I wanted to proactively deny/accept DHCP requests. I didn't want to read about a successful Saturday hack by the janitor on Monday morning when I walked in.

However! That said, I am insanely curious about this event monitoring program of which you spoke and for that alone will I accept your answer. Thanks.

This discussion is closed to new replies.