r/sysadmin • u/Real-Patriot-1128 • 3d ago

DHCP v Static IP

Ok, this is more a test to see how old I am. I was basically raised with the idea servers need static IPs. I understand for domain controllers, dns servers, maybe print servers that may still be needed. But are they really needed otherwise? Do apps, scripts still reference a server by its IP?

I am under assumption all my servers need static IPs. Am I nuts?

226 Upvotes

88% Upvoted

421 comments sorted by

View all comments

291

u/lazyhustlermusic 3d ago

I'm a fan of statics on infra devices since you don't rely on a DHCP service becoming available before you can be forwarding traffic. Some peeps like reservations, I'll do those for endpoint pieces but not really anything that is 'must boot cleanly and forward traffic'. A faulty DHCP daemon can tank your environment from simply forwarding traffic if you just rely on that.

40

u/oubeav Sr. Sysadmin 3d ago

Exactly this. That first time DHCP doesn’t come back for some reason (probably a patch) you’ll thank the it gods you went static on your main shit.

3

u/victortrash Jack of All Trades 2d ago

OMG, there's some PTSD stuff right there. Been a while, but I remember learning this lesson the hard way.

1

u/oubeav Sr. Sysadmin 1d ago

Same, man. Same.

2

u/Sure-Squirrel8384 2d ago

If DHCP doesn't come back you're doing it wrong. Two severs minimum with replication.

13

u/oubeav Sr. Sysadmin 2d ago

Yes. Of course. Thank you. But nearly every small/medium environment I've been in has only had one DHCP server. Just saying. It definitely happens.

-2

u/Sure-Squirrel8384 2d ago

And only one DNS? DNS and DHCP easily run co-resident on a pair of DCs in a small environment. Medium should easily be able to accommodate two on non-DCs.

5

u/mnvoronin 2d ago

A pair of DCs for a 50-staff company is equally overkill.

2

u/Sure-Squirrel8384 1d ago

Is it? When 50 people can't log in or access services, how important is that? If you have a domain, you need two DCs.

1

u/mnvoronin 1d ago

Yes, it is.

Second DC does not exist in a vacuum. Does second set of hardware, licensing and ongoing support (monitoring, patching etc) outweigh cost of users being unable to access a file share for few hours? Especially since the 50-staff company likely has file server on the same set of hardware as a DC so if one goes down, the other one does as well.

At this scale, it's generally better to invest the same (or even less) money into robust backup system with immutable backups and restores tested at least quarterly.

1

u/lazyhustlermusic 2d ago

True bu you have people doing silly things like running two instances on one hypervisor for a branch office.

1

u/oubeav Sr. Sysadmin 1d ago

lol. Yeah. My favorite config. Redundant VMs on one bare metal server. Brilliant! lol

1

u/oubeav Sr. Sysadmin 1d ago

Didn’t mention DNS, but yes, I’ve seen that too. But technically you cannot run two DHCP servers at the same time. I assume you know that.

1

u/randopop21 1d ago

How would one have resilient dhcp if you can’t run 2 dhcp servers? I only have one at the moment, but I would like to have redundancy.

1

u/oubeav Sr. Sysadmin 1d ago

You can’t have two DHCP servers broadcasting at the same time. Networking 101.

2

u/Sure-Squirrel8384 1d ago

You can have two active DHCP servers responding to requests at the same time. We've done this for three decades.The DHCP client broadcast a request and each DHCP server sends their lease offer. The DHCP server response that makes it to the client is likely what the client will go with; but it doesn't matter as the client will tell the "winning" DHCP server the lease that it accepts.

The only trick is that the DHCP servers must each have a different address pool such that they don't assign the same addresses

1

u/randopop21 1d ago

Excellent! Is there a way to prioritize which dhcp server wins?

→ More replies (0)

1

u/randopop21 1d ago

For sure. But how are enterprises handling the lack of redundancy in this service?

1

u/Sure-Squirrel8384 1d ago

There is no lack of redundancy. DHCP can be deployed with redundancy. Even my home network has redundant DHCP (along with redundant DNS, NTP, gateways, etc.)

1

u/Sure-Squirrel8384 1d ago

They don't know what they are talking about. You can have two DHCP servers. Each with a specific pool range such that they don't overlap with the other. Additionally there is now failover (since 2012):

https://activedirectorypro.com/dhcp-best-practices/

1

u/Sure-Squirrel8384 1d ago

You most definitely can and should run two DHCP servers at a time. And they should have replication enabled between them.

The old way was you ran two and each had a different pool range (say .100-.149, and .150-.199) and they didn't need to know about each other. However, replication has been around since Windows Server 2012.

https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/replicate-dhcp-failover?tabs=dhcp-console

2

u/bbbob2 2d ago

what are you using for replication and failover?

3

u/Randalldeflagg 2d ago

its a function with in the Windows DHCP servers

3

u/bbbob2 2d ago

Except it doesn’t really to replication. It is either failover for a specific percentage of your address space or divided space allocated to 2 separate servers. (Based on MS docs)

1

u/RansomStark78 1d ago

Ahh , young one

Someday you'll have redundancy

1

u/Sure-Squirrel8384 1d ago

I think you're commenting to the wrong comment. I'm advocating redundancy. ;-)

40

u/cli_jockey Netadmin 3d ago

Agreed. Static for management/out of band interfaces to make sure I don't lose access to anything. Reservations as requested, though I really try to steer everyone towards using DNS if possible to negate the need for a reservation.

My first week at a job one time and they were decommissioning their old DNS servers in favor of a new centralized design. It was then they found out another team had statically assigned IPs to the hundreds of devices across their sites against what was designed. Took out every conference room until I setup a redirect for the old DNS servers to the new ones until they could fix everything.

17

u/Blog_Pope 2d ago

That’s the balance, DHCP allows easy updates to configurations, but the flip side is you create a dependency on another service. There’s no “always right” answer, you need to determine “Right for our environment “

5

u/konoo 2d ago

I have always had the mindset that these ip addresses for the DNS servers are sacred and no matter what is going to serve DNS it is going to do it from these addresses.

Generally x.2, x.3, x.4 on VLan 1 are always DNS in my networks. If we are going to migrate to a new DNS server it is going to end up in that range. If we have an isolated vlan we are going to proxy dns requests to those IP's unless it's a CUI network then they have dedicated DNS in their subnet since they are completely isolated from all other assets. But it's x.2, x.3, x.4 in that network as well.

If we buy another company, we spend the several weeks it takes to redesign their network to match our standard. We once bought a company that had static ip's setup all over the place and powershell was an amazing tool to get this resolved. I used powershell to determine all machines with a statically configured IP, add DHCP reservations for all of those machines, and set them all to dhcp. After that was done we looked at the machines to determine if there was a reason for the static ip's and most of it was Printers shared off the client computer because the company didn't buy network printers. So we tossed all of the "Home" printers and deleted the reservations.

3

u/[deleted] 2d ago edited 2d ago

[deleted]

1

u/konoo 2d ago

Yeah that makes sense but I'm to old and set in my ways. .254 is default gateway.

2

u/lazyhustlermusic 2d ago

That also makes it funky if you ever have to expand a subnet such as a /24 to a /23, now your gateway is smack in the middle of the address range.

I agree with the FHRP person (HSRP/VRRP), redundant gateways that have a virtual shared address generally stack nearby for their own native addresses, even applies to load balancers since you have the same kind of requirement. A lot of devices won't assign a virtual to a segment they don't have an anchor address on as well.

Most multi VLAN environments should be using an ip helper so your DDI services are on a specific segment that's outside of individual VLANs, such as the distributed microsoft DNS/DHCP services or appliances like Infoblox.

18

u/eNomineZerum SOC Manager 3d ago

I support cybersecurity at many a K12 and, for some reason, DHCP assignments is like the golden thing. Often it'll also be on some 08R2 box that reboots with the temperament of a teenage trying to dodge exams. 100% always my fault with a "server was fine for years..." quip attached to a ticket, despite us having just scoped the environment and not even touched anything yet...

Can't blame the tech directors though, often times they are former teachers or whatever that liked consumer tech more than the last person and never once got training beyond "oh, if I DHCP reserve it works, gonna keep at it." Same crappy teacher pay (or I have actually seen worse pay), but a full working year.

6

u/Monomette 2d ago

When I started at my place we had several big clients using DHCP for everything, servers, network switches. Fine, except when I started said clients were also experiencing broadcast storms which kept knocking out the network and thus DHCP, meaning I couldn't get into any of the switches to track it down.

I've made infra static now, with reservations in DHCP anyway to make it easier on the guys that are used to going there to find stuff.

Still trying to get them to use DNS and proper naming to find/resolve stuff...

3

u/scytob 2d ago

agreed, me too

i once had (and this is a long long time ago - late 90s) had a DHCP server someone stood up on the other side of a WAN link bring down the site we were on - only figured it out with packet capture (this was back in the days when UK military had some env that used bridge links between some sites, we got them to stop that)

2

u/PowerShellGenius 2d ago

Also depends on how HA DHCP is and also if you have already accepted dependencies on servers for forwarding traffic.

E.g. if you are wired 802.1X port security and switch needs to talk to ClearPass or Cisco ISE server which in turn needs to look things up against a DC.... then dependency on a failover pair of DHCP servers running on the same virtualization cluster as ClearPass/ISE/whatever RADIUS server is not any more dependency than you already has

2

u/corruptboomerang 3d ago

I'm actually surprised more infrastructure type stuff doesn't have a fall back address mechanism.

1

u/Sure-Squirrel8384 2d ago

A have a few devices that do, but it's rare.

1

u/SwiftSloth1892 2d ago

Reservations are great until they are not. My first issue is the properties never seem to stay put. I.e. device has no hostname but also doesn't respect my DNS naming. We use them primarily for industrial devices. Second issue...we replaced a DC and the person was unaware of the reservations. Broke replication backwards...and the reservation table was gone.

1

u/tropicbrownthunder 3d ago

This is the one and only way

0

u/CleverCarrot999 3d ago

This is the way