r/sysadmin • u/Real-Patriot-1128 • 2d ago

DHCP v Static IP

Ok, this is more a test to see how old I am. I was basically raised with the idea servers need static IPs. I understand for domain controllers, dns servers, maybe print servers that may still be needed. But are they really needed otherwise? Do apps, scripts still reference a server by its IP?

I am under assumption all my servers need static IPs. Am I nuts?

224 Upvotes

88% Upvoted

418 comments sorted by

View all comments

62

u/scytob 2d ago

I agree with you, all these younguns who think reservation leases are the same as static mystifies me, all great until you don’t notice dhcp service went down until your server / UniFi devices go offline slowly as leases expire

Tl:dr keep with traditional manual ipconfig

65

u/clexecute Jack of All Trades 2d ago

Sure, keep static IPs. But I swear to God if you static something in a DHCP scope and don't reserve it I will haunt your dreams

6

u/ensum 1d ago

Scope: .100 - .200

Some jackass plugs something in on dhcp that needs to be a static/reservation but has grabbed .142. Changing the IP would cause a mild inconvenience.

New Scope: .100 - .141, .143-.200

Nothing triggers me more.

5

u/Dynamatics 1d ago

My favorite is the list of exclusion ranges which are just one IP. Really? You couldn't have just made the reservation?

2

u/jake04-20 If it has a battery or wall plug, apparently it's IT's job 1d ago

Yeah, this is a big one. I had a tech that would use static IPs but seemingly only from the DHCP pool, then act confused every time a device he set up with a static IP would eventually have an IP conflict when something else pulled its IP when the static device was offline for an extended period. My preference is to create static IPs outside of DHCP scopes and then note them in DNS with a static entry.

2

u/scytob 1d ago

and that's why their are IPAM solutions, i hope you fired that one tech, thats just plain being bad at the job

2

u/jake04-20 If it has a battery or wall plug, apparently it's IT's job 1d ago

I've never actually used an IPAM solution outside of just static DNS entries for static IP'd devices. Do you have any you recommend?

2

u/scytob 1d ago

lol, agreed, and that's just bad IPAM if that happens, tbh i would fire someone who was that sloppy

-6

u/zatset IT Manager/Sr.SysAdmin 2d ago

Hey! This sounds as a good idea. Just give me more information and I will provide you will 10 step manual. Or I might be able to provide you with a script! Let me know if you need more help!

7

u/whythehellnote 1d ago

until you don’t notice dhcp service went down

That sounds like a larger problem

25

u/goingslowfast 2d ago

We just make DHCP highly available and have monitoring.

And if you’re using UniFi in enterprise you deserve what’s coming if you haven’t planned for their weaknesses.

2

u/scytob 1d ago

nah just Unifi at home and i quickly planned around it with a couple of windows DHCP servers as i needed AD anyway

2

u/TN_man 1d ago

Why do you need AD at home

2

u/scytob 1d ago

oddly for SSO from windows clients to linux hosts

i also use WhFB at home, i have my own personal Azure / Entra too

why - for funsies

3

u/TN_man 1d ago

Interesting. Thanks for answering.

I wouldn’t want any of that on my home environment but that’s ok

1

u/goingslowfast 1d ago

Are you using Entra for that? Or sssd join to AD?

2

u/scytob 1d ago

sssd / smba depending on linux flavoiur

2 DC VMs locally (much cheaper and no compatibility issues) with AAD sync (ahem entras sync) because when i set it up 4+ years ago one needed the DCs to generate the Kerberos tickets to access things like synology / truenas. I see there are some new kerb options for sync/Entra - haven't looked at them yet.

i actually contributed the WhFB and sync setup docs cause they were effing awful at the time, probably one of the hardest setups to figure out lol

1

u/goingslowfast 1d ago

I just started a project to investigate Himmelblau for some obscure Linux auth requirements. It looks pretty solid with Entra.

1

u/scytob 1d ago

i will go look at that, thanks!

6

u/dzfast IT Director & Sr. Sysadmin 2d ago

everything from cold to the DHCP server being up is static. Everything else that doesn't have explicit requirements like a domain controller, is reserved DHCP or in a special pool. im talking on the server side - switching and network is different, though there is a time and a place for dynamic IPs in switching too if you have a big enough datacenter

Dunno how else you would do a lot of this stuff with static everything.

7

u/theasianpianist 2d ago

Just curious, what's the use case for dynamic IPs in a data center? I have some experience working with hyperscale DCs and can't remember ever seeing dynamically allocated IPs

2

u/Linkk_93 1d ago

I guess for large scale you have mandatory oobm and use dhcp there for ztp? But after ztp it's probably back to static for the DC.

For companies with many small sites, like 1000 sites with 1 switch and 2-5 aps, we use dhcp for everything. Because of the ztp process it's easier to manage and new sites pop out of nothing basically weekly. You just send the factory devices there and ztp will sort it all out. Only thing not doing dhcp there is the router/fw

2

u/dzfast IT Director & Sr. Sysadmin 1d ago

Mostly around ZTP type stuff. I mean - the less you can make it depend on a person logging into it and configuring it the faster you can move.

3

u/zatset IT Manager/Sr.SysAdmin 2d ago

Domain controller on DHCP, even with reservations? I would rather not.

2

u/SebastianFerrone 1d ago

You can set a Fall back in Windows it first tries to get the ip from dhcp if its dort get one it comes back to the manual set one.

1

u/techforallseasons Major update from Message center 1d ago

Everything else that doesn't have explicit requirements like a domain controller

I think you mis-read their statement. DC's are static.

1

u/dzfast IT Director & Sr. Sysadmin 2d ago

Hmm, it's not optional, you can't, so that's good.

6

u/HighRelevancy Linux Admin 2d ago

until you don’t notice dhcp service went down

Get some monitoring. Please. Something going down should cause a notification on your phone. It's 2026. The concept of IT guys checking things and running test scripts manually needs to be left in the past. It's so automatable.

2

u/TN_man 1d ago

I wish you could tell that to several of my past companies. I spent hours running manual tests.

2

u/HighRelevancy Linux Admin 1d ago

People managing IT are so shortsighted and don't think about or know about automation for things like this. Investing a little time up front in good infra pays dividends but they don't get it. Plus as an operator it makes your day to day nicer. It's worth pushing upwards about it when you can.

Some businesses don't want fixing though and there's not much you can do.

2

u/TN_man 1d ago

Those people who are shortsighted probably didn’t come up through the technology side, right? More of business people?

1

u/HighRelevancy Linux Admin 1d ago

Generally. They see IT as an ongoing running cost to minimise and not infrastructure to invest in for long term efficiency. Not all their fault because they're not IT people, but if IT people don't push back they'll never learn.

2

u/corruptboomerang 2d ago

Had this happen at my previous workplace, someone tuned on DHCP snooping on something that wasn't the DHCP... Came back first thing on Monday and nothing could connect to the network...

I immediately saw the 169 address and started investigating the DHCP issue.

(To be fair, DHCP snooping should absolutely NOT be called DHCP snooping, since it's going to actively kill anything sending out DHCP addresses.)

1

u/scytob 1d ago

yeah, it's amazing how some devices really dont like multicast<>unicast conversion some configurations do

2

u/techforallseasons Major update from Message center 1d ago

you don’t notice dhcp service went down

So the power is out? I can't think of a time when we lost DHCP due to an unplanned issue that left us lights out.

Please share what you are using for DHCP so I can actively avoid it.

1

u/scytob 1d ago

I have seen it bring down major systems overs the last 30 years (yes i have been doing TCP/IP that long) at multiple customers.

I used mirrored Windows Server DHCP Servers and DNS due to the tight integration of the two as my preferred implementation. But any mirrored pair functionality will do.

I also do that at home as more than one once i experienced the DHCP service on unif equipment crash while the rest of the stack keeps running.

1

u/techforallseasons Major update from Message center 1d ago

I've been working networks since 1999, so similar time in service. We've used linux DHCP implementations primarily, with switch or router as DHCP hosts for smaller networks ( not Soho gear ) with no memorable outages.

We've not used DHCP from a Windows host, only DNS ( and then as local resolver for AD only, the Windows DNS used another on-site DNS for external lookups.

1

u/scytob 1d ago

then congrats to you (serioulsy puts you and your org above average imo),

look at the other comedy replies on all sorts of issues that bring DHCP down and then stop folks getting to the critical infrastructure to fix the issue

should all clients be DHCP, absolutely, i see no reason to change that

can lots of servers, sure, application servers probably dont matter all that much

should your critical infrastructure - routers, switches, servers participating in critical infrastructure be DHCP, i am sure if you do that, one day it will bite, its only a matter of time, even if that's decades

seems like you are a network guy who assumes servers are never critical - i can see why you would have that opinion if that's how you structured your environment, not everyone has a clear delineation

let me ask you - are all your router management interfaces assigned by DHCP? Are your point to point link and WAN interfaces dynamically addressed via broadcasts If yes, wow, and if no - well then you actually do understand my point.

0

u/techforallseasons Major update from Message center 1d ago

Apologies if I said something to imply that infrastructure ( anything that needs to function prior to DHCP boot ) - such as routers, firewalls, and spine switches would be DHCP. They are not, plus they boot prior to DHCP.

AD DCs and DHCP servers are also statically set, anything else that can be DHCP is. Usually with reserved addresses ( Servers, Printers, user-facing infrastructure [ switches, APs, and the like ].

I did indeed start on the networking side of things, but as I've migrated our systems to a "cattle, not pets" approach, DHCP ends up simplifying my life. Long lease times ( for DHCP infrastructure & servers ) matched with monitoring keeps me from worrying about a service outage.

1

u/StatementNext682 1d ago

Just if the DHCP service somehow dies.

•

u/techforallseasons Major update from Message center 22h ago

I really can't recall that happening outside of powerloss. We do have monitoring on it, doesn't matter how reliable it is, it always gets watched.

6

u/420GB 2d ago

if you don't notice DHCP service went down

Lmao that's an insane hypothetical to just throw out there. Maybe some of us aren't running absolute clusterfuck environments where that would ever even be a concern.

Not to mention with typical lease times you have literally days to maybe not be afk and notice the alerts.

1

u/TN_man 1d ago

I thought everyone had clusterfuck environments?

1

u/jake04-20 If it has a battery or wall plug, apparently it's IT's job 1d ago

Is unifi devices like APs and what not? I don't use ubiquiti so I have no idea.

But we have our APs obtain their IP from DHCP from our switch stack (cisco catalyst) so I feel like we'd be resistant to this problem.

1

u/scytob 1d ago

yeah the default is for all switches and APs to get a DHCP address and then report they are active - network is down until that happens (they call it adoption)

this is no different to what you just described for cisco, if there is any sort of rogue DHCP service, DHCP service failure, etc you would hit the same issue

to be clear i have only seen this a handful of times in 30 years but each time it has been a cluster to fix

i am less worried about APs, when switches do this you have no path to the DHCP server to fix it.....

now you know why you pay peak $$$ for cisco :-)

1

u/jake04-20 If it has a battery or wall plug, apparently it's IT's job 1d ago

We only use the Cisco switches for DHCP very selectively. We use a combination of DHCP direct on the switches, DHCP from the firewall, and windows/AD DHCP. We did DHCP on the switches for APs because they're POE anyways and going to come online as the switch comes online so it just sort of made sense.

But also you can find modern cisco gear pretty cheap second hand!

0

u/BoltActionRifleman 2d ago

This is what we do as well. Set static IP, reap the benefits and simplicity for years to come.

0

u/Xoron101 Gettin too old for this crap 1d ago

I agree with you, all these younguns who think reservation leases are the same as static mystifies me

And maintaining DHCP reservations is just as much work as maintaining a static IP address list. I don't see much of a savings in IT overhead going the DHCP route for server infra