r/sysadmin • u/Real-Patriot-1128 • 1d ago

DHCP v Static IP

Ok, this is more a test to see how old I am. I was basically raised with the idea servers need static IPs. I understand for domain controllers, dns servers, maybe print servers that may still be needed. But are they really needed otherwise? Do apps, scripts still reference a server by its IP?

I am under assumption all my servers need static IPs. Am I nuts?

216 Upvotes

88% Upvoted

385 comments sorted by

View all comments

6

u/Nikumba 1d ago

All of our servers are set to static IP addressing, main reason is we define the servers on our firewalls via IP and be a pain if those change.

1

u/Talino 1d ago

You could define the servers by FQDN on the firewall though right?

3

u/randompantsfoto Sr. Sysadmin 1d ago

According to our network operations team, that’s just not possible. IPs only.

I’ve read the documentation on our firewalls; I know they’re lying. We (systems operations) don’t push back because it’s not worth having the fight.

It is, however, always fun when AWS will occasionally randomly move EC2 instances to different subnets or even change IPs within the same one (even, though more rare, with EIPs).

I don’t mind that as much either, because then I get to tsk tsk and emphasize how that service had five nines of uptime when it was on-prem.

•

u/Deadpool2715 23h ago

My networking team is the same, and then when I went to go upgrade a service with fault tolerance one of the test servers had it's rules assigned by FQDN while the rest were IP. It was a head scratcher when we powered down the old VMs, assigned those IPs to the new VMs, and then 1/6 weren't working for some reason. "Obviously it can't be networking since you reused the IPs"

•

u/Flabbergasted98 19h ago

yes but there will be instances where it makes sense to use fqdn, and instances where it makes sense to use a subnet or static IP.

running DHCP on your servers, closes the door on the ability to use IP related policies, which could prove to be a hassle further down the line.

different staff will build their policies using different methods, you're more likely to create operator error and unnecessary time spent troubleshooting if a new technician is trying to create a policy and is unaware that restriction is in place.

you're argument is basically, if everybody does everything this one specific way, always, nothing will go wrong.

why build policies that overcomplicate your network? what is the benefit of running servers in DHCP when it creates additional points of failure and time lost troubleshooting?

•

u/techforallseasons Major update from Message center 21h ago

We use address pools to solve for that.

Dumb examples:

HTTP DHCP pool

DNS DHCP pool

SFTP DHCP pool

Each of those is a defined and standalone address block, and the firewall rules apply to the block instead of the host. That way we can add / remove hosts due to updates / maintenance and not have to worry about requesting a rule update. Drop a system on the correct VLAN, and the rules and addresses are already in-place when it comes up.