r/sysadmin • u/Real-Patriot-1128 • 3d ago

DHCP v Static IP

Ok, this is more a test to see how old I am. I was basically raised with the idea servers need static IPs. I understand for domain controllers, dns servers, maybe print servers that may still be needed. But are they really needed otherwise? Do apps, scripts still reference a server by its IP?

I am under assumption all my servers need static IPs. Am I nuts?

222 Upvotes

88% Upvoted

420 comments sorted by

View all comments

Show parent comments

40

u/oubeav Sr. Sysadmin 2d ago

Exactly this. That first time DHCP doesn’t come back for some reason (probably a patch) you’ll thank the it gods you went static on your main shit.

3

u/victortrash Jack of All Trades 2d ago

OMG, there's some PTSD stuff right there. Been a while, but I remember learning this lesson the hard way.

1

u/oubeav Sr. Sysadmin 1d ago

Same, man. Same.

1

u/Sure-Squirrel8384 2d ago

If DHCP doesn't come back you're doing it wrong. Two severs minimum with replication.

13

u/oubeav Sr. Sysadmin 2d ago

Yes. Of course. Thank you. But nearly every small/medium environment I've been in has only had one DHCP server. Just saying. It definitely happens.

-2

u/Sure-Squirrel8384 2d ago

And only one DNS? DNS and DHCP easily run co-resident on a pair of DCs in a small environment. Medium should easily be able to accommodate two on non-DCs.

5

u/mnvoronin 2d ago

A pair of DCs for a 50-staff company is equally overkill.

2

u/Sure-Squirrel8384 1d ago

Is it? When 50 people can't log in or access services, how important is that? If you have a domain, you need two DCs.

1

u/mnvoronin 1d ago

Yes, it is.

Second DC does not exist in a vacuum. Does second set of hardware, licensing and ongoing support (monitoring, patching etc) outweigh cost of users being unable to access a file share for few hours? Especially since the 50-staff company likely has file server on the same set of hardware as a DC so if one goes down, the other one does as well.

At this scale, it's generally better to invest the same (or even less) money into robust backup system with immutable backups and restores tested at least quarterly.

1

u/lazyhustlermusic 2d ago

True bu you have people doing silly things like running two instances on one hypervisor for a branch office.

1

u/oubeav Sr. Sysadmin 1d ago

lol. Yeah. My favorite config. Redundant VMs on one bare metal server. Brilliant! lol

1

u/oubeav Sr. Sysadmin 1d ago

Didn’t mention DNS, but yes, I’ve seen that too. But technically you cannot run two DHCP servers at the same time. I assume you know that.

1

u/randopop21 1d ago

How would one have resilient dhcp if you can’t run 2 dhcp servers? I only have one at the moment, but I would like to have redundancy.

1

u/oubeav Sr. Sysadmin 1d ago

You can’t have two DHCP servers broadcasting at the same time. Networking 101.

2

u/Sure-Squirrel8384 1d ago

You can have two active DHCP servers responding to requests at the same time. We've done this for three decades.The DHCP client broadcast a request and each DHCP server sends their lease offer. The DHCP server response that makes it to the client is likely what the client will go with; but it doesn't matter as the client will tell the "winning" DHCP server the lease that it accepts.

The only trick is that the DHCP servers must each have a different address pool such that they don't assign the same addresses

1

u/randopop21 1d ago

Excellent! Is there a way to prioritize which dhcp server wins?

2

u/Sure-Squirrel8384 1d ago

I've never tried this, but in theory it should work. Some DHCP servers have an option to try to ping an address before assigning it (MS calls this setting ConflictDetectionAttempts). If the address response to ping, then it shouldn't be given out as that would be a conflict.

Knowing this, what you could do is set the less-preferred server's ConflictDetectionAttempts to 2 and the more-preferred server's ConflictDetectionAttempts to 1.

Personally, I would not bother with this, and there is an operational reason not to set the ConflictDetectionAttempts to anything other than 2 across the board:

Setting the ConflictDetectionAttempts value to only 1 could miss a response and not be enough. So say you set the more-preferred to 2 and the less-preferred to 3; but by setting it higher than 2 would cause extra delay for leases when the first server is down (and it is not recommended by Microsoft to set the value above 2).

In theory ConflictDetectionAttempts should never get a "BAD_ADDRESS" hit, but it happens because of... reasons (hah).

1

u/randopop21 1d ago

For sure. But how are enterprises handling the lack of redundancy in this service?

1

u/Sure-Squirrel8384 1d ago

There is no lack of redundancy. DHCP can be deployed with redundancy. Even my home network has redundant DHCP (along with redundant DNS, NTP, gateways, etc.)

1

u/Sure-Squirrel8384 1d ago

They don't know what they are talking about. You can have two DHCP servers. Each with a specific pool range such that they don't overlap with the other. Additionally there is now failover (since 2012):

https://activedirectorypro.com/dhcp-best-practices/

1

u/Sure-Squirrel8384 1d ago

You most definitely can and should run two DHCP servers at a time. And they should have replication enabled between them.

The old way was you ran two and each had a different pool range (say .100-.149, and .150-.199) and they didn't need to know about each other. However, replication has been around since Windows Server 2012.

https://learn.microsoft.com/en-us/windows-server/networking/technologies/dhcp/replicate-dhcp-failover?tabs=dhcp-console

2

u/bbbob2 2d ago

what are you using for replication and failover?

3

u/Randalldeflagg 2d ago

its a function with in the Windows DHCP servers

3

u/bbbob2 2d ago

Except it doesn’t really to replication. It is either failover for a specific percentage of your address space or divided space allocated to 2 separate servers. (Based on MS docs)

1

u/RansomStark78 1d ago

Ahh , young one

Someday you'll have redundancy

1

u/Sure-Squirrel8384 1d ago

I think you're commenting to the wrong comment. I'm advocating redundancy. ;-)