Slashdot Mirror
DHCP Management Across a Diversified Network?
ET Admin writes "I work for a small Wireless ISP, where we are deploying new network hardware to allow for growth and contain broadcast traffic. All routing/switching equipment is Cisco. We use Linux stand-alone boxes and VMs (running on Win 2003 boxes). We have decided on a hybrid VLAN layout where we have certain VLANs limited by location, and other VLANs that are global across the network. And I want DHCP served across it all. Does anyone have experience with IPAM software that handles multiple DHCP servers? Our network is small so spending a couple grand is overkill at this point. Any recomendations to help me decide between serving DHCP from the Nix boxes, or from the Cisco gear? Knowing that a single DHCP server will handle from 100-500 hosts."
setup DHCP Relaying on the switches to forward/relay all dhcp request across the vlans and subnets to one (or two) dhcp servers
http://lmgtfy.com/?q=cisco+dhcp+relay&l=1
You can easily run hundreds of thousands of hosts off a single DHCP server. It is not cpu intensive particularly if you have a decent lease duration.
Just because you disagree doesn't make it offtopic or flamebait.
Someone in house here created it, and we use it across multiple vlans from a Gentoo box. It uses the ISC DHCPD server.
http://phpdhcpadmin.sourceforge.net
Seriously, do not use the Cisco gear to handle the DHCP. There are several ways to handle this, either have a system with an interface on all the networks, or setup your Cisco gear to forward the HDCP requests to the one subnet that does have your system.
With using Unix/Linux you can setup failover servers so that if one does not respond, the other will take over the requests and that way you will not lose DHCP across your entire network due to hardware/software issues on a single system. Go read up on dhcpd, it is not too difficult to understand, and is really probably your best low cost solution.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
You need to use DHCP snooping to block rogue DHCP servers and block packets with forged MAC addresses on untrusted interfaces
You need IP source guard to block forced IP addresses on untrusted interfaces
Otherwise, you are at risk of DOS and/or compromise from malicious users, and at risk of instability and insanity caused by users who plug a rogue DHCP server (even something as simple as the LAN side of a Linksys gateway) into your gear.
Ahem... never heard of RFC 3315? DHCPv6 still has a place in an IPv6 network.
DNSMasq. Nuff said.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
To everyone who tagged this "domyjobforme", I hope every single one of you gets the same response the next time you ask for help doing you job. At least this guy had the sense to say, "Hey, there's a community of people that contains a multitude of experts in many fields, I bet someone might have some good suggestions." And guess what else? Maybe some readers will find the suggestions helpful too. Ask Slashdot is for questions that the general community might find interesting and helpful, not just one guy. It's not just about the submitter, and it's certainly not about your need to be snide to those who recognize their shortcomings and try to expand their base of knowledge.
jX [ Make everything as simple as possible, but no simpler. - Einstein ]
whys that, IPV6 thinks its too good for DHCP?
Hey, wait, VMware server's still an option for production servers. Several years ago, it was a commercial product called VMware GSX server.
"Small wireless ISP" doesn't exactly strike me as the type of user, who would be deploying an Oracle RAC cluster with a load of 10k transactions per second, and an Exchange 2007 server with 5000 mailboxes, processing 10 messages per second.
GSX was the version for production servers in a small environment. ESX was the high-end uber-expensive version for running massive numbers of servers on a dedicated host in a large environment.
Server hardware in common use has gotten a lot better, much more powerful, since then. And VMware Server is no worse than GSX.
If your workload is suitable for that type of virtualization, GSX should be okay.
Yeah, ESX is a lot better, can handle many more VMs, and can virtualize many high-end workloads effectively that weren't even VM-suitable under GSX/VMware server.
ESXi is less mature, and probably not as suitable as ESX.
Yeah, because as a wireless ISP you can totally require your clients to support IPv6. Wait, no, that's not right.
-k. ^-^ ^D
Carnegie Mellon's NetReg is an open source system that provides a pretty complete IP Address Management toolset, including management of DNS & DHCP configurations for ISC bind/dhcpd. It can manage ISC dhcpd's failover configuration, and multiple server groups, etc.
Rather then just repeating what I've said before when the subject of IP Address Management came up on slashdot, I'll just link to it.
Note: While the project has been pretty quiet for quite some time now, thats mostly because its the system is very stable and there hasn't been a lot of major new development in the last couple of years. I used to be one of the core developers of the system before I moved on to another job, but its still in active use by many sites.
I get the strong impression you might be in way over your head with less than 3 years experience. You're asking about implement technologies which you don't fully understand yet. The risk here is that you might get a solution that works, but it will be horribly insecure.
VLANS are layer 2. Subnetting is at the layer three level and normally coincidence with the layer 2 vlans you create (but not always). While you can have vlans spread across large regions, you defeat most of the benefits of using a vlan such as limiting broadcast domains and introduce some latency and timing issues. Cisco will tell you to keep the number of hops as small as possible. Adding 250 ms rtt between peers is an issue. Cisco has also had issues where vlans were not hard boundaries and you could get traffic to jump vlan boundaries by faking the 802.11q tags.
I think I understand what your trying to accomplish - a public IP that can move around a larger region and between wireless towers at will. I think a far better solution is along the lines of a secure VPN. That avoids a whole slew of security and performance issues associated with vlans and wireless. What's stopping a malicious person from coming up with a wireless subscriber module (what exactly is that, btw?) that adds whatever vlan tag they want and getting access to any subnet at will?
I also recommend using dhcp-helper and a handful of linux dhcp servers. That puts all the configuration in a central linux box and you don't have to muck with all the switches and routers for every little change.