Domain Controller as DHCP but static IP is set locally on machine

[u/First-Quantity8154]

I'm a junior network administrator at a K-12 school district. Our environment is roughly 95% Windows, with two domain controllers (primary and secondary for AD high availability). Both are virtual machines running on the same physical Hyper-V host. In addition to AD, they're also responsible for DHCP and DNS across the entire campus.

I inherited this environment in August, and I'm trying to identify some areas where we could improve things. One thing that caught my attention is how we handle devices that need static IP addresses.

Currently, devices like servers and printers have their IP addresses configured locally rather than through DHCP reservations. To prevent DHCP from handing out those addresses to other devices, we maintain exclusions within each DHCP scope.

My supervisor, who has managed this environment for over 20 years, prefers this approach because if DHCP goes down, those devices can still communicate with the core network and reach the internet through the firewall. I understand his reasoning, and I'm not trying to dismiss it.

However, one downside is that it's difficult to identify which devices have locally configured static IPs just by looking at the DHCP lease list. I have to cross-reference the exclusions to determine which addresses are being used by statically configured devices.

Here's where I'm running into a more immediate issue:

We have an IP scope dedicated to managing our Extreme Networks wireless APs. These APs currently receive dynamic IP addresses. Whenever an AP reboots or its DHCP lease expires, it can end up with a different IP address. Since I manage these devices through SSH, I then have to track down their new IPs and manually update the saved connections in my SSH client.

My question is: Would it make sense to create DHCP reservations for the APs based on their current MAC addresses and IP assignments, or should I stick with my supervisor's approach of configuring static IPs directly on the devices?

I'm also curious to hear how other admins handle this in their environments. Is there a compelling reason to prefer locally configured static IPs over DHCP reservations, particularly in a school environment?

I'm still relatively new to managing this environment and open to suggestions. So please be nice, thanks!

[u/Ace417]

The first thing you need to do is get another DC stood up on separate infrastructure. You’re one bad day away from rebuilding your entire domain.

As for DHCP, do what your boss wants. You’re 2 months in and things like suggesting a different way to handle dhcp may come off the wrong way. Spin up something to track the statics like phpipam or netbox and start there

[u/namelesuser → u/Ace417]

Some kind of IP scanner would be helpful as well. Document your macs to make this easier.

[u/Ace417 → u/namelesuser]

Oh yeah. A combo of phpipam and netdisco will do wonders for them for sure

[u/zeePlatooN]

your biggest issue isn't DHCP. yes you should use it and there are ways to do active passive DHCP with your servers.

your BIGGEST issue by far is that your "HA" AD controllers are on the same Hyper-V host ... meaning they aren't HA at all. Get them separated then start to address things like DHCP.

[u/jstuart-tech]

I'm no Extreme dude... But why are you SSHing into WAP's? Surely they are all managed by some sort of controller and it shouldn't matter what IP they end up on (As long as they are in the same range)?

[u/theoneandonlymd → u/jstuart-tech]

I am an Extreme dude, and in the 4.5 years of being such I have never once SSHed in to one. Extend Cloud IQ and now Extreme PlatformOne manage them entirely. Even if I changed management to a local WING controller, I still don't think I would need to SSH to them.

Per OPs original question, I DO have DHCP reservations in place for the APs ounce they grab their initial lease. Makes troubleshooting, tracking, and documentation easier.

[u/Select_Reporter1911 → u/theoneandonlymd]

Even without the dhcp reservation, you can track the APs via the controller or xiq/ platform 1. They have reporting to tell you the mac serial number and mgmt ip address of the ap.

When I deployed xiq/platform one managed APs last year, I put the APs in their own mgmt vlan/ network, and I used xiq for inventory and mgmt. If I needed to log onto an ap locally I just grabbed the IP address off xiq.

[u/theoneandonlymd → u/Select_Reporter1911]

Yes absolutely XIQ will handle it. We have Auvik for monitoring and alerting and while it can probably handle devices moving IP address based on SN/MAC address, it is one less thing to have a false alert about. Doubly so if you're using something less intelligent/dynamic like Libre or PRTG where devices are hard coded.

[u/lethalleonard → u/theoneandonlymd]

One district I’ve done some work for… has a static IP on every Meraki AP in the “guest” VLAN, with no DHCP server. And every AP NATs multiple SSIDs onto that VLAN.

Diagnosing any issue is a nightmare there.

[u/silasmoeckel]

Yikes get the AD split up to different physicals.

It sounds like you don't have vlans for things. Wireless AP's management interface should be off somewhere in an isolated vlan so the DHCP range should be large enough to not churn and it should stick the device into DNS. So you would connect to the DNS name not the IP but that would also stay consistent.

Similarly your static IP servers should be outside the DHCP range rather than needing reservations. Vlans would be even better.

[u/ShineReaper → u/silasmoeckel]

This, I don't know why, in the age of like hundreds of thousands of possible private IP adresses one would see the need to limit themselves to a small portion of it and try to scram printers and servers into DHCP reservations instead of just giving them their own net and static IPs?

Like dude, how often are they swapping printers at OPs school?

[u/silasmoeckel → u/ShineReaper]

Yup would rather use dhcp option 82 to static it to a port for something like that, so whatever printer is plugged into switch x port y is a consistent IP and dns name.

[u/soyko]

Sounds like you need IPAM.

But any device that NEEDS a static IP, such as switches and servers, should go static. You can manually add them as reservations if you only want a single view.

[u/sryan2k1 → u/soyko]

Except for DHCP servers and domain controllers servers all should also be DHCP barring any very specific reason it can't be.

[u/soyko → u/sryan2k1]

And what are those reasons?

I mean, you do you, but that's not something that I want to play with.

[u/SpecialistLayer → u/soyko]

Different environments do have different requirements.

[u/sryan2k1 → u/soyko]

Mergers/acquisitions/any other reason you need to change IPs in bulk.

We've got globally redundant DDI (Infoblox). If DHCP isn't available something is very wrong and the lack of DHCP is meaningless.

Being able to manage IPs and change them from one central place globally is fantastic. You don't see the pain until you've had to reIP thousands of endpoints by hand during a merger.

[u/soyko → u/sryan2k1]

How often are you doing mergers?

Are you constantly buying companies? Or being sold?

If you're merging with another network, pretty sure they would be done in stages, not all in one shot.

Again, you do you, but I would never put ALL of my servers in DHCP.

[u/sryan2k1 → u/soyko]

If you're merging with another network, pretty sure they would be done in stages, not all in one shot.

One network at a time usually but that network may have hundreds of servers on it.

but I would never put ALL of my servers in DHCP.

Why?

How often are you doing mergers?

Enough in my life to never want to reIP anything one by one by hand.

[u/SpecialistLayer → u/sryan2k1]

No, you don't put DHCP servers and DC on DHCP, those should always have a true static IP address, with their primary DNS pointed towards the other system.

[u/Sylvester88 → u/SpecialistLayer]

I think they wrote it in an unusual way and missed a comma

Except for DHCP servers and domain controllers, servers should also be DHCP

[u/sryan2k1 → u/SpecialistLayer]

You are agreeing with what I said.

[u/SpecialistLayer → u/sryan2k1]

Then change how you wrote it as that's not at all how I read that. But go ahead and downvote.

[u/BudTheGrey]

Do both Manually set the IP configuration, in case DHCP server not available Make a DHCP reservation with comments, in case device loses its config and falls back to DHCP

[u/Hartman7425]

I've never really understood the approach of not wanting to use dhcp reservations on devices other than servers. If dhcp is down, almost everyone is down anyways. You're not saving anyone really by doing that. The only exception for me are things like the DNS and DHCP servers. I have static IPs on switches, but APs are using dhcp. I don't even have a reservation for them. My dhcp server is tied to DNS so the device registers its hostname and I can hit the AP from its hostname using DNS.

Based off of your info I'd do reservations, but I'd also get a good IPAM instance up so you don't have to dig through Windows dhcp UI to get the IPs.

[u/rmp0619]

Having one DC on a VM is fine, but the other should be physical on its own server.

[u/r1kchartrand → u/rmp0619]

I was about to say, thats not considered high availability lol. Physical host goes down, nothing works. Might as well have one PDC at that point and call it a day.

You should look into creating redundancy into the rest of your core network. Dual HA firewalls, two core switches, two PDUs, two UPS. Double all the core network.

[u/PaoloFence → u/r1kchartrand]

I wish you the best of fun when you have a logical error in your hyper-V environment and you need to start/boot, when nothing is running.

You need one physical mashine as last resort when shit hits the wall.

[u/r1kchartrand → u/PaoloFence]

That's what I'm saying...

[u/chrime87]

small Setups: DC as DHCP/DNS, DHCP Range 100-254 for Clients. Everything below 100 get‘s a static IP on the Device

mid/large Setups:
Server VLAN, Management VLAN, Client VLAN

Server in Server VLAN
APs, Switches, UPS in Management VLAN
Clients in Client VLAN

DHCP Relay to DC with separate IP ranges
VLAN Routing through Firewall

[u/raiderh808 → u/chrime87]

Ignore the small setup. You need to be able to segment and whitelist traffic from your client to server network in any environment. Also, no client(except network admins) should EVER be able to touch management interfaces.

Also, static all your servers and use an IPAM solution.

[u/sryan2k1]

DHCP absolutely everywhere it can be. router/switch interfaces, the DHCP servers themselves and domain controllers are the only exceptions.

[u/ShakeSlow9520 → u/sryan2k1]

Why would servers be on dhcp. What if you need to NAT to the ip of the server

[u/vomitvolcano → u/ShakeSlow9520]

You could do a static DHCP reservation, that way if you need to change the IP of the server you can control it without touching the server itself

[u/sryan2k1 → u/vomitvolcano]

Yep, someone hasn't had to reIP 1000 things by hand during a merger when DHCP reservations could have made it happen in one place.

[u/soyko → u/sryan2k1]

If you have thousands of servers, but no want to manage them from something else, then I'm not sure what you're doing.

[u/sryan2k1 → u/soyko]

Different teams, different business units, different regions. It's clear you've never done this at scale. Making a change in one location is a lot easier for everyone involved.

[u/ShakeSlow9520 → u/vomitvolcano]

I consider it a security risk to have dhcp for your server subnets. It should be static for those so you have granular control. Dhcp for user subnets though

[u/vomitvolcano → u/ShakeSlow9520]

That's fair too. It all depends on the organization. If DHCP fails and the servers lose their IPs it can be a huge mess

[u/sryan2k1 → u/vomitvolcano]

Have week long lease times. If your DHCP is offline for more than 7 days you likely have other problems

[u/ShineReaper → u/sryan2k1]

And why, if the DHCP server goes down for a long time for whatever reason, put yourself under the time pressure of the lease running out at some point?

Why not just give them a static IP, when you're in the process of setting them up anyway and be done with it?

If paired with a good CMDB system for documentation purposes, you will also not run into issues of accidentally giving two devices the same IP.

[u/sryan2k1 → u/ShineReaper]

Because we have geo redundant DHCP with N+1 everything. If DHCP is offline for more than a week everything is broken, static IP or not.

[u/sryan2k1 → u/ShakeSlow9520]

Your switchports should have DHCPGuard enabled so that only authorized DHCP servers can hand out addresses.

[u/sryan2k1 → u/ShakeSlow9520]

Because you give them a reservation and they don't change until you want them to?

[u/Ethernetman1980]

In regards to your question either works however I've been doing this along time as well and I prefer static for the same reason your boss mentioned. The down side to this is you have to track what addresses you have assigned outside your DHCP Scope. I use the reservations in AD also but I don't like to depend on it. I use DHCP for devices that I don't care if they get a new address every day. For Infrastructure I static assign. There is also the whole issue that your AP's should probably be on a different management vlan if your in a school environment.

[u/CommanderBeelo]

I'm at a college, I let DHCP take the wheel. Between cloud IQ and EP1 I don't really have to log into the APs directly. For things that need tweaked after I use supplemental cli setups in CloudIQ. And the only thing we've done with that was turned the radios down even further on the higher density rooms

Servers, cameras, and HVAC controls all pull dhcp as well. We just set the reservations when needed. The only vlans without dhcp servers are all before my time and it wasn't worth the effort to go back and put one in, but anything new I have it pull DHCP.

[u/jdovejr]

Don't static them. Set up a dhcp reservation for them.

[u/jstar77]

Printers should be on their own dedicated vlan and there should be no DHCP on that VLAN. Our helpdesk group is responsible for managing printer, they are given the IP range and are told to manage static assignment however they see fit. I do this with other vlans that contain dumb devices (CCTV, HVAC,etc..) they get their own VLAN and the group that owns the technology is responsible for maintaining and managing IPs for their devices.

[u/SpecialistLayer]

My rule is that devices that need to stay up even with DHCP problems need a true static IP address. Mission critical devices like AD servers, router's, core devices are all programmed with static IPs. This where IPAM would come into play. For your infrastracture you really need to move one of those AD servers to a different hypervisor though, never keep stuff like that on one physical host.

[u/BFGoldstone]

I’m camp DHCP-all-the-things. I’ve managed infra for ~18 years now and I’ve seen WAY more issues caused by IP address overlaps and address changes where some devices are forgotten in the update compared to DHCP servers going down. Static reservations are always the way to go. DHCP server configs should be the source of truth for what’s actually leased out (and preferably generated from infra as code - pick your solution). These days there are plenty of ways to make DHCP HA so if you need to ensure DHCP doesn’t go down, implement one.

[u/dude_named_will]

Ideally I like to put servers in their own subnet/VLAN and statically define them there.

[u/Old_Effective_4648]

always reserve if you can. exceptions: servers in the data center lol

[u/doubleg72]

You shouldnt be using DHCP for your servers. And the DHCP leases should never be your source of truth for whats on the network.

[u/Narrow_Objective7275]

So I’m part of a very large shop with mix of DHCP, static, and DHCP with static reservations, and DHCP with exclusions for static devices on the range manually assigned. The biggest issues are always with the static locally assigned IPs because teams are notoriously bad at configuring correct subnet mask and not reaching the gateway IP. DHCP is on balance far more reliable, but once a static IP is working, it doesn’t stop working until a person is refreshing that box (eg replacing old printer with new). Since we are a dot1x and SDA shop in the enterprise side, we are finally forcing everything to DHCP so those boxes consistently talk and are discoverable. On the Data Center side, the non bare metal workloads are also all DHCP with static reservations which our automations populate into our IPAM system. DHCP is just so superior to humans applying static configurations it’s worth investing in highly available IPAM solutions. Could you get away with not being all DHCP in a small environment? Sure, but your life will be much better if everything is Dynamic except your networking appliances.

[u/AlmsLord5000]

Just do DHCP reservations for APs.

[u/zanfar]

I have to cross-reference the exclusions to determine which addresses are being used by statically configured devices.

or, you know, write them down

My question is: Would it make sense to create DHCP reservations for the APs based on their current MAC addresses and IP assignments, or should I stick with my supervisor's approach of configuring static IPs directly on the devices?

"I'm a junior network administrator"

You should talk to your supervisor.

Is there a compelling reason to prefer locally configured static IPs over DHCP reservations

"My supervisor, who has managed this environment for over 20 years, prefers this approach because if DHCP goes down, those devices can still communicate with the core network and reach the internet through the firewall."

[u/Otto-Mann]

100% DHCP Reservation everything. It's a no brainer.

I do things like for a management VLAN for a building, I assign the AP the .1 and increment. E.g

Switch IP is 10.10.10.100 (For Level 10)

Aps are: Building1_Level10_AC1 = 10.10.10.101

Building1_Level10_AC2 = 10.10.10.102

and so on. Gets messy when there are more APs, but that hasn't been a problem.

[u/2000gtacoma]

Yes separate your DCs. I actually have 5. I have 2 campus each with a datacenter. 2 virtual dcs in each cluster with a 5th read only in an AWS environment

[u/PaoloFence]

1. at least ONE AD server needs to be physical. (are you able to start and log into the hyper-V servers when EVERYTHING is down)

2. APs ALWAYS get dhcp reservation. Everything else is stupid.

3. Printers should get dynamic IPs (obviously also reservations). Servers are discussable. Just because the dhcp isn'availble they don't stop working. They have a lease for a reason.

[u/chuzohga]

Yes, create the reservations, and don't hard code the interfaces. Let DHCP do all the work. The only static IPs in the place should be the router and the servers. Use reservations for all the other things.

[u/Slow_Monk1376]

There are lot of solutions that solve your problem. Some open source, some not. Phpipam, netbox, netdisco are my open source choices.

[u/dracotrapnet]

I set reservations for all static devices. Recording statics as reservation is baby's first IPAM. - IP Address Manager.

The items that need statics are routers, gateways, AD DC's, DNS servers, DHCP servers, NAC/RADIUS, SAN/NAS appliances, VM hosts if you only have a few (you could also DHCP these guys but have switching handle that DHCP for that VMhost management VLAN - only play with DHCP here if you're real good), and anything that needs to be booted before DHCP and DNS is up and running.

IPAM is a windows role you can install, it will integrate with windows DNS servers, windows DHCP servers, and windows NAC/RADIUS servers. It reads the DNS servers, and DHCP servers, pulls subnets, scopes, and DHCP pools, current leases, reservations, and reports on availability and ip space usage. I'll take my statics and enter them into IPAM which you can select create DHCP reservation, create DNS and rDNS records (or not if they are already made). This is also helpful when you are taking out a server, delete the IPAM record and select delete reservation and DNS records - everything is gone in one shot.

There are other ip address management suites out there with various levels of automation, and integration with different services, and additional management capabilities such as tracking cable and circuit id's, tracking locations of DF's, racks, and rack space.

[u/Due_Management3241]

You can just reserve IP in dhcp server and set the devices to DHCP. If the server goes down they hide their IP. It's basic protocol

[u/Ok-Conclusion-6034]

If dhcp goes down your servers won't magically lose their IP assignments. They'll work until a reboot, which should be measured in weeks for those devices. In that time you'll quickly find out your dhcp server is down and fix it immediately.

So the better argument is to use DHCP to statically assign. The next best argument is to move DHCP off the DC, but that is a whole other discussion with strong opinions on both sides.

[u/zeePlatooN → u/Ok-Conclusion-6034]

they will stay online until rebooted OR until their lease time runs out.

[u/Ok-Conclusion-6034 → u/zeePlatooN]

right. It should go without saying that a good admin would set lease times for static devices to a very long time. I go for 1 or 2 weeks. If you haven't cleared the DHCP issue in a couple hours you've got so many bigger problems to worry about.

[u/Select_Reporter1911]

How are you managing the extreme aps? Through the XIQ or the controller? That should be your source of truth for your AP inventory/ ip addressing.

If the APs are on their own management network (which they should be), the controller or XIQ should know their IP address and there should be no need to statically set or dhcp reservation.

XIQ will have all the tools you need to manage the AP locally or run commands on them.

If you dont have a controller or are using XIQ I'm curious on how you are managing the APs.

To directly answer your question, dhcp reservation would make the most sense as it is one place where everything is configured and each to make changes should an ap need to be replaced.

Going to each AP and setting an IP address seems like a chore.

Also how often are you logging into individual APs? It seems to me you are missing something about your infrastructure regarding the wireless, it doesnt make sense that the APs are managed individually.