Multiple Scopes on DHCP

[gmail2]

I've got a new 2003 server with IP adress 192.168.0.1, however this server will act as a DC for two different subnets - 192.168.0.0/24 and 192.168.1.0/24. I need to configure DHCP for both of these scopes (there's a firewall between the two and I've already configured DHCP relay on it) but I have two questions:
1. Should I create a superscope and put the two scopes in it? From what I can see, a superscope is for two logical subnets on the SAME physical subnet (which is not the case here). Or should I just create two scopes without the superscope?

2. How do I make sure that clients in the 192.168.0.0/24 subnet don't get served IP addresses from the 192.168.1.0 scope?

Thanks in advance for anyone that can help me out with this

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[InfrArch]

do you have your DC multihomed? If so, this is definitely not recommended.

Create 2 separate scopes.

DHCP will issue the correct ip for the remote client. The decision will be made based on the source IP. (which will be border router IP)



Victor K (Microsoft Consulting Services)
MCSA/MCSE:Security & Messaging;CNE;CCSE+;CIWSP;CIWSA;Network+;Security+;CCNA;nCSE;CISSP

 

[gmail2]

No, the server isn't multihomed - it has one IP address on the 192.168.0.0 subnet and then DHCP relay is configured on the firewall between the two subnets - so any DHCP broadcasts sent on the 192.168.1.0 subnet will be forwarded to the server's IP - but how will it know which scope to assign the IP address from?

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[InfrArch]

As I told before: The decision will be made based on the source IP. (which will be border router IP)



Victor K (Microsoft Consulting Services)
MCSA/MCSE:Security & Messaging;CNE;CCSE+;CIWSP;CIWSA;Network+;Security+;CCNA;nCSE;CISSP

 

[Davetoo]

I have seven scopes on one server, it works just as GENEnG has explained. The request for an IP comes through the requestors router, which determines which scope to assign from.



I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[gmail2]

OK, thanks for that, but what about the computers that are on the same physical and logical subnet as the server? What's to stop them getting IP addresses from the subnet which is intended for us on the other side of the firewall (ie 192.168.1.0)

Thanks again

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[Davetoo]

Because they're on the same subnet, they'll pull from the proper pool as well.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[gmail2]

OK, that's good enough for me !!
thanks

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[WhoKilledKenny]

To answer your question with a little more detail. DHCP broadcast "request for IP" will either be a Multicast or Unicast broadcast. I dont rember off hand if I'm 100% but if the broadcast is Unicast it is from the same subnet. If mutlicast its from another subnet and will have the subnet address in the packet. The info in the packet is the mechanism that allows DHCP to know which pool to assign an address from.

 

[gmail2]

That's for that WhoKilledKenny - just curious, do you mean if it's from the same subnet it's multicast, if it's from another subnet it's unicast?

Irish Poetry - Karen O'Connor
Get your Irish Poetry Published
Garten und Landschaftsbau

 

[Davetoo]

Hmmm...I don't think it's unicast vs multicast in this case...

http://www.nesc.ac.uk/talks/talks/MikeDaw_AccessGrid/multicast-intro.pdf

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[WhoKilledKenny]

Sorry guys, It's been a long time... didn't mean to confuse the subject.

As established in RFC 1542, the DHCP Relay Agent can forward the packet to an IP broadcast, multicast, or unicast address. In practice, DHCP Relay Agents forward DHCPDiscover messages to unicast IP addresses which correspond to DHCP servers.

So my point being, If DHCP sees that it is a unicast broadcast, it know the Discover is comming from a relay agent and the client is not on the same subnet (As the DHCP Server).