DHCP Relay Deep Dive and Clusters

Table of Contents

How do the IPs get into other network areas?

DHCP requests are usually sent as a broadcast, which means that the request reaches all participants in its (sub)net (also known as broadcast domain), but none for which a routing process would have to be started.

DHCP cannot communicate across a network boundary due to the broadcast. As soon as the client network and the DHCP server are separated from each other, no IPs can be assigned because the requests, the DHCP discover, do not reach the server. If you separate your networks with VLANs, for example, you have to consider something like that. A DHCP server can be implemented on the router that connects the networks, but this is an unclean solution.

The most elegant solution to the problem is a DHCP Relay Agent, or IP Helper as Cisco calls it. The IP helper then has the function of converting the incoming broadcast into a unicast and taking over the communication with the DHCP server. The DHCP relay is implemented at the outermost layer3 component.

Would you like professional & individual advice?
Test your IT now with a professional penetration test!
For the penetration test

How do I implement a DHCP relay?

DHCP Dynamic Host Configuration Protocol Relay

In the above example, the DHCP server is in network C and supplies it with IP addresses. The IPHelpers in network A and B take over the communication for the clients with the DHCP server.

The relay agent can also be implemented directly in the network, for example on a Windows server with routing and RAS services.

The DHCP server does not have to be directly connected to the router with the relay agent, but the network interface on which the IP Helper is running must be able to reach the DHCP server. So if there is a firewall in between, ports 67 and 68 UDP must also be opened. Of course you need a separate IP range for each network, otherwise the networks cannot communicate with each other.

resiliency

Since Windows Server 2012 it has been very easy to cluster several DHCP servers together, which means that two or more DHCP servers share 100% of the address space and distribute the leases (IP addresses) in the networks.

Each server in the cluster needs its own IP helper in the other networks. You can also enter a network broadcast address as a relay agent, but for this the cluster must be in the same network and the IP Helper must be able to send a broadcast into the network.

The cluster can be configured as a failover or load balancer. If the load balancing mode is selected, the percentage distribution of the IPs per server must be configured with . With the cluster, you don't have to configure a division of the DHCP range for two servers in the same network.

Improve the security of your IT system now!
You will receive detailed advice from us!
Contact us now

Summarized

  • IP Helper or Relay Agent serves as a "mediator" for the DHCP traffic.

  • Firewalls must allow relay traffic. The source IP changes in the packet, which is important to note when creating the rule.

  • In order to efficiently operate two or more DHCP servers in the same network, they should be clustered. Because the servers are no longer in the same network segment, communication takes a little longer and a potential attacker can respond faster with a rogue DHCP. Protective measures such as DHCP snooping should therefore be standard.

  • Up to a certain size or in special areas such as server networks, it is better to assign IPs statically than to use a DHCP server.
Newsletter Form

Become a Cyber ​​Security Insider

Get early access and exclusive content!


By signing up, you agree to receive occasional marketing emails from us.
Please accept the cookies at the bottom of this page to be able to submit the form!
OTHER CONTRIBUTIONS

Table of Contents

PSN_KU_Cover
NewsLetter Form Pop Up New

Become a Cyber ​​Security Insider

Subscribe to our knowledge base and get:

Early access to new blog posts
Exclusive content
Regular updates on industry trends and best practices


By signing up, you agree to receive occasional marketing emails from us.
Please accept the cookies at the bottom of this page to be able to submit the form!