Automating DHCP reservations at a U.S. government agency
BlueCat worked with a large U.S. government agency to bring automation to a task they perform over and over, all day long: DHCP reservations.
Read moreA DHCP reservation is a server-side configuration that binds a specific IP address to a client identifier (typically a MAC address), ensuring a device receives the same address on every DHCP request while keeping that address managed centrally and excluded from the dynamic lease pool. This approach enables organizations to assign fixed addresses to servers, printers, cameras, and network appliances without manual configuration on each device, centralizing address management and allowing updates like DNS or gateway changes to propagate automatically through lease renewal. However, operational risks arise from poor tracking, including address conflicts when reserved addresses fall within the dynamic range, stale entries for retired hardware, MAC address spoofing vulnerabilities, and failover issues in redundant server environments, all of which require careful IPAM practices and security controls to mitigate.
A reservation is a record stored on the DHCP server that links one client identifier to one IP address within a scope. The client still uses the normal DHCP exchange and is unaware that a reservation exists.
Reserved addresses are still leased, so lease times, options such as default gateway and DNS servers, and scope settings still apply. Many servers let a reservation carry its own options that override scope-level values. If the identifier changes, as when a network card is replaced, the device no longer matches and receives a pool address until the reservation is updated.
If a reserved address falls within the dynamic range and the server does not exclude it, another client may be offered it before the reserved device comes online. The result is an address conflict, often seen as intermittent connectivity loss on both devices.
A typo in the MAC address, or a device that sends a client ID option instead of using its hardware address, means the record never matches. The device receives an address from the pool and the reservation appears to be ignored.
Replacing a network card, a failed printer or a virtual machine with a regenerated MAC address leaves the old record in place. The new device gets a pool address while the reserved address sits unused until someone updates the record.
Two records that use the same IP address or the same identifier within or across scopes can cause rejected configuration or unpredictable assignments. This often occurs when reservations are entered by hand in several places without a central record.
If reservations are defined on only one server in a failover or split-scope pair, the partner server hands out pool addresses when it answers. Clients then change address after a failover event, and DNS or firewall rules tied to the old address stop working.