11.2 DHCP Scopes, Option Hierarchy, Reservations & Relay Agents

DHCP Scopes, Option Hierarchy, Reservations & Relay Agents

1. DHCP Scopes, Address Pools, Exclusions & Lease Durations

A DHCP Scope is an administrative grouping of IP addresses on a specific physical or logical subnet that the DHCP server can lease to clients.

+-----------------------------------------------------------------------------+
|                        DHCP SCOPE ADDRESS ALLOCATION                        |
|                                                                             |
|   SUBNET: 10.10.1.0/24 (Total: 10.10.1.1 - 10.10.1.254)                     |
|                                                                             |
|   [10.10.1.1 - 10.10.1.20]  --> EXCLUSION RANGE (Routers, Switches, Static) |
|   [10.10.1.21 - 10.10.1.200]--> ACTIVE ADDRESS POOL (Dynamic Leases)        |
|   [10.10.1.201 - 10.10.1.220]-> RESERVATION RANGE (Printers, Scanners)      |
|   [10.10.1.221 - 10.10.1.254]-> EXCLUSION RANGE (Servers, Out-of-Band Mgmt) |
+-----------------------------------------------------------------------------+

Core Scope Components:

1. Address Pool Range: The continuous block of IPv4 addresses defined by start and end IPs (e.g., 10.10.1.1 to 10.10.1.254) and subnet mask (255.255.255.0).
2. Exclusion Ranges: Specific IP subsets within the address pool that the DHCP server will never lease dynamically. Exclusions protect statically configured assets such as default gateways, core switches, and domain controllers from IP conflicts.
3. Conflict Detection Attempts: Configured via Set-DhcpServerSetting -ConflictDetectionAttempts <0-5>. Before offering an IP address, the DHCP server transmits ICMP Echo (ping) requests. If an echo reply comes back, the server flags the IP as BAD_ADDRESS and offers a different IP. (Default is 0, which disables the check; Microsoft advises keeping it at 3 or less because each attempt delays the offer — see section 11.5).
4. Lease Duration Best Practices:
   • Wired Desktop LANs (Default 8 Days): Stable environments with low device turnover benefit from longer leases, minimizing broadcast renewal traffic.
   • Wireless / Guest / BYOD Networks (4 to 8 Hours): Mobile devices connect and disconnect rapidly. Short lease durations ensure addresses are recycled quickly to prevent address pool exhaustion.
   • High-Churn VDI / Lab Environments (30 to 60 Minutes): Ephemeral virtual machines spin up and destroy frequently; short leases reclaim IP addresses near-instantaneously.

# Create a new IPv4 Scope with 8-day lease duration
Add-DhcpServerv4Scope `
    -ComputerName 'dhcp01.corp.contoso.com' `
    -Name 'Workstation-Subnet' `
    -StartRange 10.10.1.1 `
    -EndRange 10.10.1.254 `
    -SubnetMask 255.255.255.0 `
    -LeaseDuration (New-TimeSpan -Days 8) `
    -State Active

# Add an Exclusion Range for network infrastructure
Add-DhcpServerv4ExclusionRange `
    -ComputerName 'dhcp01.corp.contoso.com' `
    -ScopeId 10.10.1.0 `
    -StartRange 10.10.1.1 `
    -EndRange 10.10.1.20

---

2. DHCP Option Hierarchy & Core Options

DHCP Options deliver supplementary network configuration parameters to clients during the DORA exchange. Windows Server enforces a strict four-tier precedence hierarchy when conflicting options are defined.

+-----------------------------------------------------------------------------+
|                     DHCP OPTION PRECEDENCE HIERARCHY                        |
|                                                                             |
|   [1. RESERVED CLIENT OPTIONS]  (HIGHEST PRECEDENCE - Overrides all below)   |
|               |                                                             |
|               v                                                             |
|   [2. CLASS OPTIONS]            (User Class / Vendor Class Matches)         |
|               |                                                             |
|               v                                                             |
|   [3. SCOPE OPTIONS]            (Specific to all clients in a given scope)  |
|               |                                                             |
|               v                                                             |
|   [4. SERVER OPTIONS]           (LOWEST PRECEDENCE - Global server defaults)|
+-----------------------------------------------------------------------------+

Precedence Hierarchy Explained:

1. Reserved Client Options (Level 1): Applied directly to an individual IP reservation. Overrides all class, scope, and server options.
2. Class Options (Level 2): Applied conditionally based on client identification:
   • Vendor Class (Option 60): Matches hardware vendors (e.g., Cisco VoIP phones, Hewlett-Packard JetDirect printers).
   • User Class (Option 77): Matches custom user-defined flags assigned on clients via ipconfig /setclassid.
3. Scope Options (Level 3): Applied to all clients leasing from a specific scope (e.g., Option 003 Router unique to that subnet).
4. Server Options (Level 4): Global defaults applied across all scopes hosted on the DHCP server (e.g., Option 006 DNS Servers or Option 015 DNS Domain Name).

Critical Standard DHCP Options:

# Configure Server-Level (Global) DNS Options
Set-DhcpServerv4OptionValue `
    -ComputerName 'dhcp01.corp.contoso.com' `
    -DnsServer 10.10.1.4, 10.10.1.5 `
    -DnsDomain 'corp.contoso.com'

# Configure Scope-Level Default Gateway
Set-DhcpServerv4OptionValue `
    -ComputerName 'dhcp01.corp.contoso.com' `
    -ScopeId 10.10.1.0 `
    -OptionId 3 `
    -Value 10.10.1.1

---

3. IP Reservations & Policy-Based Assignment

An IP Reservation guarantees that a specific network interface permanently receives the same IPv4 address from the DHCP pool while continuing to receive dynamic option updates (such as updated DNS servers or gateways).

• MAC Address Binding: Reservations bind a 48-bit physical MAC address (or Client UID) to a fixed IP within the scope's range.
• Supported Types: Reservations can be configured for DHCP only, BOOTP only, or Both (default).
• DHCP Policies: Windows Server supports Policy-Based Assignment (PBA), allowing administrators to group clients by MAC address prefix (OUI), Vendor Class, User Class, or Client FQDN to assign dedicated IP sub-ranges and specialized options automatically.

# Create a fixed reservation for a network printer
Add-DhcpServerv4Reservation `
    -ComputerName 'dhcp01.corp.contoso.com' `
    -ScopeId 10.10.1.0 `
    -IPAddress 10.10.1.205 `
    -ClientId '00-15-5D-AA-BB-CC' `
    -Name 'PRINTER-HQ-FLOOR2' `
    -Description 'Floor 2 Color Laser MFP' `
    -Type Both

# Create a DHCP Policy for Cisco IP Phones using Vendor Class Identifier
Add-DhcpServerv4Policy `
    -ComputerName 'dhcp01.corp.contoso.com' `
    -ScopeId 10.10.1.0 `
    -Name 'VoIP-Phone-Policy' `
    -Condition OR `
    -VendorClass EQ 'Cisco-IP-Phone*'

---

4. Advanced Scopes: Superscopes & Multicast Scopes (MADCAP)

Superscopes:

A Superscope is an administrative container that groups multiple independent member scopes on a single physical subnet. Superscopes solve capacity exhaustion when a physical broadcast domain runs out of IP addresses and cannot be immediately re-subnetted or re-VLANed.

• Operational Behavior: When the primary member scope in a superscope reaches 100% address allocation, the DHCP server automatically begins leasing addresses from the secondary member scope to newly connecting clients on that same physical wire.
• Routing Requirement: The local default gateway router must support secondary IP addressing on its physical interface to route traffic between the multiple logical subnets sharing the wire.

Multicast Scopes (MADCAP):

• Windows Server DHCP supports the Multicast Address Dynamic Client Allocation Protocol (MADCAP) defined in RFC 2730.
• Manages dynamic leasing of Class D IPv4 addresses (224.0.0.0 to 239.255.255.255), typically within the administratively scoped multicast range (239.0.0.0/8).
• Used by streaming media services, video conferencing servers, and distributed ghost imaging systems. Multicast leases operate independently of standard unicast scopes and default to a 30-day lease duration.

---

5. DHCP Relay Agents & IP Helper Across Routed Boundaries

Because DHCPDISCOVER and DHCPREQUEST frames are Layer 2 broadcasts (255.255.255.255), standard Layer 3 routers drop them at the subnet boundary. Servicing multiple routed subnets from a centralized DHCP server requires DHCP Relay Agents (RFC 1542 / BOOTP Forwarders) or router IP Helper addresses.

+-----------------------------------------------------------------------------+
|                  DHCP RELAY AGENT & IP HELPER ROUTING FLOW                  |
|                                                                             |
|   [CLIENT: Subnet 10.10.2.0/24]               [DHCP SERVER: 10.10.1.10]     |
|   +--------------------------+                +--------------------------+  |
|   | Client MAC: 00-15-5D...  |                | Scope A: 10.10.1.0/24    |  |
|   | Broadcasts DHCPDISCOVER  |                | Scope B: 10.10.2.0/24    |  |
|   +--------------------------+                +--------------------------+  |
|                |                                            ^               |
|                | (Layer 2 Broadcast)                        | (Unicast)     |
|                v                                            |               |
|   +------------------------------------------------------+  |               |
|   | ROUTER / LAYER 3 SWITCH INTERFACE: 10.10.2.1         |  |               |
|   | - Intercepts UDP 67 broadcast                        |  |               |
|   | - Sets 'giaddr' (Gateway IP) = 10.10.2.1             |  |               |
|   | - Unicasts packet to DHCP Server: 10.10.1.10 ======= | -+               |
|   +------------------------------------------------------+                  |
+-----------------------------------------------------------------------------+

The giaddr Field Mechanism:

1. The client broadcasts DHCPDISCOVER on its local subnet (10.10.2.0/24).
2. The Layer 3 switch/router interface receives the broadcast on UDP 67. The router's DHCP Relay Agent or ip helper-address 10.10.1.10 intercepts the packet.
3. The Relay Agent populates the giaddr (Gateway IP Address) field in the DHCP packet header with the IP address of the router interface on the client's subnet (10.10.2.1).
4. The Relay Agent encapsulates the packet into a unicast UDP packet and sends it across the routed network directly to the DHCP server (10.10.1.10).
5. The DHCP server inspects the giaddr field, matches 10.10.2.1 to its configured 10.10.2.0/24 scope, allocates an IP from Scope B, and unicasts the DHCPOFFER back to the Relay Agent, which relays it to the client.