static dhcp assignment

How-To Geek

How to set up static dhcp so your computer's ip address doesn't change.

DHCP makes it simple to configure network access for your home network, and port forwarding makes it easy to those computers from anywhere.

Quick Links

The problem with dhcp and port forwarding, finding your mac address, dd-wrt and static dhcp.

DHCP makes it simple to configure network access for your home network, and port forwarding makes it easy to those computers from anywhere. By configuring static DHCP on your router, you can combine the best of both worlds.

DHCP is great. You configure your router to automatically assign IP addresses and the computers on your network just plain work. Port forwarding is useful because you can access your router from outside of your network and be redirected to the computer you need inside of your network. The problem is that these two wonderful things rely on one premise: your internal IP addresses don’t change. If your router changes the IP that is assigned to a machine by DHCP, then you have to reconfigure Port Forwarding. Many programs try to get around this fact by offering Universal Plug and Play (UPnP) port forwarding features, but not everything does.

Newer routers often have the ability to remember which IP address was assigned to which computer, so if they disconnect and reconnect their IP doesn’t change. Often, though, a router reset will wipe this cache and start assigning IPs on a first-come, first-served basis. Tons of older routers don’t even have this ability, and immediately assign new IP addresses. With IP addresses changing, you have to reconfigure your port forwarding settings often, otherwise you may lose the ability to connect to your home computers.

You can do this on plenty of modern routers, but we're going to use DD-WRT for this guide. We’ve touted DD-WRT’s ability many times before, and it’s not for nothing. This amazing custom router firmware has a solution to this mess: static DHCP, also known as DHCP reservation. While configuring your router for DHCP, you have the ability to enter the MAC addresses of your computers’ network cards and enter which IP address to assign them. DD-WRT will automatically take care of the rest! If you have a different router, you can try following along using your router's own admin page--the instructions should be somewhat similar.

The only real work you’ll have to do is find the MAC address of each computer’s attached networking card. If you’re using wireless then you should find the MAC of your wireless card, and if you’re wired then use the Ethernet card.

Just go down to the icon in your system tray for your connection and click it. Mine is wireless.

Right-click on your current active connection and click on Status.

Click on the “Details…” button.

Your MAC address for this device is listed as “Physical Address.”

OS X users can check under their System Settings and click on Network. If you click on the various tabs for your connection, you should find a “Physical ID,” “Ethernet ID,” or “MAC Address.” Ubuntu users can type “ifconfig” in Terminal. You’ll see various network adapters, each displaying its own hardware address. Do this for all of the computers in your network that you need port forwarding for. The others will just get their IPs assigned automatically by DHCP.

Now that you have a list of MAC addresses for each of your computers, open up a browser tab and head over to your router’s DD-WRT interface. Click on Setup, and under Basic Setup, make sure DHCP is turned on.

Scroll down to “Network Address Server Settings (DHCP)” and make a note of the starting IP address and the maximum number of users. The addresses you configure should fall within this range. Here, my range of IPs would be 192.168.1.100 – 192.168.1.114.

Now, click on the Services tab up top.

Under the DHCP Server section, you can see that there’s a list of “Static Leases” click on the Add button to add a new one.

Enter the MAC address of each computer, give each one a name so you know which is which, and then assign them an IP address. You won’t be able to add the same IP address to two different MAC address, so make sure each MAC has a unique IP. If your version of DD-WRT also has a space to enter the “Client Lease Time,” a safe setting would 24 hours, or 1440 minutes.

That’s it! Be sure to click on both the Save button and the Apply Settings button, and wait for the changes to take effect. The settings should automatically change when each computer’s lease expires, though you can reconnect from each computer if you want the changes to take effect immediately.

Now, whether your computer loses its connect, the router gets power cycled, or the DHCP lease expires, each computer you entered into the list will stick to its assigned IP. Furthermore, you won’t have to manually configure static IPs on each machine! Port forwarding won’t have to be a pain ever again.

Does your router support DHCP reservations? Do you have a more clever use for this system? Share your thoughts in the comments!

DHCP Static Binding on Cisco IOS

Lesson Contents

Cisco IOS devices can be configured as DHCP servers and it’s also possible to configure a static binding for certain hosts. This might sound easy but there’s a catch to it…in this lesson, I’ll show you how to configure this for a Cisco router and Windows 7 and Linux host. This is the topology I’ll be using:

The router called “DHCP” will be the DHCP server, R1, and the two computers will be DHCP clients. Everything is connected to a switch and we’ll use the 192.168.1.0 /24 subnet. The idea is to create a DHCP pool and use static bindings for the two computers and R1:

• R1: 192.168.1.100
• Windows 7: 192.168.1.110
• Linux: 192.168.1.120

First, we will create a new DHCP pool for the 192.168.1.0 /24 subnet:

Whenever a DHCP client sends a DHCP discover it will send its client identifier or MAC address. We can see this if we enable a debug on the DHCP server:

Cisco Router DHCP Client

Now we’ll configure R1 to request an IP address:

In a few seconds you will see the following message on the DHCP server:

When a Cisco router sends a DHCP Discover, message, it will include a client identifier to identify the device uniquely. We can use this value to configure a static binding, here’s what it looks like:

We create a new pool called “R1-STATIC” with the IP address we want to use for R1 and its client identifier. We’ll renew the IP address on R1 to see what happens:

Use the renew dhcp command or do a ‘shut’ and ‘no shut’ on the interface of R1 and you’ll see this on the DHCP server:

As you can see above the DHCP server uses the client identifier for the static binding and assigns IP address 192.168.1.100 to R1. If you don’t like these long numbers, you can also configure R1 to use the MAC address as the client identifier instead:

This tells the router to use the MAC address of its FastEthernet 0/0 interface as the client identifier. You’ll see this change on the DHCP server:

Of course, now we have to change the binding on the DHCP server to match the MAC address:

Do another release on R1:

And you’ll see that R1 gets its correct IP address from the DHCP server and is being identified with its MAC address:

So that’s how the Cisco router requests an IP address. Let’s look at the Windows 7 host now to see if there’s a difference.

Windows 7 DHCP Client

This is what you’ll find on the DHCP server:

Windows 7 uses its MAC address as the client identifier. We can verify this by looking at ipconfig:

That’s easy enough. We’ll create another static binding on the DHCP server so that our Windows 7 computer receives IP address 192.168.1.110:

Let’s verify our work:

This is what the debug on the DHCP server will tell us:

There you go, Windows 7 has received the correct IP address. Last but not least is our Linux computer, which acts a little differently.

Linux DHCP Client

Linux (Ubuntu), in my example, acts a little differently when it comes to DHCP client. Let me show you:

The DHCP server shows this:

We see the MAC address of the Linux server so we’ll create a static binding that matches this:

We’ll release the IP address on our Linux host:

Now take a good look at the debug:

That’s not good, even though we configured the client identifier, it’s not working. Let’s double-check the MAC address:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

• Learn any CCNA, CCNP and CCIE R&S Topic . Explained As Simple As Possible.
• Try for Just $1 . The Best Dollar You’ve Ever Spent on Your Cisco Career!
• Full Access to our 786 Lessons . More Lessons Added Every Week!
• Content created by Rene Molenaar (CCIE #41726)

671 Sign Ups in the last 30 days

Tags: DHCP , Network Services

Forum Replies

Thanks for the info Rene As always complete posts!

how to reserve a single ip for pc in router ? ?

That is exactly what this lesson is about…

I have some challenges with CCNA R&S lab about DHCP/DHCP relay.The lab number is 10.1.3.3 assuming that you have access to the new CCNA R&S oficial course… The lab has two clients, two intermediary routers and another router connected to the intermediary routers via serials. Intermediary router are R1 and R3, the central router is R2. To R2 are connected via Ethernet GIgabit interfaces a DNS Seriver and the ISP The lab tell me to do the R2 a dhcp server for the two PC’s connected to the intermediary routers R1 and R2 so they receive an IP… The challenge

Hi Catalin,

Your message wasn’t deleted but not approeved before, I do this manually because of spam. I think this example should help you:

https://networklessons.com/cisco/ccie-routing-switching/cisco-ios-dhcp-relay-agent

If not, let me know.

17 more replies! Ask a question or join the discussion by visiting our Community Forum

• Engineering Mathematics
• Discrete Mathematics
• Operating System
• Computer Networks
• Digital Logic and Design
• C Programming
• Data Structures
• Theory of Computation
• Compiler Design
• Computer Org and Architecture

Dynamic Host Configuration Protocol (DHCP)

• Dynamic NAT Configuration in Cisco
• Static NAT Configuration in Cisco
• How to Configure a Router to Use DHCP?
• Configuring OSPF Static Neighbors in Cisco
• Packet Tracer to Configure DHCP On a Wireless Router
• Steps of Configuring NAT for IP Address Conservation
• What is IPv6 Stateless Address Autoconfiguration ?
• Steps Involves in Cisco Router Configuration Backups
• What is My Internet Protocol (IP) Address?
• What is IPv6 Intra Site Automatic Tunnel Addressing Protocol (ISATAP)?
• Working of Dynamic Host Configuration Protocol
• How are variables scoped in C - Static or Dynamic?
• Introduction of Virtual Router Redundancy Protocol (VRRP) and its configuration
• How DHCP server dynamically assigns IP address to a host?
• Which Protocol Is Used to Automatically Assign IP Addresses to Hosts?
• DHCP Server Configuration in Cisco
• Difference between Static and Dynamic IP address
• Static vs Dynamic Load Balancing

Dynamic Host Configuration Protocol (DHCP) vs Static IP Assignment

The two different approaches of network configuration to manage IP addresses for devices are DHCP (Dynamic Host Configuration Protocol) and Static IP Assignment which you can use to configure computer networks and to assign IP addresses to devices on a network are the focus. A distinctive feature of DHCP is the automated assignment of IP addresses dynamically, while Static IPs do it the other way around, which means they do not assign fixed IP addresses manually. Being knowledgeable about the dissimilarities in methodologies is just like proficiency in network administration as meeting the unique needs of networking infrastructure.

Primary Terminologies

• Dynamic Host Configuration Protocol (DHCP): A network protocol that automates the allocation of IP address(es) to devices in a network and improves the IP address management processes.
• Static IP Assignment: Static IP addressing for gadgets and deployment of such addresses all over the network to avoid dynamic addressing sometimes.
• IP Address: It is a unique numeric code assigned to any device that is connected to a network which is used to communicate between the devices and to identify themselves.
• Network Management: The activity of controlling and maintaining IP address allocation and configuration.
• Configuration Complexity: The complexity and amount of labor that are involved in the task of IP address assignment within a network.
• Resource Usage: It is used to implement better IP address utilization, and IPv4 wasting is a possibility if not handled appropriately.
• Device Identification: To specifically characterize the devices according to their IP addresses allows effective network administration and resolving problems.
• IP Address Ownership: The system of IP addresses being either assigned temporarily by a DHCP (Dynamic Host Configuration Protocol) server or permanently assigned on the basis of the ownership of the separate devices.

Dynamic Host Configuration Protocol (DHCP) is a network protocol that enables automatic assignment of IP addresses (and other network configuring information) to devices being accessed on the network. The function of DHCP is to simplify IP address management processes as it allows the automatic allocation of addresses to devices when they connect to the network. In this merging of the IP address allocation makes the process more efficient and relieves you from the pain of assigning addresses manually to all devices.

Example: An office network provided with a DHCP server allot an IP address automatically to the new laptop joining the network. This intelligent allocation mechanism, the last device recognizes new onboarding process is easier.

Step-by-Step Process: DHCP

• The device communicated through the network.
• DHCP client transmits a data packet that is broadcast to receive an IP address.
• The DHCP server is subsequently given the address request and it gives an available IP address.
• The client signs off on the terms and inputs the IP address.
• DHCP server assigns IP to the client in addition to other config network information (subnet mask, default gateway, DNS servers, etc.)
• The client will be provided with the network prefix so that he can use it for network communication until the lease expires or the device disconnects from the network.

Static IP Assignment

DHCP is used to temporarily assign IP addresses while the static IP assignment is about the manual configuration of a dedicated IP for each device on the network. In contrast to the DHCP in which IP addresses change over time or sometimes differently, the static IP assignments make it possible to always use the same IP address for one device. Such a technique is employed in instances of network elements such as servers, printers, and other network infrastructure devices that require wire addresses.

Example: A network printer is assigned a static IP address just to ensure that its address does not change which it happens to be a very critical component because that is what enables other devices to communicate and collaborate with ease.

Step-by-Step Process: Static IP Assignment

• In network administration, a particular IP address is assigned by hand to a device.
• The device can now use this single fixed IP address to communicate with the network every time, providing reliability and predictability.

Dynamic Host Configuration Protocol (DHCP) vs Static IP Assignment – FAQs

What is the main difference between dhcp and static ip assignment.

DHCP provides dynamic IP address assignment, although Static IP Assignment requires implementing hard-coded static IP addresses for devices.

Which method offers more flexibility in IP address management?

DHCP provides simplicity and reliability in IP management while in case with the static IP address each machine gets the fixed and predictive IP address.

Is DHCP or Static IP Assignment better for large networks?

DHCP is common among larger networks since it can easily scale and has less complicated configuration.

Can DHCP and Static IP Assignment coexist in the same network?

Definitely, a network is always a collection of DHCP-assigned addresses and statically assigned addresses which are needed for particular devices on the network.

Do Static IP Assignments pose security risks?

Static IP Assignments is capable of affording more access to IP addresses usage and control, however, if not handled cautiously, it can expose machines to foreign IP addresses and other vulnerabilities.

Please Login to comment...

Similar reads, improve your coding skills with practice.

What kind of Experience do you want to share?

• Skip to content
• Skip to search
• Skip to footer

DHCP - Static Mapping

Available languages, download options.

• PDF (268.3 KB) View with Adobe Reader on a variety of devices

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Table Of Contents DHCP—Static Mapping Contents Information About DHCP—Static Mapping DHCP Database and DHCP Server How to Configure DHCP—Static Mapping Configuring the DHCP Server and the Text File URL Prerequisites Restrictions Examples Configuration Examples for DHCP—Static Mapping Configuring the DHCP Server and the Static-Binding File URL: Example Additional References Related Documents Standards MIBs RFCs Technical Assistance Command Reference debug ip dhcp server origin Glossary DHCP—Static Mapping The DHCP—Static Mapping feature enables assignment of static IP addresses without creating numerous host pools with manual bindings by using a customer-created text file that the DHCP server reads. The benefit of this feature is that it eliminates the need for a long configuration file and reduces the space required in NVRAM to maintain address pools. Feature History for the DHCP—Static Mapping Feature Release Modification 12.3(11)T This feature was introduced. 12.2(27)SBA This feature was integrated into Cisco IOS Release 12.2(27)SBA. Finding Support Information for Platforms and Cisco IOS Software Images Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn . You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear. Contents • Information About DHCP—Static Mapping • How to Configure DHCP—Static Mapping • Configuration Examples for DHCP—Static Mapping • Command Reference • Glossary Information About DHCP—Static Mapping To configure this feature, you should understand the following concept: • DHCP Database and DHCP Server DHCP Database and DHCP Server A DHCP database contains an external file that is configured by a DHCP server. The file contains the mappings between a client IP address and the hardware address. There are two types of bindings: manual bindings that are special address pools stored in NVRAM, and automatic bindings that are assigned from an address pool by the DHCP server. Automatic bindings are stored on a remote host called the database agent and are saved as text records for easy maintenance. Both manual and automatic bindings are static. The DHCP—Static Mapping feature enables the capability of reading the static bindings in a separate text file (similar in format to the DHCP database file) and configuring special pools to store bindings read from the files. The static-binding files are read when the existing database files are read, for example, when a router reloads or the service restarts. The files are read-only. The read automatic bindings are treated just like the manual bindings, in that they are: • Retained across DHCPRELEASEs from the clients. • Not timed out. • Deleted only upon deletion of the pool. • Provided appropriate exclusions for the contained addresses, which are created at the time of the read. Just like automatic bindings and manual bindings, the static bindings are also displayed by using the show ip dhcp binding static command. How to Configure DHCP—Static Mapping This section contains the following procedure: • Configuring the DHCP Server and the Text File URL (required) Configuring the DHCP Server and the Text File URL Perform this task to configure the DHCP server and text file URL. You will input your addresses in the text file, which is stored in the DHCP database for the DHCP server to read. There is no limit on the number of addresses or the number of address pools. The file format has the following elements: • IP address • Hardware type • Hardware address • Lease expiration Legal values are defined in the ARP section of the Dynamic Host Configuration Protocol , RFC 2131. There is also a special type ID that indicates that a field is a DHCP client identifier. A sample file is as follows: *time* January 21 2005 03:52 PM *version* 2 !IP address    Type      Hardware address               Lease expiration 2.0.0.4 /24         1            0090.bff6.081e                   Infinite 2.0.0.5 /28         id           00b7.0813.88f1.66 3.0.0.2 /21         1            0090.bff6.081d                  Infinite *end* If the subnet mask is not specified, a natural mask is assumed depending on the IP address. Prerequisites The administrator should create the static-binding text file in the correct format and configure the address pools before performing this task. Before editing the file, you must disable the DHCP server using the no service dhcp command. In the static-binding text file, there must be a space between the IP address and mask. Restrictions The bindings must not be deleted when a DHCPRELEASE is received or must not be timed out by the DHCP timer. The automatic bindings should be treated just like manual bindings created by using the ip dhcp pool command. SUMMARY STEPS 1. enable 2. configure terminal 3. ip dhcp pool name 4. origin file url 5. exit DETAILED STEPS   Command or Action Purpose Step 1  enable Example: Router> enable Enables privileged EXEC mode. • Enter your password if prompted. Step 2  configure terminal Example: Router# configure terminal Enters global configuration mode. Step 3  ip dhcp pool name Example: Router(config)# ip dhcp pool abcpool Assigns a name to a DHCP pool and enters DHCP configuration mode. Note If you have already configured the IP DHCP pool name using the ip dhcp pool command and the static file URL using the origin file command, you must perform a fresh read using the no service dhcp command and service dhcp command. Step 4  origin file url Example: Router(dhcp-config)# origin file tftp://10.1.0.1/static-bindings Specifies the URL from which the DHCP server can locate the text file. Step 5  exit Example: Router(dhcp-config)# exit Exits to global configuration mode. Examples The following example shows what has been configured: Router# show ip dhcp binding 00:05:14:%SYS-5-CONFIG_I: Configured from console by console Bindings from all pools not associated with VRF: IP address  Client-ID/            Ls expir   Type    Hw address           User name 10.9.9.4/8  0063.7363.2d30.3036.  Infinite   Static  302e.3762.2e39.3634. 632d.4574.8892. 10.9.9.1/24 0063.6973.636f.2d30.  Infinite   Static  3036.302e.3437.3165. 2e64.6462.342d. The following sample shows each entry in the static-binding text file: *time* January 21 2005 22:52 PM !IP address Type        Hardware address                              Lease expiration 10.19.9.1 /24    id          0063.6973.636f.2d30.3036.302e.3437 10.9.9.4        id          0063.7363.2d30.3036.302e.3762.2e39.3634.632d  Infinite *end* The following sample debug output shows the reading of the bindings from the TFTP server: Router# debug ip dhcp server Loading abc/static_pool from 10.19.192.33 (via Ethernet0): [OK - 333 bytes] *May 26 23:14:21.259: DHCPD: contacting agent tftp://10.19.192.33/abc/static_pool (attempt 0) *May 26 23:14:21.467: DHCPD: agent tftp://10.19.192.33/abc/static_pool is responding. *May 26 23:14:21.467: DHCPD: IFS is ready. *May 26 23:14:21.467: DHCPD: reading bindings from                              tftp://10.19.192.33/abc/static_pool. *May 26 23:14:21.707: DHCPD: read 333 / 1024 bytes. *May 26 23:14:21.707: DHCPD: parsing text line *time* Apr 22 2002 11:31 AM *May 26 23:14:21.707: DHCPD: parsing text line "" *May 26 23:14:21.707: DHCPD: parsing text line !IP address Type Hardware address Lease expiration *May 26 23:14:21.707: DHCPD: parsing text line "10.9.9.1 /24 id 0063.6973.636f.2d30.3036.302e.3437" *May 26 23:14:21.707: DHCPD: creating binding for 10.9.9.1 *May 26 23:14:21.707: DHCPD: Adding binding to radix tree (10.9.9.1) *May 26 23:14:21.707: DHCPD: Adding binding to hash tree *May 26 23:14:21.707: DHCPD: parsing text line "10.9.9.4 id 0063.7363.2d30.3036.302e.3762.2e39.3634.632d" *May 26 23:14:21.711: DHCPD: creating binding for 10.9.9.4 *May 26 23:14:21.711: DHCPD: Adding binding to radix tree (10.9.9.4) *May 26 23:14:21.711: DHCPD: Adding binding to hash tree *May 26 23:14:21.711: DHCPD: parsing text line "Infinite" *May 26 23:14:21.711: DHCPD: parsing text line "" *May 26 23:14:21.711: DHCPD: parsing text line !IP address Interface-index Lease expiration VRF *May 26 23:14:21.711: DHCPD: parsing text line "*end*" *May 26 23:14:21.711: DHCPD: read static bindings from tftp://10.19.192.33/abcemp/static_pool. Configuration Examples for DHCP—Static Mapping This section contains the following configuration example: • Configuring the DHCP Server and the Static-Binding File URL: Example Configuring the DHCP Server and the Static-Binding File URL: Example The following example shows how to restart the DHCP server, configure the pool, and specify the URL at which the static-binding file is stored: no service dhcp service dhcp ip dhcp pool abcpool  origin file tftp://10.1.0.1/staticfilename Additional References The following sections provide references related to the DHCP—Static Mapping feature. Related Documents Related Topic Document Title DHCP overview and configuration Cisco IOS IP Configuration Guide , Release 12.3 DHCP commands: complete command syntax, command mode, defaults, usage guidelines, and examples Cisco IOS IP Command Reference, Volume 1 of 4: Addressing and Services , Release 12.3 T Standards Standards Title No new or modified standards are supported by this feature, and support for existing standards has not been modified by this feature. — MIBs MIBs MIBs Link No new or modified MIBs are supported by this feature, and support for existing MIBs has not been modified by this feature. To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL: http://www.cisco.com/go/mibs RFCs RFCs Title RFC 2131 Dynamic Host Configuration Protocol Technical Assistance Description Link Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content. http://www.cisco.com/public/support/tac/home.shtml Command Reference This section documents modified commands only. • debug ip dhcp server • origin debug ip dhcp server To enable Cisco IOS Dynamic Host Configuration Protocol (DHCP) server debugging, use the debug ip dhcp server command in privileged EXEC mode. To disable DHCP server debugging, use the no form of this command. debug ip dhcp server { events | packets | linkage | class } no debug ip dhcp server { events | packets | linkage | class } Syntax Description events Reports server events, such as address assignments and database updates. packets Decodes DHCP receptions and transmissions. linkage Displays database linkage information, such as parent-child relationships in a radix tree. class Displays DHCP class-based information. Command Modes Privileged EXEC Command History Release Modification 12.0(1)T This command was introduced. 12.2(13)ZH The class keyword was added. 12.3(4)T This command was integrated into Cisco IOS Release 12.3(4)T. 12.3(8)YA This command was integrated into Cisco IOS Release 12.3(8)YA. 12.3(11)T The output was enhanced to show the static mappings. 12.2(27)SBA This command was integrated into Cisco IOS Release 12.2(27)SBA. Examples The following example shows a combination of DHCP server events and decoded receptions and transmissions: Router# debug ip dhcp server events Router# debug ip dhcp server packets DHCPD:DHCPDISCOVER received from client 0b07.1134.a029 through relay 10.1.0.253. DHCPD:assigned IP address 10.1.0.3 to client 0b07.1134.a029. DHCPD:Sending DHCPOFFER to client 0b07.1134.a029 (10.1.0.3). DHCPD:unicasting BOOTREPLY for client 0b07.1134.a029 to relay 10.1.0.253. DHCPD:DHCPREQUEST received from client 0b07.1134.a029. DHCPD:Sending DHCPACK to client 0b07.1134.a029 (10.1.0.3). DHCPD:unicasting BOOTREPLY for client 0b07.1134.a029 to relay 10.1.0.253. DHCPD:checking for expired leases. The following example shows database linkage information: Router# debug ip dhcp server linkage DHCPD:child pool:10.1.0.0 / 255.255.0.0 (subnet10.1) DHCPD:parent pool:10.0.0.0 / 255.0.0.0 (net10) DHCPD:child pool:10.0.0.0 / 255.0.0.0 (net10) DHCPD:pool (net10) has no parent. DHCPD:child pool:10.1.0.0 / 255.255.0.0 (subnet10.1) DHCPD:parent pool:10.0.0.0 / 255.0.0.0 (net10) DHCPD:child pool:10.0.0.0 / 255.0.0.0 (net10) DHCPD:pool (net10) has no parent. The following example shows when a DHCP class is removed: Router# debug ip dhcp server class DHCPD:deleting class CLASS1 The following example shows the debug output when the configured pattern does not match: Router# debug ip dhcp server class DHCPD:Searching for a match to 'relay-information 0106000 400020202020800060009e80b8800' in class CLASS1 DHCPD:Searching for a match to 'relay-information 0106000400020202020800060009e80b8800' in class CLASS1 DHCPD:Searching for a match to 'relay-information 0106000 The following example shows the debug output when you unconfigure a DHCP pattern in a DHCP class and then configure the pattern in the DHCP class: Router# debug ip dhcp server class DHCPD:pattern 'relay-information 123456' removed from class CLASS1 DHCPD:Added pattern 'relay-information 010600040002020202 0800060009e80b8800' for class CLASS1 The following example shows the debug output when the configured pattern does match: Router# debug ip dhcp server class DHCPD:Searching for a match to 'relay-information 0106000 400020202020800060009e80b8800' in class CLASS1 DHCPD:input pattern 'relay-information 010600040002020202 0800060009e80b8800' matches class CLASS1 DHCPD:input matches class CLASS1 The following example shows the debug output when static mappings are configured: Router# debug ip dhcp server Loading abc/static_pool from 10.19.192.33 (via Ethernet0): ! [OK - 333 bytes] *May 26 23:14:21.259: DHCPD: contacting agent tftp://10.19.192.33/abc/static_pool (attempt 0) *May 26 23:14:21.467: DHCPD: agent tftp://10.19.192.33/abc/static_pool is responding. *May 26 23:14:21.467: DHCPD: IFS is ready. *May 26 23:14:21.467: DHCPD: reading bindings from                              tftp://10.19.192.33/abc/static_pool. *May 26 23:14:21.707: DHCPD: read 333 / 1024 bytes. *May 26 23:14:21.707: DHCPD: parsing text line "*time* Apr 22 2002 11:31 AM" *May 26 23:14:21.707: DHCPD: parsing text line "" *May 26 23:14:21.707: DHCPD: parsing text line !IP address Type Hardware address Lease expiration. *May 26 23:14:21.707: DHCPD: parsing text line "10.9.9.1/24 id 0063.6973.636f.2d30.3036.302e.3437" *May 26 23:14:21.707: DHCPD: creating binding for 10.9.9.1 *May 26 23:14:21.707: DHCPD: Adding binding to radix tree (10.9.9.1) *May 26 23:14:21.707: DHCPD: Adding binding to hash tree *May 26 23:14:21.707: DHCPD: parsing text line "10.9.9.4 id 0063.7363.2d30.3036.302e.3762.2e39.3634.632d" *May 26 23:14:21.711: DHCPD: creating binding for 10.9.9.4 *May 26 23:14:21.711: DHCPD: Adding binding to radix tree (10.9.9.4) *May 26 23:14:21.711: DHCPD: Adding binding to hash tree *May 26 23:14:21.711: DHCPD: parsing text line "Infinite" *May 26 23:14:21.711: DHCPD: parsing text line "" *May 26 23:14:21.711: DHCPD: parsing text line !IP address Interface-index Lease expiration VRF. *May 26 23:14:21.711: DHCPD: parsing text line "*end*" *May 26 23:14:21.711: DHCPD: read static bindings from tftp://10.19.192.33/smith/static_pool. Related Commands Command Description debug dhcp Displays debugging information about the DHCP client and monitors the status of DHCP packets. debug ip ddns update Enables debugging for DDNS updates. host (host-list) Specifies a list of hosts that will receive DDNS updates of A and PTR RRs. ip ddns update hostname Enables a host to be used for DDNS updates of A and PTR RRs. ip ddns update method Specifies a method of DDNS updates of A and PTR RRs and the maximum interval between the updates. ip dhcp client update dns Enables DDNS updates of A RRs using the same hostname passed in the hostname and FQDN options by a client on an interface. ip dhcp-client update dns Enables DDNS updates of A RRs using the same hostname passed in the hostname and FQDN options by a client. ip dhcp update dns Enables DDNS updates of A and PTR RRs for most address pools. ip host-list Specifies a list of hosts that will receive DDNS updates of A and PTR RRs. show ip ddns update Displays information about the DDNS updates. show ip ddns update method Displays information about the DDNS update method. show ip dhcp server pool Displays DHCP server pool statistics. show ip host-list Displays the assigned hosts in a list. update dns Dynamically updates a DNS with A and PTR RRs for some address pools. origin To configure an address pool as an on-demand address pool (ODAP) or static mapping pool, use the origin command in DHCP pool configuration mode. To disable the ODAP, use the no form of this command. origin { dhcp | aaa | ipcp | file url } [ subnet size initial size [ autogrow size ]] no origin { dhcp | aaa | ipcp | file url } [ subnet size initial size [ autogrow size ]] Syntax Description dhcp Specifies the Dynamic Host Configuration Protocol (DHCP) as the subnet allocation protocol. aaa Specifies authentication, authorization, and accounting (AAA) as the subnet allocation protocol. ipcp Specifies the IP Control Protocol (IPCP) as the subnet allocation protocol. file url Specifies the external database file that contains the static bindings assigned by the DHCP server. The url argument specifies the location of the external database file. subnet size initial size (Optional) Specifies the initial size of the first requested subnet. You can enter size as either the subnet mask (nnnn.nnnn.nnnn.nnnn) or prefix size (/nn). The valid values are /0 and /4 to /30. autogrow size (Optional) Specifies that the pool can grow incrementally. The size argument is the size of the requested subnets when the pool requests additional subnets (upon detection of high utilization). You can enter size as either the subnet mask (nnnn.nnnn.nnnn.nnnn) or prefix size (/nn). The valid values are /0 and /4 to /30. Defaults The default size value is /0. Command Modes DHCP pool configuration Command History Release Modification 12.2(8)T This command was introduced. 12.3(11)T The file keyword was added. 12.2(27)SBA This command was integrated in to Cisco IOS Release 12.2(27)SBA. Usage Guidelines If you do not configure the pool as an autogrow pool, the pool will not request additional subnets if one subnet is already in the pool. Use the dhcp keyword to obtain subnets from DHCP, the aaa keyword to obtain subnets from the AAA server, and the ipcp keyword to obtain subnets from IPCP negotiation. If you expect that the utilization of the pool may grow over time, use the autogrow size option. If a pool has been configured with the autogrow size option, ensure that the source server is capable of providing more than one subnet to the same pool. Even though the Cisco IOS software specifies the requested subnet size, it can accept any offered subnet size from the source server. Examples The following example shows how to configure an address pool named green to use DHCP as the subnet allocation protocol with an initial subnet size of 24 and an autogrow subnet size of 24: ip dhcp pool green   vrf green   origin dhcp subnet size initial /24 autogrow /24   utilization mark high 80   utilization mark low 20 The following example shows how to configure the location of the external text file: ip dhcp pool abcpool  origin file tftp://10.1.0.1/staticbindingfile Related Commands Command Description show ip dhcp pool Displays information about the DHCP address pools. Glossary address binding —A mapping between the client IP and hardware addresses. The client IP address may be pre-configured by the administrator (manual address allocation) or assigned from a pool by the Dynamic Host Configuration Protocol (DHCP) server (automatic address allocation). address pool —The range of IP addresses assigned by the DHCP server. The pool may also store client parameters, such as default router and DNS servers. database agent —Any host storing the DHCP bindings database. DHCP client —Any host requesting configuration parameters. DHCP database —An external file configured in a DHCP server, which stores automatic bindings from the server. DHCP server —Any host providing configuration parameters. Note Refer to Internetworking Terms and Acronyms for terms not included in this glossary. Copyright © 2004, 2005 Cisco Systems, Inc. All rights reserved.

Was this Document Helpful?

Contact Cisco

• (Requires a Cisco Service Contract )

• Log in / create account
• Privacy Policy
• Community portal
• Current events
• Recent changes
• Random page

Static DHCP

From dd-wrt wiki, [ edit ] introduction.

Static DHCP (aka DHCP reservation) is a useful feature which makes the DHCP server on your router always assign the same IP address to a specific computer on your LAN . To be more specific, the DHCP server assigns this static IP to a unique MAC address assigned to each NIC on your LAN. Your computer boots and requests its IP from the router's DHCP server. The DHCP server recognizes the MAC address of your device's NIC and assigns the static IP address to it. (Note also that, currently, each reserved IP address must also be unique. Therefore, e.g., one cannot reserve the same IP address for both the wired and wireless interfaces of a device, even though the device may be configured such that only one interface is active at any given time.)

Static DHCP will be needed if you want an interface to always have the same IP address. Sometimes required for certain programs, this feature is useful if other people on your LAN know your IP and access your PC using this IP. Static DHCP should be used in conjuction with Port Forwarding . If you forward an external WAN TCP/UDP port to a port on a server running inside your LAN, you have to give that server a static IP, and this can be achieved easily through Static DHCP.

[ edit ] Configuration

• Log into the DD-WRT Web GUI
• Go to the Services tab
• DHCP Daemon should be enabled
• If there is no blank slot under "Static Leases", click Add
• Enter the MAC address of the client interface, the hostname of the machine, and the desired IP address for this machine. Note that you cannot reserve the same IP address for two different MAC addresses (e.g. both the wired and wireless interfaces of a device).
• Scroll to the bottom of the page and save your changes.

Note: You must either Save or Apply the page each time you've added and filled out a new static lease. Clicking the Add button refreshes the page without saving what you entered. If you try to add multiple blank leases and fill them all out at once then you will encounter a bug that the GUI thinks they are duplicate entries.

Note: A blank lease duration means it will be an infinite lease (never expires). Setting a lease duration will allow you to change the static lease information later on and have the host automatically get the new information without having to manually release/renew the lease on the host.

[ edit ] DHCP Options

The DHCP system assigns IP addresses to your local devices. While the main configuration is on the setup page you can program some nifty special functions here.

DHCP Daemon : Disabling here will disable DHCP on this router irrespective of the settings on the Setup screen.

Used domain : You can select here which domain the DHCP clients should get as their local domain. This can be the WAN domain set on the Setup screen or the LAN domain which can be set here.

LAN Domain : You can define here your local LAN domain which is used as local domain for DNSmasq and DHCP service if chosen above.

Static Leases : Assign certain hosts specific addresses here. This is also a way to add hosts to the router's local DNS service (DNSmasq).

Note: It is recommended but not necessary to set your static leases outside of your automatic DHCP address range. This range is 192.168.1.100-192.168.1.149 by default and can be configured under Setup -> Basic Setup : Network Address Server Settings (DHCP) .

[ edit ] Example

To assign the IP address 192.168.1.12 and the hostname "mypc" to a PC with a network card having the MAC address 00:AE:0D:FF:BE:56 you should press Add then enter 00:AE:0D:FF:BE:56 into the MAC field, mypc into the HOST field and 192.168.1.12 into the IP field.

Remember: If you press the 'Add' button before saving the entries you just made, they will be cleared. This is normal behavior.

[ edit ] How to add static leases into dhcp by command

If more than two...just keep adding them to the static_leases variable with a space between each.

Don't forget the double quotes...if you have any spaces (more than one lease) you must include the quotes to the variable.

NOTE: Starting with build 13832 the format has changed to the following:

Note the '=' sign at the end of each lease. If you want to set static lease time then put a number after the last '=' to set time in minutes...in the second cases above a blank after the = sign means its an indefinite lease, 1440=24 hours.

If you have success setting a couple of entries, but have difficulty setting lots of entries, then you may be encountering a length limitation for your given method and firmware combination. A workaround for this is to ssh or telnet to the router and enter it there. If you still run into a length problem then you could use vi (or other method) to enter your configuration into a file and then run the file. Here is what I saved into a file and ran with success (I needed single quotes instead of double quotes in my case):

I then ran the file (which is named myiplist.sh) like so:

Also remember tools such as "nvram show | grep static" as well as "nvram commit".

[ edit ] Troubleshooting

If you cannot ping a hostname, append a period to the end. I.e. instead of "ping server" try "ping server."

If the static reservations are visible, but your machines continue to get a normal DHCP IP try going to the Setup page. Hit Save and then Apply settings. The DHCP daemon should restart and you may lose connection briefly. Try renewing your DHCP lease and you should be getting the correct IP at this point.

Categories : DHCP | Basic tutorials

• Discussion |
• What links here |
• Related changes |
• Upload file |
• Special pages
• | Permanent link
• About DD-WRT Wiki |
• Disclaimers |
• Powered by MediaWiki |
• Design by Paul Gu

• Configuring a DHCP server static IP address

For certain types of servers, you must assign a static IP address and subnet mask during or after Setup. These servers include DHCP servers, DNS servers, WINS servers, and any server providing access to users on the Internet. It is also recommended that you assign a static IP address and subnet mask for each domain controller. If a computer has more than one network adapter, you must assign a separate IP address for each adapter.

Click Start , click Control Panel , click Network and Internet , click Network and Sharing Center and then click Change Adapter Settings .

Right-click the connection to which you want to add a static IP address and then click Properties .

Acknowledge the UAC dialog and then double-click Internet Protocol Version 4 (TCP/IP/IPv4).

Click Use the following IP address , and do one of the following:

• For a local area connection, in IP address, Subnet mask , and Default gateway , type the IP address, subnet mask, and default gateway addresses.
• For all other connections, in IP address , type the IP address.

Click Use the following DNS server addresses .

In Preferred DNS server and Alternate DNS server , type the primary and secondary DNS server addresses.

To configure advanced static IPv4 address settings for a local area connection, click Advanced .

Acknowledge the UAC dialog and then double-click Internet Protocol Version 4 (TCP/IP/IPv6).

Click Use the following IPv6 address , and then do one of the following:

• For a local area connection, in IPv6 address, Subnet prefix length , and Default gateway , type the IP address, subnet prefix length, and default gateway address.
• For all other connections, in IPv6 address , type the IP address.

To configure advanced static IPv6 address settings for a local area connection, click Advanced .

Additional Resources

For a list of Help topics providing related information, see Configuring DHCP Server Role Settings .

For updated detailed IT pro information about DHCP and TCP/IP, see the Windows Server 2008 documentation on the Microsoft TechNet Web site.

Table Of Contents

• DHCP Overview
• Installing the DHCP Server Role
• More about WINS server settings
• Integrating DHCP with DNS
• More about adding scopes
• More about authorizing DHCP servers in AD DS
• More about DHCPv6 stateless mode
• DHCP network interface card bindings
• Configuring Split Scopes
• Configuring Name Protection
• Configuring Link Layer Filtering
• Configuring a DHCP Scope
• Configuring a DHCP Multicast Scope
• Configuring a DHCP Superscope
• More About Predefined DHCP Options
• Increase fault tolerance by splitting DHCP scopes
• Eliminate manual updates of DNS records by configuring dynamic update and secure dynamic update
• Allow remote administration of DHCP servers by configuring Windows Firewall ports
• Prevent rogue DHCP servers on your network by authorizing DHCP servers in AD DS
• Enforce network access policies for client health by configuring DHCP with Network Access Protection
• Automate management of devices that have static IP addresses by creating DHCP reservations
• Support multiple subnets with one DHCP server by configuring DHCP relay agents
• Avoid reconfiguring DHCP on a new server by migrating an existing DHCP infrastructure
• Balance the load on your DHCP servers by using the 80/20 rule for scopes
• Centralize management of two or more DHCP servers as a single system by clustering DHCP servers
• More About DHCP Backup and Restore
• More About Exporting and Importing the DHCP Database
• More About DHCP Security Groups
• Distribute DHCP Leases Based on MAC Address
• Prevent Name Squatting with Name Protection
• More About DHCP Audit and Event Logging

How to configure a static IP on Windows 10 or 11

Do you need to switch from a dynamic to a static IP address configuration on Windows 11 or 10? Here's how.

• Windows 11 static IP
• Windows 10 static IP

On Windows, the router's Dynamic Host Configuration Protocol (DHCP) server is (usually) responsible for assigning a dynamic Transmission Control Protocol/Internet Protocol (TCP/IP) configuration to every device in the network, including to your computer running Windows 11 or Windows 10.

Although a dynamic IP address is the recommended configuration for most situations, you may need to change to a static IP address if you're thinking about setting up a printer or file sharing, or you have to configure port forwarding on the router to your computer.

The reason is that a dynamic network configuration can change at any time after the lease from the DHCP expires and if the address changes, network resources you may have configured will stop working. Setting a static IP address will always stay the same on the computer, allowing a more reliable experience sharing resources in the network or forwarding ports.

Whatever the reason, on Windows 10 and 11, you have many ways to configure a static TCP/IP address, including using the Settings app and Command Prompt.

This guide will walk you through the different ways to configure a static network configuration on Windows 11 and 10.

How to set a static TCP/IP network configuration on Windows 11

On Windows 11, you can change your computer's dynamic IP configuration to static in at least two ways through the Settings app or commands.

Configure IP from Settings app

Get the Windows Central Newsletter

All the latest news, reviews, and guides for Windows and Xbox diehards.

To assign a permanent TCP/IP configuration on Windows 11, use these steps:

• Open  Settings .
• Click on  Network & internet .
• (Optional) Click on Advanced network settings .
• Under the "More settings" section, click on Hardware and connection properties.
• Note the current IPv4 ,  Subnet mask ,  Default Gateway , and  DNS server addresses to determine the new configuration, as it has to be in the same network scope.
• Click the  Ethernet  or  Wi-Fi  page on the right side from the "Network & internet." page.

• Quick note:  If you select the Wi-Fi page, you need to click on the connection properties to access the network settings.
• Click on the  Edit  button for the "IP assignment" setting.

• Select the  Manual  option from the drop-down menu.
• Turn on the  IPv4  toggle switch.
• Confirm the IP address for the computer – for example, 10.1.4.90.
• Confirm the subnet mask for the configuration – for example, 255.255.255.0.
• Confirm the default gateway address (usually your router's IP) – for example, 10.1.4.1.
• Confirm the preferred DNS address – for example, 10.1.4.1.

•   Quick note:  In a home network, you may also be able to use the router's IP address for the DNS configuration. You can also use third-party DNS services like Google Public DNS, Cloudflare, Cisco's OpenDNS, and others. 
• (Optional) Select the  "On (automatic template)"  option for the "DNS over HTTPS" setting and leave the  "Fallback to plaintext"  option disabled unless you want to encrypted as well as unencrypted traffic or you're troubleshooting connectivity.
• Quick note:  DNS over HTTPS (DoH) is a feature that encrypts the DNS queries over the HTTPS protocol to improve security and privacy on the internet. You only want to enable this feature if the DNS server supports this feature.
• Confirm the alternate DNS address (if applicable).
• (Optional) Select the  "On (automatic template)"  option for the "DNS over HTTPS" setting and leave the  "Fallback to plaintext"  option disabled.
• Click the  Save  button.

Once you complete the steps, the computer will start using the static network configuration. If everything has been configured correctly, you should be able to open the web browser to access the internet.

If you entered an address (such as the DNS address) and then changed it, you probably won't be able to save the settings. If this is the case, cancel the configuration, start over, enter the correct configuration, and then try to save the settings.

Configure IP from Command Prompt

To set a static TCP/IP configuration on Windows 11, use these steps:

• Open  Start .
• Search for  Command Prompt , right-click the top result, and select the  Run as administrator  option.
• Type the following command to see your current networking configuration and press  Enter : ipconfig /all
• Confirm the name of the adapter and the networking configuration, including the IPv4 , Subnet mask , Default Gateway , and DNS Servers .

• Type the following command to configure a static TCP/IP address and press  Enter :  netsh interface ip set address name= "ADAPTER-NAME" static IP-ADDRESS SUBNET-ADDRESS DEFAULT-GATEWAY-ADDRESS

In the above command, replace  ADAPTER-NAME  with the name of your network adapter. Change  IP-ADDRESS SUBNET-ADDRESS    DEFAULT-GATEWAY-ADDRESS  with the device IP address, subnet mask, and default gateway addresses you want. For example, this command sets the 10.1.4.90, 255.255.255.0, 10.1.4.1 configuration:  netsh interface ip set address name="Ethernet 10Gb" static 10.1.4.90 255.255.255.0 10.1.4.1

• Type the following command to set a DNS server address and press  Enter :  netsh interface ip set dns name="ADAPTER-NAME" static DNS-ADDRESS  

In the command, change  ADAPTER-NAME  with your adapter's name and  DNS-ADDRESS  with the DNS server address of the network. For example, this command sets the local router as the DNS server:  netsh interface ip set dns name="Ethernet 10Gb" static 10.1.4.1

• Type the following command to set an alternate DNS server address and press  Enter :  netsh interface ip add dns name="ADAPTER-NAME" DNS-ADDRESS index=2

In the command, change  ADAPTER-NAME  with the adapter's name and  DNS-ADDRESS  with an alternate DNS server address. For example, netsh interface ip add dns name="Ethernet 10Gb" 1.1.1.1 index=2

After you complete the steps, the commands will set a static network configuration on Windows 11.

How to set a static TCP/IP network configuration on Windows 10

On Windows 10, you can also use the Settings app and Command Prompt to set up a static IP network configuration.

To assign a permanent TCP/IP configuration on Windows 10, use these steps:

• Click on  Ethernet  or  Wi-Fi .
• Click on the active connection on the right side.

• Click the  Edit  button for the "IP assignment" setting.

• Select the  Manual  option.
• Confirm the subnet prefix length (subnet mask) for the configuration – for example, 24 to specify the 255.255.255.0 subnet mask.

• Quick tip:  It's important to use the number that represents the network instead of the subnet mask. Otherwise, the configuration won't save. If you don't know the subnet prefix length for your subnet mask, you can use any  online subnet calculator  to find out.

Once you complete the steps, Windows 10 will start using the static IP configuration. If you lose network connectivity, restart the computer to regain access to the local network and internet.

To change from dynamic to static IP address with commands on Windows 10, use these steps:

In the command, change  ADAPTER-NAME  with your adapter's name and  DNS-ADDRESS  with the DNS server address of the network. For example, this command sets the local router as the DNS server:  netsh interface ip set dns name=" Ethernet 10Gb" static 10.1.4.1

In the command, change  ADAPTER-NAME  with the adapter's name and  DNS-ADDRESS  with an alternate DNS server address. For example, netsh interface ip add dns name="Ethernet0" 1.1.1.1 index=2

After you complete the steps, the network configuration will switch from dynamic to static on Windows 10.

Mauro Huculak is technical writer for WindowsCentral.com. His primary focus is to write comprehensive how-tos to help users get the most out of Windows 10 and its many related technologies. He has an IT background with professional certifications from Microsoft, Cisco, and CompTIA, and he's a recognized member of the Microsoft MVP community.

• 2 DesktopGPT brings GPT-3.5 Turbo, GPT-4, and GPT-4 Turbo to Windows 11's backyard, potentially giving Microsoft's Copilot AI a run for its money as the best alternative
• 3 Clippy, the infamous paperclip, is here to debloat Windows 11 and save you from ads
• 4 Microsoft says most company execs won't hire anyone without an AI aptitude, prompting "a 142x increase in LinkedIn members adding AI skills like Copilot and ChatGPT to their profiles"
• 5 World of Warcraft Dragonflight's final major update, Patch 10.2.7 "Dark Heart", is now available

How to set router to assign static IP address automatically to Windows 10

You can configure your router to assign a static IP address configuration automatically without changing the Windows 10 settings, and here's how to do it.

On Windows 10, a static IP address is a recommended configuration for many scenarios, such as when sharing files, printers, media, and other services.

If the device doesn’t include a static IP address, services will eventually stop working. Usually, because computers connected to a network receive their Internet Protocol (IP) address configuration from the Dynamic Host Configuration Protocol (DHCP) server, which are dynamic and temporary.

Typically, you would assign a static IP address using the Windows 10 settings , but you can also set the dynamically assigned networking configuration from the DHCP server as the static configuration using the router settings.

In this guide , you’ll learn the steps to configure your router’s DHCP server to assign a static IP address to a computer without the need to change the networking settings on Windows 10 .

How to convert dynamic IP address to static using binding

How to assign static ip address using dhcp server.

Use these steps to make a DHCP assigned IP address configuration static on Windows 10:

Open Router web interface.

Click on Network Map from the left pane.

Click on the Clients button.

Under the “Client status list” section, click the computer you want to change its configuration.

Turn on the MAC and IP Address Binding toggle switch.

Click the Apply button.

Once you complete the steps, the DHCP server will always assign the same TCP/IP address configuration to the device you specified.  

Use these steps to configure the DHCP server on your router to assign a static IP address configuration to a Windows 10 device:

Click on LAN from the left pane.

Click on the DHCP tab.

Under the “Manually Assigned IP around the DHCP list” section, use the drop-down to select the MAC address of the device you want to configure.

In the “IP Address” section, specify the static IP address you want the computer to use.

Click the Add (+) button.

After you complete the steps, every time the device you specified connects to the network the DHCP server will assign the TCP/IP configuration without the need to change the Windows 10 settings.

Mauro Huculak is a Windows How-To Expert who started Pureinfotech in 2010 as an independent online publication. He has also been a Windows Central contributor for nearly a decade. Mauro has over 14 years of experience writing comprehensive guides and creating professional videos about Windows and software, including Android and Linux. Before becoming a technology writer, he was an IT administrator for seven years. In total, Mauro has over 20 years of combined experience in technology. Throughout his career, he achieved different professional certifications from Microsoft (MSCA), Cisco (CCNP), VMware (VCP), and CompTIA (A+ and Network+), and he has been recognized as a Microsoft MVP for many years. You can follow him on X (Twitter) , YouTube , LinkedIn and About.me . Email him at [email protected] .

• Windows 10 update KB4512508 (build 18362.295) releases for version 1903
• Explore Beekeeping theme for Windows 10 (download)

We hate spam as much as you! Unsubscribe any time Powered by follow.it ( Privacy ), our Privacy .

• Editor's Choice: Tech Gifts for Mom
• Amazon Prime Tech Deals!
• When to Use a Static IP Address

Are static IP addresses better than dynamic addresses?

• Massachusetts Institute of Technology
• University of Illinois

In This Article

Jump to a Section

Static IP Address Uses

• Static vs. Dynamic
• When Not to Use a Static IP

Static IP Address Assignment on Home Networks

• Getting a Static Public IP Address

A static IP address, or fixed IP address , is an IP address that never changes. Not everyone needs a static IP address, but knowing how they differ from dynamic IP addresses can help you understand whether you should use a static IP address.

Here are some example situations for when you might need a static IP address:

• Setting up a home file server .
• Adding a second router to a network.
• Enabling access to a computer when away from home or work.
• Forwarding ports to certain devices.
• Sharing a printer over a network.
• Connecting to an IP camera when away from home.

Static & Dynamic: What They Mean

The terms static and dynamic are simple to understand. At the core, the only real change you'll notice between static versus dynamic IP addresses is that the former never changes, while the latter does.

Most people don't care if their IP address changes. If you never know what your IP address is and never have a reason to keep it the same, then dynamic addresses are fine for you.

However, if your network or computer is set up in a specific way where some devices would work easier and set up would be smoother for you as the admin if an IP address always stayed the same, then static addressing is what you want.

Static IP addresses are assigned manually by an administrator. In other words, the device receiving the static IP is given a specific address (such as 192.168.1.2 ), and from then on, the address never changes.

Dynamic IP addresses are not assigned manually. They are assigned automatically by DHCP (Dynamic Host Configuration Protocol).

When Static IP Addresses Are Used

Static IP addresses are necessary for devices that need constant access.

For example, a static IP address is necessary if your computer is configured as a server, such as an FTP server or web server. If you want to ensure that people can always access your computer to download files, force the computer to use a static, never-changing IP address.

If the server was assigned a dynamic IP address, it would change occasionally, preventing your router from knowing which computer on the network is the server.

If you want to access your home computer while you're on a trip or your work computer when you're at home, setting up the computer to use a static IP address lets you reach that computer at any time without fearing that the address will change and block your access to it.

A shared printer is another example of when to use a static IP address. If you have a printer that everyone in your house or office needs to share, give it an IP address that won't change no matter what. That way, when every computer is set up to connect to that printer, those connections remain indefinitely because the address never changes.

Here are some other reasons to use static IPs:

• They provide slightly better protection against network security problems than DHCP address assignment provides.
• Some network devices don't support DHCP.
• They help avoid potential  IP address conflicts where DHCP might supply an address already assigned elsewhere.
• They provide geolocation that's more accurate than a dynamic IP address.

When Not to Use a Static IP Address

Because a static IP address is assigned manually, it's less efficient for a network admin to give it out, especially in mobile situations. Someone must visit the device in person to give it an IP address instead of letting DHCP assign the address automatically.

For example, you wouldn't set a static IP address on a smartphone because the moment it reaches another Wi-Fi network, the address might not be supported on that network, meaning that it won't be able to access the internet.

Dynamic addressing is more convenient in this situation because it's easy for administrators to set up. DHCP works automatically with minimal intervention needed, allowing mobile devices to move between different networks seamlessly.

Businesses are more likely to use static IP addresses than home networks. Implementing static IP addresses isn't easy and frequently requires a knowledgeable technician.

However, you can have a static IP address for your home network. When making static IP assignments for local devices on home and other private networks, the address numbers should be chosen from the  private IP address  ranges defined by the Internet Protocol standard:

• 10.0.0.0–10.255.255.255
• 172.16.0.0–172.31.255.255
• 192.168.0.0–192.168.255.255

These ranges support thousands of IP addresses. It's common for people to assume they can choose any number in the range and that the specific choice doesn't matter much. This is untrue.

To choose and set specific static IP addresses suitable for your network, follow these guidelines:

• Do not choose any addresses that end with .0 or .255 . These addresses are usually reserved for use by network protocols .
• Do not choose the addresses at the beginning of a private range. Addresses like 10.0.0.1 , 192.168.0.1 , and 192.168.0.100 are commonly used by network routers and other consumer devices. These are the first addresses hackers attack when trying to break into a private computer network.
• Don't choose an IP address that falls outside the range of your local network. For example, to support all addresses in the 10.x.x.x private range, the subnet mask on all devices must be set to 255.0.0.0. If they aren't, some static IP addresses in this range don't work.

How to Get a Static Public IP Address

Internet service providers (ISP) traditionally assign all their IP addresses to customers dynamically, due to historical shortages of available IP numbers.

Contact your service provider if you prefer a static IP address. You can't get a static public IP address without requesting it from your ISP. Customers can sometimes obtain a static IP by subscribing to a special service plan and paying extra fees.

Get the Latest Tech News Delivered Every Day

• What Is a Static IP Address?
• What Is a Dynamic IP Address?
• What Is an IP Address?
• What Is a Public IP Address? (and How to Find Yours)
• What Is DHCP? (Dynamic Host Configuration Protocol)
• Uses for the 192.168.0.2 and 192.168.0.3 IP Addresses
• How to Fix It When There's No Internet Connection
• How Is 192.168.1.2 Used?
• NETGEAR Default Password List (May 2024)
• How to Connect Two Routers on a Home Network
• Understanding the 192.168.1.100 IP Address
• What Is the 192.168.1.5 IP Address Used For?
• How to Work With IP Address 192.168.100.1
• How to Obtain a Fixed IP Address
• How to Change Your IP Address
• 192.168.1.4: IP Address for Local Networks

This browser is no longer supported.

Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.

Step-by-Step: Configure DHCP Using Policy-based Assignment

Updated: May 27, 2016

Applies To: Windows Server 2012, Windows Server 2012 R2

The Dynamic Host Configuration Protocol (DHCP) server role in Windows Server 2012 introduced a new policy based IP address assignment feature. Policy based assignment (PBA) allows an administrator to group DHCP clients by specific attributes based on fields contained in the DHCP client request packet. This feature allows for targeted administration and greater control of configuration parameters delivered to network devices.

In this guide

This guide provides step-by-step instructions for deploying DHCP policy based assignment in a test lab using one server computer and two client computers. Software and hardware requirements are provided, as well as an overview of DHCP policy based assignment.

The following instructions are for configuring a test lab using the minimum number of computers. Individual computers are needed to separate the services provided on the network and to clearly show the desired functionality. This configuration is neither designed to reflect best practices nor does it reflect a desired or recommended configuration for a production network. The configuration, including IP addresses and all other configuration parameters, is designed only to work on a separate test lab network.

DHCP policy based assignment overview

With a DHCP server running Windows Server 2012 or Windows Server 2012 R2, administrators can define an address assignment policy at the server level or scope level. A policy contains a set of conditions to evaluate when processing client requests. Policy based assignment enables flexibility for some common scenarios, including:

Multiple device types : A network includes many different DHCP client devices, such as printers, IP phones, and desktops. Administrators need the ability to classify these devices using different IP address ranges. This enables router policies and quality of service (QoS) based on IP address range policies to control network access or traffic. For example, you can add a vendor class of “Hewlett-Packard JetDirect” or Cisco Systems, Inc. IP Phone CP-7940G and configure printer and IP-phone policies to assign a specific IP address range to these devices.

Multiple roles : A network includes different types of computers, such as laptops, desktops, and servers in the same subnet. Depending on the type of client, the administrator might wish to provide different lease duration settings. All the wireless clients that connect via a specific relay agent can be assigned a four-hour lease duration. DNS dynamic update protocol can be disabled for clients matching this policy. Similarly, a server policy can be created using a list of server MAC addresses. Servers can be assigned a 12-day lease duration

Virtualization : A data center network employs virtualization for different workloads and applications. Virtual machines are added and removed dynamically depending upon load requirements at a given time. An administrator wishing to route traffic on the network differently for VMs can create a policy based on MAC address prefix to assign a short lease duration, specific IP address range, and different default gateway.

The following fields in the DHCP client request are available when defining policies.

Vendor Class

MAC address

Client Identifier

Relay Agent Information

Policy settings and evaluation

Policy settings can be of three types.

IP address range : The IP address range within a scope from which to assign an IP address to a client. A server level policy cannot have a setting for an IP address range.

Standard DHCP options : One or more standard DHCP options to send to a client in the response based on the options requested by the client in the parameter request list.

Vendor specific DHCP options : One or more vendor specific DHCP options to send to the client based on the vendor class field in the client request.

The DHCP server evaluates policies sequentially according to an assigned processing order. The DHCP administrator assigns the processing order to the policies. If policies exist at the server and scope levels, the server applies both sets of policies and evaluates the scope policies before the server policies. The processing order for a scope level policy defines the order of evaluation within the scope. If there are no policies defined at the scope level, the policies at the server level apply to the scope.

Address assignment

The DHCP server determines the scope to which a DHCP client belongs based on the gateway IP address of the relay agent or the interface of the DHCP server on which it receives the DHCP client packet. Once the server determines the client scope, the server evaluates the DHCP packet against the policies applicable for the scope in the processing order specified. The policies applicable at a scope are those configured at the scope and those inherited from the server. A single client request can match multiple policies.

If a client request matches the conditions of a policy for which a specific IP address range is associated, the server will assign the first free IP address from the range as determined by the rule. If a policy is associated with multiple address ranges, the server will assign IP addresses by first attempting to assign an IP from the lowest address range. If no IP addresses are available to use from the lower address range, the server will then look for a free IP address from the higher address ranges. If no IP addresses are free from any of the address ranges associated with the policy, the server will process the next matched policy as defined by the processing order.

If none of the matched policies has a free IP address, the server will drop the client packet and log an event. If a DHCP client packet does not match any of the policies applicable for the scope, or none of the matched policies for a client packet is associated with an IP address range, the server will lease the client an IP address from the IP address range configured for the scope exclusive of any policy-specific IP address ranges.

Option assignment

A DHCP client uses the parameter request list field in a DHCP packet to request a list of standard options from the server. The option assignment processing for a client is similar to that of IP address assignment. The DHCP server evaluates the fields in the client request against each policy applicable for the scope in the processing order specified. If the client request matches the conditions of any of the policies applicable for the scope, and its settings include specific options, the server returns these options to the client. If multiple policies match the client request, the server returns the sum of the options specified for each of the matched policies. The DHCP server sends vendor class options to the client based on the vendor class contained in the DHCP client request.

Scenario overview

This test lab demonstrates new DHCP functionality in Windows Server 2012 or Windows Server 2012 R2. One server computer and two client computers are used. See the following figure.

Hardware and software requirements

One server computer and two client computers are required to complete the test lab.

The following are required components of the test lab:

The product disc or other installation media for Windows Server 2012 or Windows Server 2012 R2.

One computer that meets the minimum hardware requirements for Windows Server 2012 or Windows Server 2012 R2.

At least one DHCP client computer is required.

The lab uses two computers running Windows® 8. If only one client computer is available, or clients are not running Windows 8, you must alter some of the procedures in the test lab accordingly.

Steps for configuring the test lab

The following procedures are used to configure computers for the demonstration portion of the test lab:

Configure DHCP1 : DHCP1 is a domain controller, DNS server, and DHCP server for the contoso.com Active Directory domain.

Configure Client1 : Client1 is a DHCP client computer.

Configure Client2 : Client2 is a DHCP client computer.

Configure DHCP1

DHCP1 is a computer running Windows Server 2012 or Windows Server 2012 R2, providing the following services:

A domain controller for the contoso.com Active Directory domain.

An authoritative DNS server for the contoso.com DNS zone.

A DHCP server.

Initial configuration of DHCP1 consists of the following steps:

Install the operating system and configure TCP/IP on DHCP1

Install ad ds, dns server, and dhcp server, create a domain administrator account, create a dhcp scope on dhcp1, to install the operating system and configure tcp/ip on dhcp1.

Start your computer using the Windows Server 2012 or Windows Server 2012 R2 product disc or other digital media.

When prompted, enter a product key, accept license terms, configure clock, language, and regional settings, and provide a password for the local Administrator account.

Press Ctrl+Alt+Delete and sign-in using the local Administrator account.

If you are prompted to enable Windows Error Reporting, click Accept .

Click Start , type ncpa.cpl , and then press ENTER . The Network Connections control panel will open.

The previous step demonstrates the functionality in Windows Server 2012 or Windows Server 2012 R2 that enables you to search and run applications, settings, and files by clicking Start and then typing a search term. You can also open the Network Connections control panel by clicking next to Ethernet in Server Manager using the Local Server view. For more information, see Common Management Tasks and Navigation in Windows Server 2012 ( https://go.microsoft.com/fwlink/p/?LinkId=242147 ).

In Network Connections , right-click Ethernet and then click Properties .

Double-click Internet Protocol Version 4 (TCP/IPv4) .

On the General tab, choose Use the following IP address .

Next to IP address type 10.0.0.1 and next to Subnet mask type 255.255.255.0 . It is not necessary to provide an entry next to Default gateway .

Next to Preferred DNS server , type 10.0.0.1 .

Click OK twice, and then close the Network Connections control panel.

DHCP1 will serve as a domain controller, DNS server, and DHCP server for the contoso.com Active Directory domain.

To configure DHCP1 as a domain controller, DNS server, and DHCP server

The Server Manager Dashboard is displayed by default. In the navigation pane, click Configure this local server .

Under PROPERTIES , click the name next to Computer name . The System Properties dialog box will open.

On the Computer Name tab, click Change and then type DHCP1 under Computer name .

Click OK twice, and then click Close .

When you are prompted to restart the computer, click Restart Now .

After restarting the computer, sign-in using the local Administrator account.

In Server Manager, under Configure this local server , click Add Roles and Features .

In the Add Roles and Features Wizard , click Next three times, and then on the Select server roles page select the Active Directory Domain Services checkbox.

When you are prompted to add required features, click Add Features .

Select the DHCP Server checkbox.

Select the DNS Server checkbox.

Click Next five times, and then click Install .

Wait for the installation process to complete, verify on the Installation progress page that Configuration required. Installation succeeded on DHCP1 is displayed, and then click Close .

Click the Notification flag and then click Promote this server to a domain controller . See the following example.

In the Active Directory Domain Services Configuration Wizard , on the Deployment Configuration page, choose Add a new forest and then next to Root domain name , type contoso.com .

Click Next , and then on the Domain Controller Options page, under Type the Directory Services Restore Mode (DSRM) password , type a password next to Password and Confirm password . Confirm that Domain Name System (DNS) server and Global Catalog (GC) are selected, and then click Next .

Click Next four times, verify that All prerequisite checks passed successfully is displayed, and then click Install .

The computer will restart automatically to complete the installation process.

Sign in using the local Administrator account.

A domain administrator account is required to configure settings in the test lab.

You can use the CONTOSO\Administrator account in this test lab and skip creation of a domain administrator account if desired. This account has domain administrator privileges, and other privileges. However, it is a best practice to disable or rename this account. For more information, see Active Directory Best Practices ( https://go.microsoft.com/fwlink/p/?LinkID=243071 ).

To create a domain administrator account

On the Server Manager menu bar, click Tools , and then click Active Directory Users and Computers .

In the Active Directory Users and Computers console tree, double-click contoso.com , right-click Users , point to New , and then click User .

In the New Object – User dialog box, type user1 under User logon name and next to Full name , then click Next .

Next to Password and Confirm password , type a password for the user1 account.

Clear the checkbox next to User must change password at next logon , select the Password never expires checkbox, click Next , and then click Finish .

Click the Users folder, and then double-click user1 and then click the Member Of tab.

Click Add , type domain admins under Enter the object names to select , click OK twice, and then close the Active Directory Users and Computers console.

Click Start , click Administrator , and then click Sign out .

Sign in to the computer using the user1 credentials. Click Other user and then type the user1 name and password.

Next, create a DHCP scope on DHCP1.

To create a DHCP scope on DHCP1

On the Server Manager menu bar, click Tools and then click DHCP . The DHCP console opens.

In the DHCP console tree, navigate to IPv4 . Right-click IPv4 and then click New Scope . The New Scope Wizard opens.

Click Next and then type a name for the new scope next to Name (ex: Contoso-scope1).

Click Next and then in IP Address Range , type 10.0.0.1 next to Start IP address , type 10.0.0.254 next to End IP address , and type 24 next to Length . The value of Subnet mask will change automatically to 255.255.255.0 .

Click Next , and then in Add Exclusions and Delay type 10.0.0.1 under Start IP address , type 10.0.0.10 under End IP address , and then click Add . This allows the first ten IP addresses in the 10.0.0.0/24 subnet to be used for static addressing of servers on the network.

Click Next and then in Lease Duration under Limited to enter 0 Days , 0 Hours , and 2 Minutes . This very short lease duration will simplify the DHCP demonstration.

Click Next three times, and then in Domain Name and DNS Servers , verify that the Parent domain is contoso.com and 10.0.0.1 is listed as the only DNS server.

Click Next twice, and then in Activate Scope select Yes, I want to activate this scope now .

Click Next , and then click Finish .

In the DHCP console tree, right-click dhcp1.contoso.com , and then click Authorize .

Refresh the view in the DHCP console and verify that DHCP1 is authorized and that the Contoso-scope1 is active.

Note: To review scopes on the current server using Windows PowerShell, right-click Windows PowerShell , click Run as Administrator , click Yes in the User Account Control alert that appears, and then type the following command at the Windows PowerShell prompt, and then press ENTER.

Configure Client1

Client1 is a computer running Windows® 8 that is acting as a DHCP client.

Configuration of Client1 consists of the following steps:

Install the operating system on Client1

Pin windows powershell to the taskbar.

During the demonstration portion of the test lab, Client1 will be used as a DHCP client.

To install the operating system on Client1

Start your computer using the Windows 8 product disc or other digital media.

When prompted, enter a product key and accept license terms.

When prompted to enter a computer name, type Client1 and click Next .

Click Use express settings .

On the Sign in to your PC page, click Don’t want to sign in with a Microsoft account and then click Local account .

Next to User name , type user1 , enter a password and password hint, and then click Finish .

The DHCP failover demonstration on Client1 makes use of Windows PowerShell to verify DHCP lease information. To make Windows PowerShell more easily accessible, it will be pinned to the taskbar.

To pin Windows PowerShell to the taskbar

The Start menu is displayed by default. If Start is not displayed, move the mouse cursor to the lower left corner of the screen until Start is displayed, and then click Start .

Type powershell and then under Results for “powershell” right-click Windows PowerShell and then click Pin to taskbar .Confirm that Windows PowerShell is pinned to the taskbar.

Client1 can also be joined to the contoso.com domain; however this is not required to complete the test lab.

Configure Client2

Client2 is a computer running Windows 8 that is acting as a DHCP client.

Configuration of Client2 is nearly identical to Client1. To configure Client2, repeat the identical procedures used to configure Client1, except when you enter a computer name, type Client2 instead of Client1.

DHCP policy based assignment demonstration

For the DHCP policy based assignment demonstration portion of the test lab, a MAC address based policy will be configured to assign unique DHCP options and IP address ranges to Client1 and Client2.

A demonstration of DHCP policy based assignment on Windows Server 2012 or Windows Server 2012 R2 consists of the following procedures:

Determine MAC addresses

Create policies, demonstrate policies.

Unique MAC addresses on Client1 and Client2 will be used to match different DHCP policies.

To determine MAC addresses

On DHCP1, open the DHCP console and navigate to IPv4\Scope [10.0.0.0] Contoso-scope1\Address Leases .

Click Address Leases and then in the details pane write down the MAC addresses listed for Client1 and Client2 under Unique ID .

The DHCP Policy Configuration Wizard will be used to create a unique policy for Client1 and another policy for Client2. A policy configured for an individual computer is not typical and is only configured for demonstration purposes. On a corporate network, you can use wildcards and other conditions to match multiple DHCP client devices.

To create policies

In the DHCP console, under Scope , right-click Policies and then click New Policy .

Ensure that you select the Policy folder under the Scope folder. This is the scope-level folder. The other Policies folder is for server-level policies and if you create a policy there you will not be able to create the IP address range policy for this exercise.

Next to Policy Name , type Client1 Policy , and then click Next .

On the Configure Conditions for the policy page, click Add .

In the Add/Edit Condition dialog box, choose MAC Address next to Criteria , type the MAC address for Client1 next to Value (001DB7A63D in this example), and then click Add , then click OK .

Click Next , and then in Configure settings for the policy , type 10.0.0.100 next to Start IP address and type 10.0.0.199 next to End IP address .

Click Next , and then under Available Options , select 003 Router , type 10.0.0.7 under IP address , and click Add .

Repeat the previous steps for Client2 using the following conditions, IP address ranges, and options:

Policy Name : Client2 Policy

Condition : MAC Address equals (in this example) 00155DB7A63E.

Start IP address : 10.0.0.200

End IP address : 10.0.0.254

003 Router : 10.0.0.8

Next, review the effect that these policies have on the IP address configuration of Client1 and Client2.

To demonstrate policies

In the details pane, under Policy Name , right-click one of the two policies you just created.

Note that you can move the policy up or down in the processing order, delete the policy, or disable the policy.

Click Properties .

Review the available parameters that you can edit on the General , Conditions , IP Address Range , Options , and DNS tabs.

Click OK , and then on Client1 type ipconfig /all at the Windows PowerShell prompt.

Client1 has been assigned the first IP address in the 10.0.0.100 – 10.0.0.199 range, and a default gateway of 10.0.0.7, as determined by the policy based assignment.

If the IP address hasn't changed yet, you can type ipconfig /release and then ipconfig /renew to get a new lease.

Repeat the previous step on Client2.

Client2 has been assigned the first IP address in the 10.0.0.200 – 10.0.0.254 range, and a default gateway of 10.0.0.8.

Policy based assignment in Windows Server 2012 or Windows Server 2012 R2 DHCP allows you to create simple yet powerful rules to administer DHCP on your network.

Additional resources

• Artificial Intelligence
• Generative AI
• Cloud Computing
• CPUs and Processors
• Data Center
• Edge Computing
• Enterprise Storage
• Virtualization
• Internet of Things
• Network Management Software
• Network Security
• Enterprise Buyer’s Guides
• United States
• Newsletters
• Foundry Careers
• Terms of Service
• Privacy Policy
• Cookie Policy
• Copyright Notice
• Member Preferences
• About AdChoices
• E-commerce Links
• Your California Privacy Rights

Our Network

• Computerworld

IPv6: How to configure static and DHCP IP addressing and deal with DNS

Ipv6 offers several ways that aren’t possible in ipv4 to assign ip addresses, and dns set-up has differences as well..

As IP technology has matured, the range of devices that the internet protocol supports goes well beyond computers to include cell phones, entertainment systems, and Internet of Things (IoT) devices, which created the need for more IP addresses and the development of IPv6 to provide them.

With more and more device types requiring network connectivity, the demand for addresses in an IPv4-based network is at a premium. It can provide somewhere south of 4,294,967,296 unique addresses. IPv6 , on the other hand, can yield roughly 3.4×10 38 , which should be ample for a very long time.

IPv6 also includes performance enhancements like refined multicasting, stateless address autoconfiguration (SLAAC), simplified headers to streamline router processing, and the option to allow larger packets. Security also gets a potential boost in IPv6 with IPSec, which was initially built for IPv6 and then retrofitted for IPv4.

Dealing with IPv6 includes familiarizing yourself with two important IP concepts: DHCP and DNS. Here are tips on both.

Key IPv6 addressing concepts

IPv6 addressing within a network has a few major differences from IPv4. With IPv4 certain address ranges are reserved for private networks (such as 10.0.0.0/8 or 192.168.0.0/16) and link-local addressing without dynamic host configuration protocol (DHCP) (169.254.0.0/16).

DHCP automatically assigns IP addresses and distributes other information to hosts on a network so they can communicate with other endpoints. At the same time, by assigning active IP addresses only to active devices, DHCP can reuse them to help conserve IPv4 addresses. IPv6 has similar concepts but refines each idea a little further.

Link-local addresses in IPv6 exist on each interface, regardless of whether the interface has an address assigned from DHCP or is configured using another method. Link-local IPv6 addresses have a prefix of fe80::/10 and a 64-bit suffix which can be computed and managed by the host itself without requiring additional networking components. IPv6 hosts can verify the uniqueness of their link-local addresses through a neighbor discovery process, which reaches out to the local network in order to verify that the address is not already in use.

Once a link-local address has been established, the IPv6 host attempts to determine if an IPv6-capable router is available through the use of a router solicitation message. If an IPv6 router is available it will respond with a router advertisement, which includes network configuration information such as a network prefix that is used for automatic address configuration using SLAAC or whether the host should obtain additional configuration information from a DHCPv6 server.

Configuring a Static IPv6 address in Windows

Typical to Windows, there are three ways to configure a static IPv6 address for a network adapter, all of which work in Windows 10 and in both Windows Server 2016 and 2019. The first way uses the classic Control Panel method as follows.

From the Control Panel, navigate to Network and Internet, Network and Sharing Center, and then choose the Change adapter settings link in the left panel. (You can shortcut all the clicking by searching for “View Network Connections” from the Start Menu or the Search bar).

Once you locate the network adapter you wish to configure, you can view the properties and locate the Internet Protocol Version 6 (TCP/IPv6) node and configure the properties for the IPv6 protocol. As with IPv4 you can set the adapter to obtain the IPv6 address automatically or configure your own IPv6 address, subnet, default gateway, and DNS server information. If you need to set multiple IPv6 addresses this can be accomplished by clicking the Advanced button.

The second method of setting a static IP address involves the more modern Settings application. In Settings go to Network & Internet and click the Properties button for the interface you wish to configure. Click the Edit button under IP settings, change the configuration type to Manual, enable IPv6, and populate your settings.

The third way is to use the Windows PowerShell command-line interface. In order to set a static IPv6 address using the New-NetIPAddress cmdlet you will need either the name or the numeric index of the adapter you wish to configure. Both of these values are available using the Get-NetAdapter cmdlet. From an administrative PowerShell prompt enter one of the following commands (on a single line) replacing the details as necessary for your environment:

Managing IPv6 Addressing for a Windows Network

Static IP addresses are generally OK to use when the device is hosting a critical network service that requires retaining a consistent network address, but for general use you’ll want to have a way to automate address configuration.

In an IPv4 network DHCP is the obvious answer for IP configuration and can also provide critical networking details such as the default gateway or DNS-server addresses through DHCP options. IPv6 offers three potential scenarios for managing addressing and network configuration.

SLAAC is a straightforward option assuming your router supports the appropriate router-advertisement messages. DHCP is certainly still in play to handle stateful addressing in the form of DHCPv6. You can also potentially have a hybrid scenario where your router handles addressing, and DHCPv6 simply provides the relevant network-configuration details.

In Windows Server 2016 and 2019, configuring DHCPv6 is extremely straightforward. If your router is configured to handle router advertisements and addressing through SLAAC you can simply manage the IPv6 server options to configure DNS servers or other options. If you prefer to roll with stateful addressing you can add one or more DHCPv6 scopes and configure a prefix, any exclusions, and lease durations. DHCPv6 scopes will maintain a list of leases and their expirations just as an IPv4 scope would, and they also provide an easy path for creating IPv6 reservations from existing leases.

Setting up DNS Name Resolution for IPv6

DNS is incredibly important in an IPv6 network, even moreso than in an IPv4 network because trying to configure connectivity and access resources using only IPv6 addresses is borderline insane. The biggest difference to note in regard to using DNS with IPv6 is that the IPv4 A records, which convert a fully qualified domain name (FQDN) to an IPv4 address, are replaced by AAAA (quad-A) records. All other record types such as CNAME, MX, NS, SOA, and the various DNSSEC-related record types simply reference the FQDN of the AAAA record. Reverse lookup zones, which are used to find a hostname from an IP address, are different in IPv6 simply because they are built on the IP address structure, but the process of creating and using these zones are functionally identical.

The DNS server role in Windows Server supports both IPv4 and IPv6 through a similar set of tools and processes. As with A records, AAAA records can either be created manually for critical systems or the dynamic update process can be leveraged to manage DNS records for the entire enterprise.

AAAA records can be manually created using the DNS console through the same process as A records: Right click the required DNS zone, select the New Host (A or AAAA) option, and populate the Host name and IP address. Dynamic updates are enabled through the DNS console, but most of the work is done by DHCP; the update process is configured within the DHCP console and updates are performed by the DHCP client service on individual hosts. Dynamic updates can also be manually initiated from the command line using the ipconfig command with the /registerdns switch.

Related content

Cisco adds ai features to appdynamics on-premises, chips act to fund $285 million for semiconductor digital twins, microsoft’s ai ambitions fuel $3.3 billion bet on wisconsin data center, red hat unveils image mode for its linux distro, newsletter promo module test.

Tim Ferrill is an IT professional and writer living in Southern California. He has covered Windows, Windows Phone, and Windows Server for several publications, including CITEworld and InfoWorld.

More from this author

Tips for building a home lab to prep for network certifications, certifications that can land you a job as a network-automation engineer, free training from 8 top vendors to advance your it career, surviving a mastodon stampede, most popular authors.

• Elizabeth Montalbano

Show me more

Insecure protocols leave networks vulnerable: report.

What is a digital twin and why is it important to IoT?

2024 global network outage report and internet health check

Has the hype around ‘Internet of Things’ paid off? | Ep. 145

Episode 1: Understanding Cisco’s Converged SDN Transport

Episode 2: Pluggable Optics and the Internet for the Future

Has the hype around ‘Internet of Things’ paid off?

Are unused IPv4 addresses a secret gold mine?

Preparing for a 6G wireless world: Exciting changes coming to the wireless industry

Stack Exchange Network

Stack Exchange network consists of 183 Q&A communities including Stack Overflow , the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Q&A for work

Connect and share knowledge within a single location that is structured and easy to search.

Static IP Address assignment vs DHCP address assignment

I manage a small-ish network that consists of less than 70 nodes. The previous system administrators opted to have a dhcp server and manually set dhcp addess.

I have opted to rather use dhcp address assignment instead of static address assignment except for my domain controllers and EXS hosts. I have been critised for following this scheme, but its way easy for me to manage the address scope with out having to scan the network for available ip addresses. Am i on the right track or have i lost the plot?

7 Answers 7

Why were you criticised for doing it that way? I mean I think it's crazy not to use DHCP for workstations at least, but maybe there is something specific to the environment that changes that equation.

The only issue I can see with DHCP is ensuring that your scope is properly created and doesn't cross over with the pool of static addresses you use (even that can be got around with reservations but its more work than needed).

That aside, users should never ever need to know whether or not you use DHCP because their workstation should 'just work', except for when the DHCP server is not available (and if that's an issue, you just have more than one DHCP server online).

EDIT: Convict makes a good point about documentation, make sure you do have the IP address ranges documented, explaining what you've done, why and how to find it. I don't think people are comfortable with the idea that some tools are "self documenting" (and to an extent they might have a point, how would you easily re-create your DHCP database with all your reservations, if you couldn't restore from backup?).

• I too am seriously curious! What reasons were given for this criticism? –  quux Jun 10, 2009 at 8:21
• previous network admins assignment addresses in the dhcp pool to servers, without excluding those addresses. Since 95% of the computers are infact servers offering custom applications i prefer to assign these 'servers' addresses by way of dhcp reservation –  biosFF Jun 10, 2009 at 8:27
• @biosff - well the way you're doing things there certainly makes sense. I'm still boggling at the idea you'd get criticised for it, few of our users know or care about whether we use DHCP or a dartboard to assign and manage IP addresses and as long as things work they don't care either! –  Rob Moir Jun 10, 2009 at 8:49
• 1 The documentation is the DHCP database, IMHO. You should back it up and test restoring it. Why keep separate documentation that will fall out of date when you can use the database / config file that drives the DHCP server as the authoritative documentation? –  Evan Anderson Jun 10, 2009 at 12:03
• Evan, I'm inclined to agree but that makes people who don't understand that uncomfortable. At the very least you need to write a puff piece of documentation explaining what you've done and where to look and how to pick it all up. –  Rob Moir Jun 10, 2009 at 12:31

Yes, I think you're on the right track.

I suspect that you're being criticised because ...

of the lack of documentation about your network, rather than your choice of technology to assign an IP address;

you're doing IP address assignment differently to the way it's always been done . You're challenging the status quo.

Ask more questions to find out the real reason for the criticism. You may have to teach your detractors about DHCP and its benefits to your network administration.

People will come around to your way of configuring the network once they see how much easier it is to add another workstation to the network when the IP address is allocated by DHCP. DHCP should mean the end of those pesky duplicate IP address allocation errors that have plagued your network in the past.

When you say the previous administrators "manually set DHCP address" do you mean static assignments?

If so, this is generally the easier way to manage pools of workstations on a LAN. Statically tie each machine's MAC address to a specific IP and deliver them by DHCP. You get the trade off of knowing exactly where each machine is and being able to change the assignments without visiting each discrete machine.

Adding my vote to DHCP all the way. I can't understand why someone would criticise you for suggesting this, the whole point is to make it easier to manage the address scope, and as soon as you have more than 5 or so workstations, it makes sense.

About the critics: there are still people around, that don't know DHCP with StaticIP via the MAC-Adress. They think, that DHCP = CHAOS, so you better tell em whats really in the bag.

I also can recommend different IP-ranges, something like this:

1-9 important Servers (static) 10-99 misc. Servers (static) 100-150 Sales & Marketing (DHCP with MAC) 151-200 Developers (DHCP with MAC) 200-253 Tech.Stuff (DHCP with MAC)

Another vote for DHCP is, that you can handle all IPs from one, central instance.

• 1 Tee-hee... I remember when I "cared" what host portions of their IP address were assigned to certain kinds of computers, devices, etc. I'm glad I let go of that. (Which network portion that gets assigned matters a lot, and is related to the VLAN the host lives in. As far as host portions of IP addresses, though, I couldn't care less. I have dynamic DNS, reverse lookup zones, and DHCP reservations... the host portion of the IP address is meaningless to me.) –  Evan Anderson Jun 10, 2009 at 12:05

DHCP is by far the best choice as soon as you have more than a few stations.

Static entries should be for servers and communication devices.

I use IP range: Static .1 - .50 for servers, printers, routers, etc. DHCP .51 - .150 for workstations

• 1 "Static" and "DHCP" are not exclusive. It is very common to use DHCP to deliver static addresses (see mh's reply). –  bortzmeyer Jun 10, 2009 at 19:58

One possible disadvantage to this is that it introduces a startup order dependancy: things which DHCP need to wait for the DHCP server to come up.

You must log in to answer this question.

Not the answer you're looking for browse other questions tagged networking ip dhcp ip-address ..

• The Overflow Blog
• Reshaping the future of API platforms
• Between hyper-focus and burnout: Developing with ADHD
• Featured on Meta
• Our Partnership with OpenAI
• Imgur image URL migration: Coming soon to a Stack Exchange site near you!

Hot Network Questions

• General contractor for adding windows to old construction?
• What is "the sin that no Christian need pardon"?
• How (or is there) a way to make my rice more fluffy than sticky? Given my current approach
• The Wu line drawing algorithm for anti-aliased lines optimization
• Can someone who isn't flying meet me at my gate for a layover at Istanbul airport?
• LED as a flyback for a 3V relay?
• Why does the EU find the foreign agent law in Georgia against their values?
• Computer not booting after installing Ubuntu next to Windows
• Miniature with man falling into a chasm and a camel—what is the myth being depicted here?
• Why is the reliability of Stormy Daniels testimony relevant in Trump's hush money process?
• When in Rome... – a deconstruction sudoku
• Where is the mistake in the argument in favor of the (erroneous) claim "every Dedekind cut is a rational cut"?
• Is the meter relative to time?
• Story about robots and unemployment
• Using Mars inner moon Phobos as a brake
• How to find what is wearing out my SSDs
• Compute R Squared by Fixing Betas for Multi Linear Regression without Intercept results in a large R Square
• On Pareto functions
• How do I enable a PHP extension on GitLab CI?
• Could not locate statistics in the system catalogs error in SQL Server
• How to expand branches of a forest tree
• Troubleshooting why my hammock fell
• Can I use "Britons" in data reports?
• A short fiction about an American poetess who supposedly foiled, thanks to posthumous poems, the Martian invasion described by H. G. Wells

• Help center
• Chinese (traditional)

Learn more 

• Case Study  
• Knowledge Center  
• Glossary  

Getting Started (119)

Product Updates (119)

News & Announcements (38)

Self Service (10)

Troubleshooting Guide (6)

Client Reviews (5)

Configuration Guide (5)

Product Testing (4)

Installation Guide (3)

Hear It from Experts (1)

Optics and Transceivers (97)

Switches (97)

Networking Devices (62)

Network Cabling and Wiring (59)

Optical Networking (18)

Networking (84)

Fiber Optic Communication (53)

Data Center (30)

General (26)

Wireless and Mobility (8)

Business Type (6)

Routing and Switching (5)

United Kingdom (1)

• Product Updates
• Networking Devices
• Case Study 
• Knowledge Center 

DHCP vs Static IP: Which One Is Better?

Nowadays, most networking devices such as routers or network switches use IP protocol as the standard to communicate over the network. In the IP protocol, each device on a network has a unique identifier that is called IP address. The easiest method of achieving this was configuring a fixed IP address or static IP address. Since there are limitations to static IP, some administrators seek to use dynamic IP instead. DHCP (Dynamic Host Configuration Protocol) is a protocol for assigning dynamic IP addresses to devices that are connected to the network. So DHCP vs static IP, what's the difference?

What Is a Static IP Address?

A static IP address is an address that is permanently assigned to your network devices by your ISP, and does not change even if your device reboots. Static IP addresses typically have two versions: IPv4 and IPv6. A static IP address is usually assigned to a server hosting websites and provides email, VPN and FTP services. In static IP addressing, each device on the network has its own address with no overlap and you'll have to configure the static IP addresses manually. When new devices are connected to a network, you would have to select the "manual" configuration option and input the IP address, the subnet mask, the default gateway and the DNS server.

A typical example of using static IP address is web server. From the Window on your computer, go to START -> RUN -> type "cmd" -> OK. Then type "ping www.google.com" on the Command Window, the interface will pop up as you can see below. The four-byte number 74.125.127.147 is the current IP for www.google.com. If it is a static IP, you would be able to connect Google at any time by using this static IP address in the web browser if you want to visit Google.

What Is DHCP?

What is in contrast with the static IP address is the dynamic IP address. Static vs dynamic IP topic is hotly debated among many IT technicians. Dynamic IP address is an address that keeps on changing. To create dynamic IP addresses, the network must have a DHCP server configured and operating. The DHCP server assigns a vacant IP address to all devices connected to the network. DHCP is a way of dynamically and automatically assigning IP addresses to network devices on a physical network. It provides an automated way to distribute and update IP addresses and other configuration information over a network. To know how DHCP works, read this article: DHCP and DNS: What Are They, What’s Their Difference?

Proper IP addressing is essential for establishing communications among devices on a network. Then DHCP vs static IP, which one is better? This part will discuss it.

Static IP addresses allow network devices to retain the same IP address all the time, A network administrator must keep track of each statically assigned device to avoid using that IP address again. Since static IP address requires manual configurations, it can create network issues if you use it without a good understanding of TCP/IP.

While DHCP is a protocol for automating the task of assigning IP addresses. DHCP is advantageous for network administrators because it removes the repetitive task of assigning multiple IP addresses to each device on the network. It might only take a minute but when you are configuring hundreds of network devices, it really gets annoying. Wireless access points also utilize DHCP so that administrators would not need to configure their devices by themselves. For wireless access points, PoE network switches , which support dynamic binding by users' definition, are commonly used to allocate IP addresses for each device that is connected together. Besides, what makes DHCP appealing is that it is cheaper than static IP addresses with less maintenance required. You can easily find their advantages and disadvantages from the following table.

After comparing DHCP vs static IP, it is undoubtedly that DHCP is the more popular option for most users as they are easier and cheaper to deploy. Having a static IP and guessing which IP address is available is really bothersome and time-consuming, especially for those who are not familiar with the process. However, static IP is still in demand and useful if you host a website from home, have a file server in your network, use networked printers, or if you use a remote access program. Because a static IP address never changes so that other devices can always know exactly how to contact a device that utilizes a static IP.

Related Article: IPv4 vs IPv6: What’s the Difference?

You might be interested in

Email Address

Please enter your email address.

Please make sure you agree to our Privacy Policy and Terms of Use.

Cloud-based Networks Grow with Your Business

Anchor Your Hybrid Cloud Networking Strategy

• Network Cabling and Wiring
• Buying Guide
• Fiber Optic Communication
• Optics and Transceivers
• Data Center
• Ethernet Patch Cords
• Business Type
• Routing and Switching
• Optical Networking
• Best Practices
• 10G Network
• Home Networking

Fiber Optic Cable Types: Single Mode vs Multimode Fiber Cable

May 10, 2022

Layer 2 vs Layer 3 Switch: Which One Do You Need?

Oct 6, 2021

Multimode Fiber Types: OM1 vs OM2 vs OM3 vs OM4 vs OM5

Sep 22, 2021

Running 10GBASE-T Over Cat6 vs Cat6a vs Cat7 Cabling?

Mar 18, 2024

PoE vs PoE+ vs PoE++ Switch: How to Choose?

Mar 16, 2023

Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

ON THIS PAGE

Configuring static dhcp ip addresses for dhcp snooping (els), configuring static dhcp ip addresses for dhcp snooping (non-els), configuring static dhcp ip addresses for dhcp snooping (mx routers), configuring static dhcp ip addresses.

This task uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Configuring Static DHCP IP Addresses for DHCP snooping (non-ELS) . For ELS details, see Using the Enhanced Layer 2 Software CLI .

You can add static (fixed) IP addresses and bind them to fixed MAC addresses in the DHCP snooping database. These bindings are labeled static in the database, while those bindings that have been added through the process of DHCP snooping are labeled dynamic . Static IPv6 address assignment is also available for DHCPv6. This feature is supported on aggregated Ethernet interfaces.

Before you can perform this procedure, you must configure the VLAN. See Configuring VLANs for EX Series Switches with ELS Support (CLI Procedure) .

To configure a static IP address to MAC address (IP-MAC) binding in the DHCP snooping database, you must first create a group of access interfaces under the [edit vlans vlan-name forwarding-options dhcp-security ] hierarchy. Creating this group automatically enables DHCP snooping, which is a prerequisite for creating the DHCP snooping database. On switches that support DHCPv6, creating the group of interfaces will automatically enable both DHCP and DHCPv6 snooping. Then you can configure a specific interface within the group to have one or more static IP-MAC address bindings.

To configure a static IP-MAC address binding in the DHCP snooping database:

• [edit vlans vlan-name forwarding-options dhcp-security] user@switch# set group group-name interface interface-name static-ip ip-address mac mac-address

To configure a static IPv6-MAC address binding in the DHCPv6 snooping database:

• [edit vlans vlan-name forwarding-options dhcp-security] user@switch# set group group-name interface interface-name static-ipv6 ip-address mac mac-address

In the following example, a device with static IP allocation is connected to the ge-0/0/1 interface, which belongs to vlan-A. To configure this device to connect to the external network:

To verify that the configuration is configured on the device:

To verify that a binding entry is created for the static client:

• show dhcp-security binding
• Enabling DHCP Snooping (non-ELS)
• Understanding DHCP Snooping (non-ELS)

You can add static (fixed) IP addresses and bind them to fixed MAC addresses in the DHCP snooping database. These bindings are labeled static in the database, while those bindings that have been added through the process of DHCP snooping are labeled dynamic .

This task uses Junos OS for EX Series switches that do not support Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does support ELS, see Configuring Static DHCP IP Addresses for DHCP snooping (ELS) . For ELS details, see Using the Enhanced Layer 2 Software CLI .

To configure a static IP-MAC address binding in the DHCPv6 snooping database:

To view results of the configuration steps before committing the configuration, type the show command at the user prompt.

To commit these changes to the active configuration, type the commit command at the user prompt.

• secure-access-port

You can add static (fixed) IP addresses and bind them to fixed MAC addresses in the DHCP snooping database. These bindings are labeled as static in the database, while those bindings that have been added through the process of DHCP snooping are labeled dynamic .

To configure a static IP address/MAC address binding in the DHCP snooping database, you must first create a group of access interfaces under [edit bridge-domains bridge-domain-name forwarding-options dhcp-security ] . Creating this group automatically enables DHCP snooping, which is a prerequisite for creating the DHCP snooping database. The following procedure shows the configuration in two steps, but it can be done in one. You can then configure a specific interface within the group to have one or more static IP-MAC address bindings.

To configure a static IP address and MAC address binding in the DHCP snooping database:

• Create a group by including an access interface: [edit bridge-domains bd-name forwarding-options dhcp-security] user@device# set group group-name interface interface-name
• Configure a static IP address: [edit bridge-domains bd-name forwarding-options dhcp-security] user@device# set group group-name interface interface-name static-ip ip-address mac mac-address

• Help Center
• Speakers and Displays
• Nest Thermostat
• Cameras and Doorbell
• Locks and Alarm Systems
• Smoke Alarms
• Subscriptions and Services
• Nest Common Concerns
• Your privacy
• Google Nest
• Privacy Policy
• Terms of Service
• Submit feedback
• Speakers and Displays Get started Explore features Change your settings Fix a problem Warranty, manual and returns
• Nest Thermostat Introducing Nest thermostats Get started Explore features and settings Fix a problem Warranty, manual & returns
• Cameras and Doorbell Introducing Nest cameras and doorbells Get started Explore features and settings Fix a problem Warranty, manual & returns
• Locks and Alarm Systems Locks Alarm Systems
• Smoke Alarms Introducing Nest Protect Get started Explore features and settings Safety and certifications Fix a problem Warranty, manual & returns
• Wi-Fi Learn about Wifi products Get started Features and settings Fix a problem Warranty, manual & returns Your privacy
• Subscriptions and Services Nest Aware Partner Devices and Services Nest Renew Rush Hour Rewards HVAC monitoring Nest Pro installation ADT
• Nest Common Concerns Nest Products Nest App Accounts Notifications and Emails
• Features and settings
• Network settings

DHCP IP reservation or Set a Static IP address for a device

To get the most out of Google Home, choose your Help Center: U.S. Help Center, U.K. Help Center, Canada Help Center, Australia Help Center .

When you use DHCP IP reservation, you're telling your Wi-Fi network to assign the same IP address to a specific device whenever that device connects to your network.

Why use DHCP IP reservation or Static IP

Most devices use DHCP, which assigns dynamic IP addresses, as a default. But sometimes, you want devices to always have the same IP address.

For example, a wireless printer. When you print something, your computer and printer locate each other using IP addresses. If your printer’s IP address keeps changing, your computer may not always be able to find it. Giving your printer a static IP address ensures that your computer always knows the address of your printer as it won’t change if it’s rebooted or if a DHCP IP lease expires.

• You'll need DHCP IP reservation (Static IP for your client) if you want to set up port forwarding to that device.
• You can customize the subnet you use under LAN settings (if you prefer to use a different subnet).
• This article applies only to local devices connected to your router (laptop, smartphone, tablet, etc.). They can have static IP addresses that only your router sees. The outside world won’t see these static IP addresses. But your router can also have a static IP address that the rest of the internet sees. Learn about Static IP for your Wifi point’s WAN .

Change your DHCP settings

• Tap the device for which you’d like to assign a static IP.

Note : You may need to disconnect this device from your Wi-Fi network and reconnect it before it is assigned the reserved IP.

Was this helpful?

Need more help, try these next steps:.

Get an answer from a google advisor here Message an Advisor

• Articles Automation Career Cloud Containers Kubernetes Linux Programming Security

How to troubleshoot DHCP communication problems on your network

%t min read | by Damon Garn

Imagine you have a repurposed enterprise switch with a Dynamic Host Configuration Protocol (DHCP) service that you need to troubleshoot. There is little information available about the switch's configuration or previous deployments. The device is reported to be functional and should lease Internet Protocol (IP) address configurations to clients. However, the attached clients are not receiving IP configurations from the switch.

There are many ways to troubleshoot this, including the ones I'll explore in this article: network scanning and packet sniffing tools. An advantage of scanning and sniffing tools is that they display exactly what is happening on the network. Not what the network should do, but what it is doing.

DHCP uses a four-step process to enable clients to lease an IP address configuration:

• DHCP DISCOVER: Client broadcasts that it needs to lease an IP configuration from a DHCP server
• DHCP OFFER: Server broadcasts to offer an IP configuration
• DHCP REQUEST: Client broadcasts to formally ask for the offered IP configuration
• DHCP ACKNOWLEDGE (ACK): Server broadcasts confirming the leased IP configuration

These broadcasts use ports 67/udp and 68/udp. If you're not familiar with how DHCP works, see Static and dynamic IP address configurations: DHCP deployment .

Start with the basics

First, check all the basics:

• Does physical connectivity exist with functional network media?
• Have you restarted the DHCP service?
• Is a DHCP scope configured?
• Do the server and client logs display any clues as to why the leases fail? (If so, try to fix those issues before moving on.)

Once you've confirmed the above (including that there aren't any clues in the logs), follow the steps below to use network scanners and packet sniffers to display valuable troubleshooting information.

Scan for the DHCP server

One logical step is to confirm that the DHCP service device has a network presence. An Nmap scan verifies its identity on the network. Many articles describe how to use Nmap . Begin with a basic ping sweep that identifies all hosts on the segment. Run the scan from a connected device with a static IP address configuration.

For a basic ping sweep to identify available hosts on the 192.168.1.0/24 network, type:

Good news: The network device hosting the DHCP service was detected. If it appears to have a legitimate IP address configuration, then it should be able to lease addresses. Refer to the organization's network diagram to ensure Nmap detects the nodes you expect to see.

If the results indicate it did not find the DHCP server on the network, check its static IP address configuration, ensure network interface controllers (NICs) are enabled, and so on.

Sniff for DHCP traffic

You might be asking: What DHCP traffic is being exchanged? The clients send DHCP DISCOVER queries, and the server provides DHCP OFFER responses. Use a protocol analyzer (or packet sniffer) to intercept network traffic and ensure the communication occurs as expected. The two primary examples of sniffers are tcpdump and Wireshark . Which you select is a matter of preference, familiarity, and what is installed on the system.

Sniffing network traffic with tcpdump

The tcpdump utility is fairly common on many Linux admin computers. If not, use dnf to install it:

The network interface you want to monitor must be in promiscuous mode. You set this using the ip command. For example, to configure eth0 :

You can configure tcpdump to grab specific network packet types, and on a busy network, it's a good idea to focus on just the protocol needed. This example gathers information on eth0 for UDP ports 67 and 68 (DHCP) in verbose mode. tcpdump writes the output to a file named dhcp.pcap :

View the file's contents using tcpdump (rather than a standard text editor!). The read option is -r , followed by the filename:

tcpdump can read the file, but it may be more visually appealing and easier to filter the output by opening the file in Wireshark. Launch Wireshark, go to the File menu, select Open , and select the output .pcap file (the exact process may vary by version).

First, establish whether the clients sent DHCP DISCOVER queries (remember, the client initiates the lease-generation process). If so, then the clients are likely functioning properly. If DHCP DISCOVER queries are getting sent, check for DHCP OFFER responses from the server. Do these responses exist and are they offering the correct information?

[ Download the Bash shell scripting cheat sheet . ]

Sniffing network traffic with Wireshark

Wireshark is another excellent traffic-sniffing tool, and the process is basically the same as with tcpdump. It's best to run Wireshark from the DHCP server in this case because the client computers aren't configured. Another option is to configure a central troubleshooting workstation with a static IP address to capture all traffic. Wireshark has excellent flexibility, and you can also run it from non-Linux systems.

Set the capture filter for the appropriate network interface (there isn't a capture filter for DHCP), and begin the capture process. Again, confirming the DHCP DISCOVER and DHCP OFFER communications is key. Next, start a DHCP client workstation to initiate the lease-generation process. Stop the capture after about one minute, at most. The DHCP query occurs very early in the operating system's startup procedure.

Save the capture file, if desired. In the Display filter box, type dhcp and select Enter to filter the packets. Wireshark now displays the DHCP packets picked up from the network. The client packets are DHCP DISCOVER communications, and the server should reply with a DHCP OFFER. If both sets of packets are displayed, the devices are communicating correctly. If either set is missing, then the related device has the issue. DHCP REQUEST and ACK exchanges are also displayed if the lease-generation process is successful.

[ Get access to a free trial of full access to Red Hat's curriculum . ]

Use an Nmap script

While Nmap can conduct general scans and protocol analyzers can display information based on packet captures, what about a more complete solution? Browse the Nmap site for the Nmap Scripting Engine (NSE). It contains more than 600 scripts with preconfigured settings for various Nmap scans. Authors create and share these scripts. In this scenario, the broadcast-dhcp-discover script helps with DHCP troubleshooting.

The script generates a DHCP DISCOVER message, the same as a standard DHCP client, and logs the DHCP OFFER responses from any DHCP servers. Not only can this information prove that the DHCP server is answering requests from clients, but it also detects rogue DHCP servers (rogue DHCP servers may be planted in the network by malicious actors, or they might be misconfigured servers or unknown servers deployed by administrators). The script should detect any DHCP servers because the DISCOVER message is broadcast to the 255.255.255.255 address.

The basic syntax for Nmap scripts, with the DHCP broadcast script as an example, is nmap --script broadcast-dhcp-discover . A more specific DHCP syntax is:

The unicast version of the script , dhcp-discover , sends a direct query to the DHCP server. Notice the query is addressed to the DHCP server:

This query generates a response from the server that provides basic configuration information and suggests that the service is communicating. The response to this message may vary by DHCP service type, but any response should indicate functionality. The DHCP server is likely misconfigured, not running, blocked, or otherwise unavailable if no response is detected. Regardless, it identifies the server as the problem in this scenario.

Note: There are corresponding scripts for IPv6 network troubleshooting, as well.

Start with the simple stuff

Narrowing the scope of the problem to specific network communications by using packet sniffers gives the most granular view of what's happening on the network. Confirming the presence of the DHCP server on the segment with Nmap is a good way of knowing what you think is on the network is actually on the network.

I want to point out a general note on my troubleshooting methodology in this article. Notice that I began with the simple stuff: physical connectivity, service status, service configuration, logs, and such. Begin with the simple things and move toward the more complicated. Just because a network is complex does not mean the problem is complex.

Damon Garn owns Cogspinner Coaction, LLC, a technical writing, editing, and IT project company based in Colorado Springs, CO. Damon authored many CompTIA Official Instructor and Student Guides (Linux+, Cloud+, Cloud Essentials+, Server+) and developed a broad library of interactive, scored labs. He regularly contributes to Enable Sysadmin, SearchNetworking, and CompTIA article repositories. Damon has 20 years of experience as a technical trainer covering Linux, Windows Server, and security content. He is a former sysadmin for US Figure Skating. He lives in Colorado Springs with his family and is a writer, musician, and amateur genealogist. More about me

Try Red Hat Enterprise Linux

Download it at no charge from the red hat developer program., related content.

[Wireless Router] How to manually assign IP around the DHCP list?

Send the page link to your email

Please enter your email

Scan QR code to open this page with your smart phone.

In general, the device connected to ASUS router will receive a dynamic private IP address from router DHCP server, like 192.168.1.3.  However, if you want to share files in a computer to other devices, then you might need a manual assign IP function to set a static IP for the computer so you don't need to search and confirm the IP address of the computer every time when you want to access it.

To assign a fixed IP address for your devices, you may follow the steps below.

Method1 ： You can assign a fixed IP address from your device's network card. (For how to configure the built-in network card of your device, please contact the device manufacturer.)

Method2: Set up a fixed IP for device via ASUS router DHCP server.

Step1 .  Connect your computer to ASUS router via Wi-Fi or Ethernet cable.

    Note : Wired connection is recommend to avoid setup interruptions due to unstable wireless network signals

Step2:  Open a web browser and navigate to Web GUI. https://www.asusrouter.com

Step3:   Enter your login username and password on the login page and then click [ Sign In ]. 

     Note:  If you forget the user name and/or password, please restore the router to the factory default status and setup. (The default username and password is admin/admin).   

   Please refer to  [Wireless Router] How to reset the router to factory default setting?   for how to restore the router to default status.

Step 4 : Go to [ Advanced Settings ] > [ LAN ] > [ DHCP server ], you can find the IP address range of RT-AX92U is 192.168.50.2 ~ 192.168.50.254.

Step5:  Find [Enable Manual Assignment] and click [Yes] to enable manual assign function.

Step6:   In Manually Assigned IP area, please fill in the device MAC address and the IP address binding to this device only.

     Client Name (MAC Address) ：Use the dropdown list to choose the device or manual enter the device's MAC address.

     IP address ：Enter the IP address that you want to bind to this device.  Please make sure the IP address needs to be in the IP pool of your DHCP server.

                         For example, if the IP pool of your router’s DHCP server is 192.168.50.2~192.168.50.254​, you should enter an IP address within this range, like 192.168.50.75.

     DNS server (Optional) ：Default is blank. You can enter the preferred DNS server if needed.

Step7:   Click the "+" icon and the [Apply] button to complete the setting.

Step8:  You will be direct to DHCP page if the setting is completed. Please make sure the rule you just set does show up in the manual assign IP list and MAC address/IP address are correct.

1. What is DHCP server?

   A DHCP (Dynamic Host Configuration Protocol) server in ASUS router can provide user's devices a private IP address, Subnet mask, Default gateway, DNS server that user does not need to manual assign IP for devices.

2. Why can't I manual assign IP to my device successfully after following the steps?

    a. Please make sure you've set and apply the rule successfully and you can see the rule show up in the manual assign IP list.

    b. Please make sure the device MAC address is correct.     c. Please make sure your device's network card is set to obtain IP automatically.     d. Please upgrade your router to latest firmware and reset your router to default status and try again from Step1.

    For how to do firmware upgrade, please refer to: [Wireless] How to update the firmware of your router to the latest version ?

    For how to reset router, please refer to:  [Wireless Router] How to reset the router to factory default setting?

3. Can I change to the IP address after rule is set?

    No. If you want to assign a different IP address for same device, you need to click the delete button to remove this rule and apply the setting first then back to Step4  to set a new rule again.

How to get the (Utility / Firmware)?

You can download the latest drivers, software, firmware and user manuals in the  ASUS Download Center .

If you need more information about the  ASUS Download Center , please refer this  link .

Was this information helpful?

What we can do to improve the article?

• Above information might be partly or entirely quoted from exterior websites or sources. please refer to the information based on the source that we noted. Please directly contact or inquire the sources if there is any further question and note that ASUS is neither relevant nor responsible for its content/service
• This information may not suitable for all the products from the same category/series. Some of the screen shots and operations could be different from the software versions.
• ASUS provides the above information for reference only. If you have any questions about the content, please contact the above product vendor directly. Please note that ASUS is not responsible for the content or service provided by the above product vendor.
• Brand and product names mentioned are trademarks of their respective companies.

• Static DHCP Reservations for Unifi Devices

I switched my home network over to Unifi gear a few years back and have been thoroughly impressed. In my experience, it’s fast, reliable, and fairly inexpensive. However, some of the user interface can be a little less than intuitive. I hit the following friction point every time I add a new piece of Unifi gear to the network.

Creating DHCP Reservations for Unifi Gear

I like to keep my networking infrastructure in a loosely organized IP topology. Rather than hard-coding static addresses on the specific devices, I prefer to create DHCP reservations. You would think this would be easy, but for some unfathomable reason, the Unifi controller hides the ability to set DHCP-assigned IPs for Unifi specific gear. It’s important to note that these steps are not necessary for regular devices on your network, just for the infrastructure.

Find your new device on the Devices tab in your Controller. In this example, I’ll be giving a static IP to u6-lite-01 .

Select your new device and expand the Details tab to find your device’s MAC address. Write the MAC down somewhere.

• Navigate to the Clients screen in the controller and select + Add Client at the top.

Add a new client with MAC + alias, click Add (don’t set fixed IP yet!).

• Still on the Clients screen, select + All Configured Clients on the top.

Filter to your newly added alias.

• Select your new device.

Navigate to the Network tab and give it the fixed ip.

• Find your device and restart it.

Enjoy your AP at its new IP!

• Recent Posts
• Unit Testing Angular Directives with bindToController
• Angular Service as a Kendo DataSource
• Project Health Checklist
• Unit Test Transactions in Visual Studio Load Tests
• C# Code Smell: Static Classes and Methods
• Code Smells: #region and Outlining
• A Commit Message Experiment
• An Angular 'Any Other Click' Directive
• The Great American Teach-In
• mark@[this-domain].com

• Get Started News & Events Events Ignite Conference News Welcome Guide LIVEcommunity Support Info FAQ
• Discussions Network Security Next-Generation Firewall Discussions VM-Series in the Public Cloud VM-Series in the Private Cloud CN-Series Discussions AIOps for NGFW Discussions Panorama Discussions GlobalProtect Discussions Strata Logging Service Discussions Cloud NGFW Discussions Cloud Delivered Security Services Threat & Vulnerability Discussions Endpoint (Traps) Discussions Enterprise Data Loss Prevention Discussions Next-Generation CASB Discussions IoT Security Discussions Secure Access Service Edge Prisma Access Discussions Prisma Access Insights Discussions Prisma Access for MSPs and Distributed Enterprises Discussions Prisma Access Cloud Management Discussions Prisma SD-WAN Discussions Prisma SD-WAN CloudBlades Discussions Prisma SD-WAN AIOps Discussions Autonomous DEM Discussions Cloud Native Application Protection Prisma Cloud Discussions Cloud Identity Engine Discussions Security Operations Cortex XDR Discussions Cortex XSOAR Discussions Cortex Xpanse Discussions Cortex XSIAM Discussions General Topics Custom Signatures VirusTotal
• Blogs Community Blogs Engineering Blogs
• Products Network Security GlobalProtect Next-Generation Firewall Cloud NGFW for AWS Cloud NGFW for Azure AIOps for NGFW Strata Cloud Manager Strata Logging Service Getting Started With VM-series Private Cloud Oracle Cloud Infrastructure Alibaba Cloud AWS GCP Azure CN-Series Panorama Threat Prevention Services SSL Decryption App-ID Content-ID User-ID 5G Cloud Delivered Security Services Next-Generation CASB IoT Security Enterprise Data Loss Prevention Secure Access Service Edge Prisma Access Prisma Access Insights Autonomous Digital Experience Management Prisma Access Cloud Management Prisma Access for MSPs and Distributed Enterprises Prisma SD-WAN Prisma SD-WAN CloudBlades Prisma SD-WAN AIOps Cloud Native Application Protection Prisma Cloud Cloud Identity Engine Security Operations Cortex XDR Cortex XSOAR Cortex Xpanse Cortex XSIAM Hub
• Tools Integration Resources App for QRadar Cloud Integration Expedition HTTP Log Forwarding Maltego for AutoFocus
• Education Services Certification Instructor-Led Training Digital Learning Education Services Help Center Education Services Upcoming Events Education Services Articles
• Member Recognition Spotlight News Member Spotlights Member Testimonials Cyber Elite Program
• Podcasts PANCast™ PANCast™ Episodes PANCast™: Episode Ideas Submission Threat Vector

Unlock your full community experience!

• Access exclusive content
• Connect with peers
• Share your expertise
• Find support resources

GlobalProtect Support for DHCP-Based IP Address Assignments

• LIVEcommunity
• Network Security
• GlobalProtect
• GlobalProtect Articles
• Subscribe to RSS Feed
• Mark as New
• Mark as Read
• Printer Friendly Page

on ‎05-09-2024 11:15 AM

• globalprotect gateway
• Dynamic DNS
• globalprotect
• GlobalProtect Gateway
• Back to Articles
• GlobalProtect Portal Internal Gateway Not Filtering by Source IP Address in GlobalProtect Articles 03-31-2022
• Updates on Certificates for GlobalProtect App Log Collection Feature in GlobalProtect Articles 03-09-2022
• New Feature (Disable Local Subnet Access) for Linux Clients in GlobalProtect Articles 01-19-2022
• Seamless Login With GlobalProtect (Client Certificate Authentication) in GlobalProtect Articles 01-13-2022

• GlobalProtect 17
• GlobalProtect App 1
• globalprotect gateway 1
• GlobalProtect-COVID19 12
• GlobalProtect-Resources 9
• NGFW Configuration 11
• Prisma Access 1
• PrismaAccess-COVID19 1
• VM-Series 1
• Article History

• About Palo Alto Networks
• Privacy Policy
• Terms of Use
• Community Blogs
• Community Help
• Knowledge Base

Special Features

Vendor voice, user topics, article topics, watch out for rogue dhcp servers decloaking your vpn connections.

A newly discovered vulnerability undermines countless VPN clients in that their traffic can be quietly routed away from their encrypted tunnels and intercepted by snoops on the network. Dubbed TunnelVision by the eggheads at Leviathan Security Group who uncovered and documented it, the technique (CVE-2024-3661) can result in a …

So what if I have my own little travel router and then connect to a VPN? Travel router connects to public net, I connect to travel route via VPN client software on my computer.

I’m no networking expert but I suspect that your travel router will request DHCP from the public network when it joins. At that point it becomes vulnerable and your DNS traffic can be sniffed. Although I’m guessing it will be easier for you to configure your router to avoid this (by disabling option 121) rather than trying to configure your OS.

Never heard of travel routers, sounds cool.

What I don’t get is how the rogue DHCP server is issuing valid sessions to clients. If the public wi-if network had a proper DHCP server correctly issuing IP addresses to guests, then the rogue DHCP server joins, how can that rogue issue valid IP addresses? Maybe the rogue first pretends to be a guest to find out what the next valid address is but this article didn’t make that sound likely. I need to do some reading but this problem sounds unfixable for some time to come. I’m staying at home.

"What I don’t get is how the rogue DHCP server is issuing valid sessions to clients."

Pretty simple. Two options. The first one is a rogue admin compromising the real/only DHCP server of the network. From the hollywood scenario of an uber-hacker spy posing as a maintenance employee in the cozzy little cafe frequented by the target to insert a rouge DHCP, to the more likely scenario in poor countries of a spy bribing an employee to look the other way for 10 min.

The second one, which is the one you probably are most curious for: the normal behaviour of DHCP is that the client broadcasts a DHCP request, and there may be more than one DHCP server in the network, any or all of them can answer, and is to the client to choose which request to accept, however it sees fit.. Most clients go for fist answer.

If your rogue DHCP server can answer faster than the network's real one, you are golden.

This can be prevented by using client issolation in the AP/router, but then your laptop will not be able to chromecast to the smartTV in the room. And in the case of CyberCafees, they will forget the setting, or will not use it because they are using the same AP (with different SSIDs and passwords) for internal and guest traffic... Also preventable by configuring the Eth switch or router to drop all DHCP response packages not originationg from the IP/MAcAddr/port of the real DHCP server (preffer the port, the IP can be spoofed) . Not all Eth switches or routers can do this.

As for the valid leases, many a provider of prosumer gear (say, the router for a small cafe) and pro gear (say, the router for a medium hotel), send the gear pre-configured to assign addresses in the 10/8 or 172.16/12 range. Plenty of addresses to spoof without fearing you assigning an address already used. Double points if an attacker maps the network beforehand. And even if you are in 192.168/16, more often than not, there is a bunch of addresses reserved, outside of the DHCP range, for things that need a static IP address (like servers, printers and such).

Heck,the rogue router can even dish addresses in an address range different from the one the network uses (if the hotel wifi uses 10/8 you can dish addresses in 172.16/12) but that means you have to provide other services aside from DHCP, including NAT, and that is on top of the horsepower needed to Spy the traffic. That Workstation replacement laptop the attacker is using will start to struggle, and be noticed like a sore thumb amid the fan noise ;-)

Oooh, painful

"Most clients go for fist answer."

Hey I'm open minded but I think if that's happening I'm hardcoding my IPs and hosts files!

> What I don’t get is how the rogue DHCP server is issuing valid sessions to clients.

Lets say that the rogue DHCP server initially joins the network as a client, then cycles through a bunch of valid looking MAC addresses and requests all the IP numbers that the real DHCP server can provide. Now that knows all the IP addresses that it can allocate (for the lease duration), it changes into a DHCP server and hands out fully valid IP addresses with whatever options that it wants (including increasing the lease duration). The real DHCP server ran out of free IP addresses, so it is not like it can respond to any new clients DHCP requests, so the rogue DHCP server is the only DHCP server that can respond to requests for at least the lease duration.

Then you are safe. That case is similar (almost equal) to using a VPN inside a VM with a NON-Bridged adapter.

DHCP option 121 works by over-riding the routing tables if your machine. If your t-router connects to the network, the T-ROUTER's tables will be infected, but, when your laptop gets a DHCP lease fromn the t-router, the LAPTOP's routing tables are not altered.

I'm actually curious about whether Windscribe is vulnerable on Windows. It can override the OS DNS options with options like OpenDNS, Cloudflare, or their own DNS service. Granted someone could always covertly poison those servers, but ostensibly they're employing some sysadmins to monitor for things like that, so it's at least less likely compared to some public wifi at a McDonalds or an airport where it's unlikely anyone's paying any attention to it unless it goes down, and then all they do is powercycle it.

This is an issue with DHCP, not DNS. Even if your VPN software specifies it's own DNS servers, those requests can still be re-routed by an attacker, along with any other traffic. Allowing them to at least monitor all your communications, even if they can't easily decrypt things like HTTPS.

That's not to say...

That DNS will not introduce it's own issues.

Because....well...it's DNS.

as far back as 2002?

I can never figure out this "classless" business. Does that mean that original option 33 "Static Route Option" does not present the same problem?

In any case, option 121 (" classless static routes") was added because it had already been implemented by DHCP servers as a private option: for MS, it was option 249 before it was standardized as 121. All your old (95, NT, 2K, 2003, XP) Windows DHCP clients will support 249, not 33 or 121.

Re: as far back as 2002?

¿remember that there were class A (/8 addresses), class b (/12), class c (/16) and class d (/8) addresses?

Well that was very inneficient (my university has a /16, even if we do not need more than 1000 addresses, but at the time we got our assignment, the classless system was not invented yet)

Since there were only 4MM IP addresses and many were reserved for stuff like multicasting, something had to be done, the solution was the classless address sytem, were things like a /10 address space could be givem to an organization that only needs 1000 addresses (like my university).

Problem was, routing that stuff was quite hard, so, new infrastructure and methods to assign and route that stuff was needed.

Tanenbaum's book on networks has a great explaining on it.

Its bollocks (ish)

This is one of those rather naff "security as theatre" things. Note how nauseatingly long the blog post is, with silly graphics - its thesis can be boiled down to one sentence (own your routing tables). Its all about fiddling with routing tables and sod all to do with VPNs but by pulling in VPNs this nonsense gets on a few front pages.

If you don't control your network, then you might not own your network. Obvs.

What a load of tosh. It would be nice if, instead of trying to gain internet points with a fright night article, they simply spelled out how routing tables can be abused and here is our recommendations on how to fix it.

I utterly despise this sort of wankery.

Re: Its bollocks (ish)

"VPNs this nonsense gets on a few front pages" yep, with it comes clicks, likes, kudos and some of that juicy investment money from various sources.

Disagree in this case (although of course there is some theatre), as it seems a very real threat for using public wifi, but thinking you are encrypted - whether with a private or company VPN solution. Apart from if you're using Android, apparently.

Surely the "official" DHCP server will suddenly start seeing traffic from addresses it knows it didn't issue ?

At which point some sort of alert thingy could be flagged up ?

Also my experience of multiple DHCP servers on the same network is that it causes almost instant network failure. Certainly did when we allowed laptops running Windows Server with DHCP enabled t connect to our guest network.

Re: Hang on.

Also my experience of multiple DHCP servers on the same network is that it causes almost instant network failure.

It depends what parameters those DHCP servers are set up to allocate to their clients, doesn't it, it's not the mere fact of having multiple DHCP servers that causes an issue. If your laptops are setting themselves up as the default gateway and DNS server for clients they serve, when they can not, in fact perform those functions usefully, then yes, it will cause network failure. However, if they were handing out working gateway and DNS settings, and were taking care not to allocate IP addresses that already exist on the network, problems would be much less noticeable, although you'd probably end up with IP address conflicts sooner or later. But if you're running a nefarious DHCP server that you don't want people to notice, you're going to make sure that clients do have a configuration that *appears* to work normally, and that's seems perfectly doable. At least, that's how it looks to me, I'm not a networking guy.

It would be the same effect as if you'd set up a device on a static IP.

Furthermore, in an attack on a simple network (eg free wifi in a cafe), the attacker would probably route all traffic through their machine for inspection, before forwarding it on to the correct router. So the only sign would be that all traffic would appear to be coming from a single client.

Even then, an attacker could request multiple IPs from the 'real' DHCP server (possibly as part of requesting all the DHCP addresses it can grant, so it won't interfere with the attacker's rogue DHCP server), and route outgoing traffic over multiple IPs so it would all look pretty normal.

On my (now very old) Windows network, when the windows DHCP server notices a rogue DHCP server, it goes offline and there is a message in the server log. I won't notice it at all until things fall off the network.

It's not unknown for residential routers to power up in pass-through mode, request a DHCP address from the ISP, and leak the response onto the internal network, before the firewall and netmask come up.

What am I not understanding about this?

From what I can tell, the VPN traffic is still encrypted. All that is happening is that it goes on one extra hop on an untrusted network, just like all the other untrusted hops is goes through while traversing the internet.

Re: What am I not understanding about this?

It's worse than that. Part of the DHCP spec allows it to push a static route that is guaranteed to have a higher priority than your VPN gateway. A malicious actor can use it so your OS never sends your network traffic to the local VPN entry point but instead to the rogue network.

In this case wouldn't VPN users notice that the 'exit point' wasn't in the country they selected?

If they are using the VPN for Geoblock avoiding or Selective country shopping... yes. If you are using it to circunvent censoring or to avoid spying by an oppresive regime, most likely not.

I live in Venezuela, ask me how I know

Thanks for the reply, yes got friends in South America, one is in some unnamed country that uses 220v (but actually closer to 170) and is former communist, no idea which country

It manipulates the routing table to stop the traffic ever reaching the encrypted VPN tunnel, and uses the rogue DHCP server as a snooping gateway to pass on the traffic to the legitimate destination.

the VPN traffic is still encrypted.

That would be unusual. VPN's normally appear as virtual network adapters. If no traffic is sent through that network adapter, because it's a low-priority route, nothing gets encrypted.

This post has been deleted by its author

My limited understanding of E2EE is that encryption occurs before it leaves the device, be it a cell phone or desktop.

If intercepted as described in the article there’s only an unencrypted file to look at.

If this is all true then maybe ensure the important communication is all performed using E2EE?

Yes, if you are using E2EE (or even HTTPS), the data is encrypted before it leaves THE APPLICATION (which is even better than the device). So, yes, Is important to use as much E2EE as possible.

1.) there may be holes/weaknesses in the Encryption. For instance, if a website has both an HTTP and an HTTPS variant which have the same static data, it means that we can get encryped and decripted data for the site, leading to a cryptographic attack (see point 4)

2.) The app may be misconfigured.

3.) A MITM Attack may be performed.

4.) Even in E2EE Scenarios, there is info that is exfiltrated in plaintext, for instance, the IP and port of the receiving device, and, to give a concrete example, in HTTPS, the Address of the WebPAge goes as plaintext, therfore, can be either censored or logged by the attacker.

So, E2EE is not a cure-all.

Bulk surveillance will probably not be possible using this vuln, but spying on high-value tragets probably is.

A.k.a Option 121

Rogue DHCP Servers

On large campuses DHCP requests were (are) often relayed by the switches back to the enterprise DHCP service(s) so there is usually enough latency for a rogue DHCP server to get in first. Saw this a few times when students (and those who should have known better) would connect a cheap wifi modem/access point to the lan for wifi access to the campus network. I used to run dhcp_probe to flush out the culprits. :)

Saw it again ten years later long after campus wide wifi had be deployed when a student (?) plugged his phone into his computer to charge and the phone started handing out dhcp leases to the lan that his computer was connected to. Never did find out the details as it was "rectified" by others to save someone further embarrassment I suspect. :)

If you can get dhcp server onto a lan segment and the clients trust its leases and options you are pretty much done. :)

I suppose you could do something with IEEE 802.1x port security but I have never been anywhere •1x has been implemented for wired ethernet. :(

Re: Rogue DHCP Servers

Another issue is that most DHCP servers and deployments aren't aggressively performance tuned. Attack code can be, and a whole host of 20 year old layer 2 attacks have shown that at the scale of an attacker on the local network, it is easier to speed optimize most attack code than a fully compliant and general purpose server for most network services.

The nut of it is a valid server needs to do stuff like integrity checks, while an attacker needs to get the first packet in. If they do then they become the MITM and can potentially spoof traffic to fool a vailid DHCP server. Defensively you'd probably need to be sniffing the local traffic on the wire to spot it.

This is another example of relying on old protocols from before the existence of a robust security model. Blind trust in the results of and ARP, DHCP, or DNS request break the security of too many of the bolt on security measures we have tacked on to IP networks. This problem extends up to the CA/SSL model, where any CA can sign or spoof a cert that will flag as trusted, even if that CA is run by the government of a hostile nation. That system is also totally dependent on flawed assumptions about DNS being trustworthy.

(as a side note, 802.1x is kind of a hot mess, as the connection setup time is kind of awful. On wireless networks where roaming is happening, repeated 802.1x negotiations will convince your users your wifi is broken or the internet is down on a daily basis. Expect revolt under those circumstances. That's what happens when it's all dependent on a dino like RADIUS...)

Of course, the simple answer to this (and other DHCP based attacks) is to harden your LAN. These days you don't need to be all that far up the feature tree for a network switch to include things like filtering DHCP packets from bogus servers. Turn this on for every port except your own authorised DHCP server(s) and the problem disappears. That doesn't help users on other networks where the operator wouldn't know what DHCP is, let alone how to mitigate such risks - so most non-corporate networks then.

And of course, that's where the big risks lie. As a responsible security minded organisation (or just pro level home admin) you can properly configure you own network, and configure your user devices - but when your user goes and connects to ${random_wifi} you lose that control.

Sorry, this ais a load of bollocks.

The crux of the argument is that if you accept unsolicited routing directives from your lan, then they can be set to divert traffic to another system.

Well, duuuh

We were playing with this sort of thing 30 years ago.

No system I use, or have ever set up would be vulnerable to this, and that's would be across many operating systems.... even windows!

A better summary for this article could be "Incorrectly configured computers can behave incorrectly"

So people still need to know about these issues

And as is so often the case, I'm glad it "works for you" but not everybody has enough control over the devices they use to fully secure them from these issues.

So it would be better to beat up the vendors to provide people a secure configuration out of the box, warnings about potentially dicey settings being offered when a device connects to a network, and access to the settings needed to resolve them.

If the devices you use and the networks you use them on are fully secure, great. I'll even applaud you for already having locked yours down. Maybe share that expertise instead of mocking people. But don't forget that is explicitly not true for most people, and many of them are using devices where they CAN'T fully lock the settings down from their side. Not knowing that can get good people hurt, arrested or killed in some parts of the world. I hope you are lucky enough not to live in one, but not everyone reading this probably is.

So don't pretend there isn't a place for and utility in articles like this.

Re: So people still need to know about these issues

You totally miss the point, in more than one way.

1) I wasn't mocking users, I was mocking the over-sensationalist way that the report (not this Reg article, but the original one that was being reported in) was written.. "ALL OS's AFFECTED (but android)". "NO WAY TO FIX IT". "RECENTLY DISCOVERED VULNERABILIITY" etc.

Crying wolf like that desensitises people to REAL issues.

2) Relating to criticising the sensationalist report, I was criticising any vendors who would be taken in by such a basic gaffe. I don't expect users, presented with a "plug and go" solution to assume anything is wrong. I grew up in a household of tech-illiterate people (maybe I was swapped at birth), and I would never expect them to understand this sort of thing.

If it was reported that some critical software was released with a stupidly basic vulnerability gaffe, and it was treated as almost the end of the internet world that couldn't be fixed, and someone replied "errr, thats' daft. it can be fixed, just by logging in and changing the password", would you chastise them for criticising the end users, or the hype of the report, and the stupidity of the programmers.?

POST COMMENT House rules

Not a member of The Register? Create a new account here.

Remember me on this computer? Post anonymously ?

Enter your comment

Add an icon.

Other stories you might like

Watchdog reveals lingering google privacy sandbox worries, meta, spotify break apple's device fingerprinting rules – new claim, dating apps kiss'n'tell all sorts of sensitive personal info, uk's investigatory powers bill to become law despite tech world opposition, apple's 'incredibly private' safari is not so private in europe, microsoft confesses april windows update breaks some vpn connections, a million australian pubgoers wake up to find personal info listed on leak site, dell customer order database of '49m records' stolen, now up for sale on dark web, end-to-end encryption may be the bane of cops, but they can't close that pandora's box, lawsuit accuses grindr of illegally sharing users' hiv status, google cools on cookie phase-out while regulators chew on plans, kaiser permanente handed over 13.4m people's data to microsoft, google, others.

• Advertise with us

Our Websites

• The Next Platform
• Blocks and Files

Your Privacy

• Cookies Policy
• Privacy Policy
• Ts & Cs

Copyright. All rights reserved © 1998–2024

Red Hat OpenShift 101 for OpenStack admins: Configuration

In the previous post , we oversaw the required  Red Hat OpenShift Container Platform   operators , their roles, and the format used to create the  Red Hat OpenStack Services on OpenShift (RHOSO) control plane. In this article, let’s review the deployment process.

We’ll base our observations on the Development Preview 3 code from  https://github.com/rh-osp-demo/dp-demo/ .

Let’s begin with the OpenStack Operator.

The OpenStack Operator

The OpenStack Operator consists of three parts (a CatalogSource , an OperatorGroup , and a Subscription ), each defining a different resource for managing Operators within an OpenShift/ Kubernetes cluster using the Operator Lifecycle Manager (OLM). The resources aim to set up an Operator for OpenStack, likely for managing OpenStack services within the cluster, are as follows:

These resources collectively set up an environment where the OpenStack Operator is available to be installed in the  openstack-operators namespace. The CatalogSource provides the metadata about available operators, including the OpenStack Operator, sourced from a specified image. The OperatorGroup defines the scope within which the Operator can operate, and the Subscription triggers the installation and management of the OpenStack Operator according to the specified channel and source catalog.

Let’s focus on the CatalogSource part:

• name: openstack-operator-index  - The name of the CatalogSource .
• namespace: openstack-operators - The namespace where the CatalogSource is created.
• sourceType: grpc   - Indicates that the catalog source uses gRPC to serve the index of available operators.
• secrets: A list of secrets, in this case, osp-operators-secret , that might be used by the catalog source, potentially for accessing private repositories.
• gprcPodConfig : Contains configuration specific to the pod serving the gRPC requests.
• securityContextConfig: legacy - Specifies a security context configuration for the pod. The exact meaning of "legacy" can depend on the cluster configuration.
• image : The container image URL for the operator index image, which should be adjusted to match the environment. This image hosts metadata about the operators available for installation, including the OpenStack operator.

Network isolation

Now that the operator is installed, let’s prepare the networking for the control plane, then the data plane.

First, we’ll work with the NNCP file used to configure the data plane network, which will configure the topology for each data plane network. It looks like the following ( source file ):

This YAML file defines a  NodeNetworkConfigurationPolicy for use with the NMState Operator in an OpenShift or Kubernetes environment. The policy specifies desired network configurations for nodes that match the defined nodeSelector. Here's a breakdown of the key components:

• apiVersion : Specifies the version of the NMState API used.
• kind : Identifies the resource type as NodeNetworkConfigurationPolicy , indicating that it's a policy for configuring network interfaces on nodes.
• name : The name of the policy, osp-enp1s0-worker-ocp4-worker1 , uniquely identifies it within the namespace.
• The first three are VLAN interfaces (type:  vlan ) with the names  enp1s0.20 , enp1s0.21 , and enp1s0.22 . Each interface is configured with a static IPv4 address ( 172.17.0.10/24 ,  172.18.0.10/24 , 172.19.0.10/24 , respectively) and specifies that IPv6 is disabled. DHCP is also disabled for IPv4, and each interface is brought to the up state. They are all based on the parent interface  enp1s0 and have VLAN IDs 20, 21, and 22, respectively.
• The fourth interface configuration applies to  enp1s0 itself, setting it as an Ethernet interface (type: ethernet ) with a static IPv4 address 172.22.0.10/24 , DHCP disabled, and IPv6 disabled. The interface is also set to the up state with an MTU of 1500.
• nodeSelector : Specifies a node's criteria for the policy to be applied. In this case, it selects a node with the hostname ocp4-worker1.aio.example.com with a worker role.

This policy aims to configure multiple VLANs on a specific worker node's enp1s0 interface in an OpenShift or Kubernetes cluster, assigning static IPv4 addresses to each VLAN and the parent interface. It effectively segregates network traffic into different VLANs for purposes such as separating internal API traffic, storage traffic, and tenant traffic, while also configuring the parent interface for another network segment. The policy targets a specific node identified by its hostname and role, ensuring that these configurations are only applied to the intended node.

NetworkAttachDefinition (NAD) file

This YAML snippet defines a  NetworkAttachmentDefinition object, part of the Kubernetes Network Custom Resource Definition (CRD) framework enabled by the Multus CNI plugin. This CRD is used to create multiple network interfaces in a Kubernetes pod. We will configure a NAD resource for each isolated network to attach a service pod to the network:

Let’s look at it: 

• apiVersion: k8s.cni.cncf.io/v1 : Specifies the API version for the CRD. The  k8s.cni.cncf.io/v1 indicates it's related to the CNI (Container Network Interface) plug-ins managed under the CNCF (Cloud Native Computing Foundation).
• kind: NetworkAttachmentDefinition : This tells Kubernetes that the defined resource is a  NetworkAttachmentDefinition , which Multus uses to understand how to attach secondary networks to pods.
• name: ctlplane : The name of the NetworkAttachmentDefinition , which will be referenced by pods that want to use this network configuration.
• namespace: openstack : Specifies the namespace where this NetworkAttachmentDefinition is created, indicating it's intended for use by pods running in the openstack namespace.
• cniVersion : The version of the CNI specification to use.
• name : A name for this specific network configuration.
• type : Specifies the CNI plug-in to use, in this case, macvlan, which allows a Kubernetes pod to have a unique MAC address via a parent host interface.
• master : The master interface on the host that the macvlan interface will be created on top of. Here, it's  ens224.4 , indicating a VLAN interface.
• type : The type of IPAM plugin to use, here whereabouts, which supports assigning IP addresses across multiple host nodes, avoiding IP address conflicts.
• range : The CIDR range from which IP addresses will be allocated.
• range_start ,  range_end: Define the start and end of the IP allocation pool within the specified range.

NMState resources

As described earlier, we must define IP address pools and L2 advertisements for the NMstate Operator. We must create an IPAddressPool resource to specify the range of IP addresses MetalLB can assign to services. Let’s have a look at our  osp-ng-metal-lb-ip-address-pool . It contains several entries, one per IP address pool we define. Let’s just pick one to detail, the ctlplane one:

What do we have:

• apiVersion: metallb.io/v1beta1 : Specifies the API version of MetalLB being used.
• kind: IPAddressPool : Denotes the kind of Kubernetes resource. Here, IPAddressPool is a resource type provided by MetalLB for defining a pool of IP addresses.
• namespace: metallb-system : Specifies the namespace where the resource is located. MetalLB's resources typically reside in a dedicated namespace, metallb-system , isolated from other workloads.
• name: ctlplane : The name of the IPAddressPool resource. This name is used to identify the pool within the MetalLB configuration.
• addresses : Lists the IP address ranges that MetalLB can allocate to LoadBalancer services.
• - 172.22.0.80-172.22.0.90 : Defines a specific range of IP addresses (from 172.22.0.80 to 172.22.0.90 ) that MetalLB is allowed to assign. This range should be within the network subnet accessible by the cluster and not used by other devices or services to avoid IP conflicts.

As we are using MetalLB in Layer 2 mode, define an L2Advertisement resource. This tells MetalLB to advertise the IP addresses from your network's specified pool(s). 

Let’s have a look at our  osp-ng-metal-lb-l2-advertisement YAML file. It contains several entries, let’s just pick the one relevant to ctlplane :

Here's a succinct explanation of its contents:

• apiVersion: metallb.io/v1beta1 : Specifies the version of the MetalLB API being used.
• kind: L2Advertisement : Indicates the resource type, an L2Advertisement . This type controls how MetalLB advertises IP addresses to the local network.
• name: ctlplane : The name of the L2Advertisement resource.
• namespace: metallb-system : The namespace where the resource is deployed, typically MetalLB's dedicated namespace.
• ipAddressPools : Lists the names of the IP address pools that MetalLB should advertise. In this case, it references the IPAddressPool ctlplane , which we defined earlier.
• interfaces : Specifies which network interfaces MetalLB should use to advertise IP addresses. Here, it's configured to use the interface named  enp1s0 .

This file tells MetalLB to advertise IP addresses from the  ctlplane IP address pool over the  enp1s0 network interface, making these IP addresses reachable on the local network through standard L2 networking mechanisms (ARP for IPv4, NDP for IPv6).

Let’s regroup what we have seen so far before we keep deploying our OpenStack Control Plane. When deploying MetalLB, you first apply the MetalLB resource to install MetalLB itself. Then, you define one or more  IPAddressPool resources to specify the range of IPs MetalLB can manage. Finally, you use  L2Advertisement resources to control the advertisement of these IPs on your network in Layer 2 mode.

MetalLB and NAD ( NetworkAttachmentDefinition ) serve different purposes. MetalLB is used to expose Kubernetes services of type LoadBalancer externally, allowing them to be accessible from outside the Kubernetes cluster. It's particularly useful in bare-metal environments where you don't have a cloud provider to provision external load balancers automatically. 

NAD with Multus allows for attaching additional network interfaces to pods. This is useful in scenarios where pods need to communicate over different networks or require specific network configurations that the default Kubernetes network doesn't provide.

In essence, MetalLB simplifies external access to services, while Multus and NAD enhance pod networking capabilities within the cluster.

Data plane network configuration

The data plane network configuration file will configure the topology for each data plane network. Its YAML file contains a  NetConfig header and then various network sub-sections, each defining a network to expose to the data plane network. 

Here is an extract of this sample configuration file:

The YAML snippet defines a custom resource named  NetConfig under the API group network.openstack.org/v1beta1 . This is not a standard Kubernetes API group, which implies it's part of a specific operator that extends OpenShift functionality related to integrating OpenStack networking capabilities with Kubernetes.

Here's a breakdown of what this YAML does:

• apiVersion: network.openstack.org/v1beta1 : Specifies the version of the API that the resource definition is compatible with. This is a custom resource definition (CRD) related to OpenStack networking under the v1beta1 version.
• kind: NetConfig : This indicates the type of the resource. The resource is used to configure how networking should be set up within for OpenStack-managed resources within Kubernetes.
• name: openstacknetconfig : The name of the NetConfig resource.
• namespace: openstack : This resource is in the openstack namespace.
• name: ctlPlane : Specifies the name of the network. It refers to a control plane network used for management and orchestration traffic in OpenStack.
• dnsDomain: ctlplane.aio.example.com : Defines the DNS domain used for the network.
• name: subnet1 : The name of the subnet.
• From 172.22.0.100 to 172.22.0.120
• From 172.22.0.150 to 172.22.0.200
• cidr: 172.22.0.0/24 : Typically, the CIDR should match the network of the allocation ranges and the gateway.
• gateway: 172.22.0.1 : Specifies the gateway for the subnet, which is the IP address used as the default route for traffic leaving the subnet.

From the  internalaip section, we also see we can define VLAN IDs and exclusion ranges:

• excludeAddresses:  IP range that the data plane should not use (these are the IP addresses used by the OCP cluster compute nodes (check the NNCP section above). 
• vlan:  VLAN ID used by the  internalapi network. The lack of this entry in the  ctlplane section denotes using a flat network.

OpenStack Control Plane deployment

Now that we have all of our networking defined, and provided we have our storage configured (the sample file we use relies on NFS, but we did not discuss it here), we can deploy the control plane.

The control plane deployment YAML defines the different OpenStack services that should be instantiated, and for each service its configuration. The file is quite long, so copying it here is difficult, but you can check a  sample file here .

Here is, from the above sample, the list of defined Services and Key Configurations (note that some services are disabled):

• Utilizes MetalLB for LoadBalancer with an IP of 172.22.0.89.
• Configured to use an external DNS server at 192.168.123.100.
• Database instance named openstack , using a secret osp-secret .
• Cinder API exposed via MetalLB with an IP of 172.17.0.80.
• NFS backend for Cinder Volumes with specific NFS configurations.
• Storage backend set to use Cinder with specific Glance and Cinder configurations.
• Glance API exposed via MetalLB with an IP of 172.17.0.80.
• Uses NFS for storage with a request of 10G.
• Exposed via MetalLB with an IP of 172.17.0.80.
• Uses a database instance named openstack and a secret osp-secret .
• Enabled with storage requests set for the database and cell instances.
• Uses a secret osp-secret .
• Deployed with a single replica.
• Deployed with a single replica, using a secret osp-secret .
• API and Metadata services exposed via MetalLB with an IP of 172.17.0.80.
• API exposed via MetalLB with an IP of 172.17.0.80.
• Configuration for northbound and southbound DBs, as well as the OVN Controller.
• Exposed via MetalLB with specific IPs for RabbitMQ services.
• API and Engine exposed via MetalLB with an IP of 172.17.0.80.
• Disabled in this configuration.
• Ceilometer enabled, with configurations for autoscaling and metric storage.

In summary, MetalLB is extensively used to expose various OpenStack services externally via LoadBalancer type services, with annotations specifying address pools and IPs. Storage utilizes both Cinder (block storage) and NFS, with specific service configurations detailed for different services. 

Each service utilizes a specific database instance and secrets for configuration and credentials management. Replicas and scaling define the number of replicas for certain services, indicating considerations for availability and scaling. And, finally, several services specify network attachments, indicating integration with specific network configurations for service communication.

We’ll complete the deployment process in the final part of this series: Red Hat OpenShift 101 for OpenStack admins: Data plane deployment 

• Red Hat Enterprise Linux
• Red Hat OpenShift
• Red Hat Ansible Automation Platform
• See all products
• See all technologies
• Developer Sandbox
• Developer Tools
• Interactive Tutorials
• API Catalog
• Operators Marketplace
• Learning Resources
• Cheat Sheets

Communicate

• Contact sales
• Find a partner

Report a website issue

• Site Status Dashboard
• Report a security problem

RED HAT DEVELOPER

Build here. Go anywhere.

We serve the builders. The problem solvers who create careers with code.

Join us if you’re a developer, software engineer, web designer, front-end designer, UX designer, computer scientist, architect, tester, product manager, project manager or team lead.

Red Hat legal and privacy links

• About Red Hat
• Contact Red Hat
• Red Hat Blog
• Diversity, equity, and inclusion
• Cool Stuff Store
• Red Hat Summit
• Privacy statement
• Terms of use
• All policies and guidelines
• Digital accessibility