Is a DHCP server needed essentially on SD-Access topology?

[hjson0001]

I am planning new network project with a customer and he wants SD-Access solutions.

We got some BOM from plural companies, and found something different between them.

Both have 3 DNA Centers, 3 ISEs, Border Switch(C9600), Fabric Edge Switch(C9200L), WLC(C9800-40, including AP), Stealthwatch.

However, one company doesn't mention a DHCP server separately, but the other put a 3rd party DHCP server.

As far as known, role of DHCP Server is need to build SD-Access to get IP address for users and pools.

I guess Fabric Border switch could conduct a DHCP server, so possible to skip a 3rd party DHCP server.

So, I am curious that fabric border switch carries out this role instead of DHCP Server, or do we need a DHCP server separately?

SD-Access solution is my first time, I don't know what topology is the best practice...

[Scott Hodgdon · Accepted solution]

hjson0001,

It i s always recommended to use a server for DHCP. 

A switch runs DHCP in software, taking CPU cycles from other processes.

CAN you run DHCP on the Border  ... Yes. SHOULD you ? I would not.

Cheers,
Scott Hodgdon

[hjson0001]

Thanks for quick answer :)

[Mike.Cifelli]

Here are my opinions on your considerations/questions:

Since you will be running a DNAC cluster be sure to run at least version 1.2.8. As far as I know the Cisco BU does not support a DNAC cluster running version 1.2.6. I assume you will be running a later version such as 1.2.10. The DHCP server is not necessarily needed to get an end node an ip address from the VN's IP pool. However, we run an SDA fabric using a microsoft DHCP server and things work great. I personally think the whole static/dynamic decision is something that needs to be determined from your requirements.

As far as I know, role of DHCP Server is need to build SD-Access to get IP address for users and pools.

In an SDA fabric you have two ways of on-boarding your hosts to your provisioned edge nodes. Using DNAC, you can statically assign ports to a VN with an SGT OR you can rely on ISE authz results to drive policy down. From a mobility perspective relying on ISE is the better option. The reason being is due to the fact that if you statically assign ports then other nodes/users that technically may be a part of another VN or ip pool will not have their anycast gw come up/up. Basically statically assigning the ports limits you.
Again, that is a design consideration based on your requirements.

Something else to note: In DNAC once you start assigning IP pools to VNs you will see a string that you will need to place into your authorization result profiles in the vlan checkbox pane that looks something like this: 1_1_1_0-TEST. Essentially what that will do is tell your edge node to bring up the anycast gw for that ip pool 1.1.1.0/24 in VN TEST. Just keep in mind that this is very important to ensure proper on-boarding and connectivity. If you statically assign ip addresses to hosts in that "ip pool" as long as your ISE authz results are properly setup you should be able to on-board those hosts. If it does not match in your authz profile you will have connectivity issues.

HTH & Good luck!

[hjson0001]

Thanks for detail answer :)