HSRP and DHCP Pools

[mike0000111111]

Hi Cisco Experts:

I have 6 vlans split evenly across (2x) Layer 3 3560 switches.  I'm hosting DHCP on the switches, and I have HSRP failover to the other switch.  If HSRP fails over, I'd like the failover switch to take over all DHCP requests.  

To accomplish this, can I just install the pools for all 6 vlans on both devices?  I tested this the other day and it seemed to work - with some complaining from the failover switch that some ip addresses had already been assigned.  Are there any best practice concerns I should be aware of?

Thank you very much for your time,

Mike

[johnd2310]

Hi,

What are you using the dhcp pools for? Client PCs or Network devices like access points.

Thanks

John

[mike0000111111]

Hi John:

Everything we're using is plugged into these two switches.  (5x) access points, (1x) Wireless Lan Controller, Phones, some computers, and (1x or 2x) Radius servers.

I'll make radius server static, along with management devices like access points.  Otherwise, the pools are for end devices.

Thanks,

Mike

[aolverso]

One solution could be to assigned half of your subnet to the active router and the other half of the subnet to the standby router. Doing it this way ensures that you will never be handing out duplicate IP's. Make sure that you remember to exclude the addresses of the last half of the subnet on one router and exclude the first half of the address on the other router. Here is an example of what I am talking about:

http://najcolabs.com/?p=410

[mike0000111111]

Hi Aolverso:

Thanks for your suggestion.  This would definitely prevent duplicate addresses from occurring.  But I also think that splitting a pool in half sounds like work.  Also, each half would need to be large enough to incorporate all devices in that subnet - otherwise the pool would run out of addresses in the event of a failover.  This makes a subnet larger than it needs to be during normal operations.  Finally, if DHCP does check to make sure that an address isn't being used prior to assigning the address then....

Can you think of any reason why I shouldn't just duplicate the pools across my (2x) L3 Switches and instead take your suggestion?

Thanks for all your help,

Mike

[atlewis31]

Mike,

   Just curious if you implemented this solution and if you ran into any trouble with having redundant DHCP pools on your HSRP switches?

Thanks for any update you may provide.

Adam.

[mike0000111111]

Adam:

Sorry for taking so much time.  Yes, it seems to work fine.  Great even?  When one switch goes down, my network has the ability to take over and keep on running DHCP.

One difficulty with DHCP on Cisco switches is that just plugging in a Mac address for IP address assignment doesn't work.  Sometimes you have to get the Cisco ID of a device, then assign it to the DHCP pool.  Seriously, sometimes you can't use the Mac address to assign an IP address.  

I forget which command I used to find the Cisco device ID for my various devices.  But this two-step process made things a little convoluted.

-Mike

[zackmci · Accepted solution]

Mike,

Assuming the pools are in the same subnet on the Standby and the Active router this should work fine.  If the Standby becomes Active and it may be necessary to do a release/renew on the host so that the Standby router can add them to it's binding table.  Otherwise you should be fine with that setup.

Thanks,

Zack

[mike0000111111]

Edit: I confused myself.  Please review my new posting below!

Hi Zack:

Even though one 3560 Switch will be handling all traffic to the virtual gateway, both L3 3560 switches will have an ip address on the subnet (because of HSRP).  This will likely mean that both switches will be competing to hand out ip addresses and make bindings.  If switch 1 is HSRP active, and switch 2 is HSRP standby, then:

1. When failover occurs, and switch 2 takes over all traffic for the subnet, will it first do a check to see if an ip address is already in use before it hands it over? (Ipv4 address conflict resolution)
2. Minimally, when a computer comes up for a DHCP lease renew, will the successor switch (switch 2) then make the binding in the table?

Packet Tracer indicated that it would minimally detect devices with IP Addresses not in the bindings table but that were active on the subnet and were a part of the DHCP pool.

Thanks,

Mike

[zackmci]

Mike, 

The idea of splitting up the pools between servers could work but depending on the capabilities provided by your IOS version you could increase the amount of pings sent from the DHCP server by using this command ip dhcp ping x (with x defining how many pings the server should send before allocating an address).  Try increasing this number and seeing if your duplicate address issue is resolved.

Zack

[zackmci]

Sorry the command is ip dhcp ping packets x.  This is a global command separate from the pool configs.
 

[mike0000111111]

Hi Zack:

I guess, indirectly, you answered my question: Will DHCP try to confirm an ip address is available before assigning it to a device requesting a lease?  Thank you!

However, if a device that has an ip address assigned prior to failover then asks the successor switch for a continued lease - will the successor switch be able to handle this situation - especially in the event that the ip address isn't found in the bindings table because it was originally assigned by the other switch?

Thanks,

Mike

p.s.  I don't have a duplicate address issue yet - I'm still designing the network.  Just want to prevent problems.

[zackmci]

Mike,

In the event that the lease expires while the original dhcp server has failed and has failed over to the standby, the discovery process would start and a new address will be assigned to the host from the standby's pool.  The new switch would then have that host in its bindings table until the active switch comes back up. 

If you were to bring the active switch back up before the lease expires it will renew as usual.

I hope this helps please let me know.

[mike0000111111]

Thanks Zack!  Sounds like the DHCP scenario I have is pretty bullet proof. I appreciate all of your help.

-Mike