What are the best practices for DHCP servers?

[promanelka]

Studying for the CCNA exam. Currently learning about PVST+ and Rapid-PVST+.

I am trying to create a lab scenario for 9 PCs spread out evenly across 3 access switches. To assign IPs to the PCs, I am thinking of using a DHCP server.

QUESTION

Based on best practices for enterprise network design, should the DHCP server be on a different access switch as other end-user devices or can it be placed on an access switch shared by other end-user devices?

@Ramblin Tech 

[ziddihun]

For CCNA-level best practices, it’s generally recommended to place the DHCP server in the distribution or core layer, not directly on an access switch shared with end-user devices. This improves centralized management, scalability, and security. However, in a small lab scenario like yours, it’s perfectly fine to place the DHCP server on an access switch — just make sure DHCP messages can reach all VLANs (use a DHCP relay/ip helper-address if needed).

[Joseph W. Doherty]

Normally a DHCP server host would connect to a switch supporting other server hosts, not end user hosts.

[Devaa]

For study purpose, you practise all the different possibilities like connecting DHCP server to the same switch as of hosts or keep a separate switch just for DHCP server or configure DHCP service in router or keep the DHCP server in a different broadcast domain like one or two hops away from the end hosts. 

As a Production best practice, DHCP servers will be mostly kept in the nearest Data Center to maintain High Availability, Security, and to reduce the Number of DHCP servers to be managed. 

If you just have one or two /24 pools for DHCP, it can be done using the Router itself. No need separate DHCP Servers and switches to connect them, it will add unnecessary CapEx and OpEx budgets. 

If you have multiple DHCP Pools, you can have DHCP server managed by some IPAM solutions. If the site or location is a small to medium size site, we can have 2x DHCP servers in the nearest hub site or DC. 

If we have lots of DHCP Pools and the site is large or very large, we can have a dedicated DHCP servers onsite. 2x DHCP servers connecting to 2 different access switches (not end user access switches) and should be placed in two different racks or server rooms for better redundancy. You can also add the DHCP servers in the nearest DC as backup ip helpers as well. 

DHCP looks very simple, but in most organisation there will be a dedicated team of multiple engineers works just to maintain DHCP up and running. It's a very critical service. 

[Wassim Aouadi]

For a lab environment, it does not matter whether you place it on the same switch or not. What is important is to add an additional layer of network security for the DHCP server by placing it in a different VLAN for example. In the real world, DHCP services are typically reachable through a network DMZ.

[M02@rt37]

Hello @promanelka 

The best is to place the DHCP server in the distribution layer, rather than on an access switch shared with end-user devices...

Technicaly is possible and acceptable in smaller or lab environment to host the DHCP server on the same access switch as end user devices. But do this in a production environment could introduce reliability issues. Access switches are more prone to reboots, changes, and disruptions, so placing critical services like DHCP on them can make the network less resilient.

[Joseph W. Doherty]

"Based on best practices for enterprise network design, should the DHCP server . . ."

Looking over the many replies, what's the best practice may be unclear.

Firstly, remember you asked about a DHCP server.  As a general practice, servers hosts are often treated differently than user hosts regarding their connections to the network (and where they are physically placed).  DHCP servers are one of the most critical servers, as without them, hosts using DHCP won't obtain IP addresses.  But other servers are critical too, for example servers that authenticate network access, DNS, mail, the core of the business operations, etc.

Second, you asked about enterprise.  In networking, we often equate that with large scale businesses, i.e. businesses with multi thousand employees.  For those, important servers may have specific handling and/or dedicated teams.  In Enterprise networks, you're very, very unlikely to find a (legitimate) DHCP server using the same edge device as user hosts.  That's likely true for mid-size businesses too.