Subject: Question about Virtualization and DHCP

From: Raju Narayanaswamy <[email-masked]>
Date: Fri, 22 Oct 1999 10:44:30 -0400 (EDT)

Hi All,
I have a question regarding how DHCP works in the context
of virtualization of networks. Consider an ISP serving different
corporate customers all having their own Virtual Private Networks.
Assume the DHCP server is hosted on the Service Provider.
This is a case of  customers who are not interested in
managing/configuring
the  DHCP  servers, so they outsource the responsiblities to the
service provider.

Now, since the DHCP server caters to many different corporate
customers and there may be IP address overlaps between the networks.
How does  DHCP server intelligently handle this situation of
assigning overlapping addresses?

Thanks in advance,
-Raju
[email-masked]

---

From: Ted Lemon <[email-masked]>
Date: Fri, 22 Oct 1999 11:38:44 -0400 (EDT)

> assigning overlapping addresses?

This is a really interesting question, to which, unfortunately, I
don't think there's an obvious answer.   If a relay agent at a
customer site has the same IP address as a relay agent at another
customer site, you have a particular problem - it seems impossible to
differentiate the two.   Even if the relay agents have different IP
addresses, if you have different network numbers, you still have a
problem.

The only thing I can think of that would work with existing DHCP
servers and the existing protocol, given what you are saying, would be
to have a seperate DHCP server process for each customer, and
configure the customer relay agents to relay requests to their own
DHCP servers.  If you are doing NAT (as I presume you are), you may be
able to configure your NAT router to change not only the IP address
but also the UDP destination port of the relay agent and DHCP server,
so that you could have more than one DHCP server running on the same
machine, each listening on a nonstandard port for the response from
the relay agent.

If you are willing to change your requirements a little, what I would
suggest in preference to what you have proposed is that you assign
each customer a different address range from the same private address
space.   That way you can have one DHCP server.   You don't route
different customers' networks together - you just assign them
different ranges of IP addresses.

If you want to change the protocol to make it possible for the DHCP
server to do the right thing, I would suggest a new Relay Agent
Information option called "Virtual Private Network ID" which could be
configured on the relay agent, and used on the DHCP server to choose
from a selection of VPNs.   You would then have to get your relay
agent vendor (presumably also your router vendor) to add this
capability to their DHCP relay agent.

			       _MelloN_

---

From: "Bill Moore" <[email-masked]>
Date: Fri, 22 Oct 1999 13:13:21 -0400 (EDT)

> capability to their DHCP relay agent.

Or have the relay agent also overwrite the existing UserClass ID field.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of Ted
> Lemon
> Sent: Friday, October 22, 1999 8:39 AM
> To: Multiple recipients of list
> Subject: Re: Question about Virtualization and DHCP 
> 
> 
>

---

From: Ted Lemon <[email-masked]>
Date: Fri, 22 Oct 1999 13:16:04 -0400 (EDT)

> Or have the relay agent also overwrite the existing UserClass ID field.

Well, yes, but that still involves hacking the relay agent and the
DHCP server.   If you're going to go to that trouble, why not do it in
a standard-conformant way that doesn't conflict with existing,
valuable functionality?   Adding a new agent option would be just as
easy, and that usage would, IMHO, be easy to get standardized.   There
is no chance that this usage of the user class option would get
standardized, IMHO.

			       _MelloN_

---

From: Bill Sommerfeld <[email-masked]>
Date: Fri, 22 Oct 1999 13:53:39 -0400 (EDT)

> Or have the relay agent also overwrite the existing UserClass ID field.

This would break nearly any conceivable way of doing DHCP security.

					- Bill