DHCP, AD and VLANS

[amariano]

We've just purchased our Palo Alto and are getting ready to configure. I just had a quick question on using AD.

Currently we have HP Procurves connected to a Radius server and Active Directory running DHCP. We'd like to simply and take the Radius server out of the picture and use the Palo Alto to set up our vlans so that they are role based. DHCP would then run on the Palo Alto. For example, a student gets a an IP on the student vlan, teacher on the teacher vlan, etc.

Could someone let me know if this is possible? - Thanks.

[kalavi · Accepted solution]

Hi,

It is possible to create a DHCP pool for a particular vlan on PAN boxes. Steps are:

1) Network---> DHCP

2) Create a New DHCP pool for that particular vlan or interface

[bradenmcg]

If this is an Active Directory domain, it's generally not a great idea to take DHCP away from your domain controllers.  Reason is that normally, DHCP will work with DNS on AD servers to enable dynamic updates, so a machine's hostname is always associated to its correct IP.

If the machines aren't on the domain it doesn't really matter as much, but it's still not recommended.  MS suggests that you use their DHCP along with AD because of dynamic updates.

I'm not sure how you would be able to remove the RADIUS server in your scenario, because I assume you're using 802.11x authentication (with RADIUS) in order to drop the ports on the procurves into the correct VLAN based on user authentication.  Unless you want to move the RADIUS function to the PAN - you can't do this, the PAN isn't a RADIUS server.

[CentCom]

Would each VLAN in this case count as a seperate DHCP server?  I have a PA-500 that I would like to setup a few different DHCP scopes for various VLANS and it appears that I'm limited to 3 DHCP servers on the PA-500.