DHCP Access Denied

I am starting to subnet our network along with vlans. I have 2 DC's that are
also DHCP servers in the same 192.168.x subnet. The core switch is doing
layer 3 routing with ip helper addressing on the vlans pointing to these 2
DC's. I had the following DHCP scopes setup
DC1:
192.168.14.1 thru 192.168.14.254
10.1.10.55 thru 10.1.10.154
DC2:
192.168.15.1 thru 192.168.15.254
10.1.10.155 thru 10.1.10.254
Things were working fine and then I suddenly cannot get any DHCP renewals
across the network in any subnet and upon an ipconfig /renew I get an "error:
access denied". As soon as I disabled all the 10.x DHCP scopes everyone
could get 192.x leases.
Any ideas? Do the scopes have to be the same range using exclusions instead
of starting at different addresses?

Hello,

Thank you for using newsgroup!

From your post, I suggest you refer to the following articles to configure
your DHCP scope:
255999: Increasing the number of IP addresses on a subnet in DHCP Server
http://support.microsoft.com/kb/255999

139904: How to Configure Your DHCP Server Scope
http://support.microsoft.com/kb/139904/en-us

Thanks & Regards,

Ken Zhao

Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security <http://www.microsoft.com/security>
================================================== ==
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ==
This posting is provided "AS IS" with no warranties, and confers no rights.

Hello,

I am just writing to see how everything is going. If you have any updates
or need any further assistance on this issue, please feel free to let me
know.

Thanks & Regards,

Ken Zhao

Microsoft Online Support
Microsoft Global Technical Support Center

Get Secure! - www.microsoft.com/security <http://www.microsoft.com/security>
================================================== ==
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
================================================== ==
This posting is provided "AS IS" with no warranties, and confers no rights.

The scopes look fine to me. But you should use the full Range in the Scope
and then trim it down using Exclusions. To me it is more flexible that way.
But the way you have it should not keep it from working.

Example:

DC1:
192.168.14.1 thru 192.168.14.254
10.1.10.1 thru 10.1.10.254 [Ex 10.1.10.155 - 10.1.10.254]
DC2:
192.168.15.1 thru 192.168.15.254
10.1.10.1 thru 10.1.10.254 [Ex 10.1.10.55 - 10.1.10.154]

I would probably follow the same pattern with the 192 segments so that
either DHCP can serve any segment equally. If you lose one DC the remaining
one can keep the LAN going until the other is fixed if it is done fairly
quickly.

Has there changes to the LAN?,...the VLANs Config,...Group Policies?

I have never heard of a DHCP "denying" anything since there is no user
authentication with them anyway,...they work anonymously. You don't even
have to be logged in to a workstation for it to get an address, so there
would not be any user to get "denied".


--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------

"Chadder" <(E-Mail Removed)> wrote in message
news:1E71EC6B-3837-4707-B969-(E-Mail Removed)...
>I am starting to subnet our network along with vlans. I have 2 DC's that
>are
> also DHCP servers in the same 192.168.x subnet. The core switch is doing
> layer 3 routing with ip helper addressing on the vlans pointing to these 2
> DC's. I had the following DHCP scopes setup
> DC1:
> 192.168.14.1 thru 192.168.14.254
> 10.1.10.55 thru 10.1.10.154
> DC2:
> 192.168.15.1 thru 192.168.15.254
> 10.1.10.155 thru 10.1.10.254
> Things were working fine and then I suddenly cannot get any DHCP renewals
> across the network in any subnet and upon an ipconfig /renew I get an
> "error:
> access denied". As soon as I disabled all the 10.x DHCP scopes everyone
> could get 192.x leases.
> Any ideas? Do the scopes have to be the same range using exclusions
> instead
> of starting at different addresses?

I will try changing the ranges using the exclusions as this does give you
more flexibility without changing the whole scope.
Yeah - the whole access denied thinig was really stange. The only thing I
was doing was creating the vlans on the core switch getting ready to start
moving the edge switches into their respective vlans. And these changes were
made days prior to the outage.

One more question, do you see any problems with activating all the new DHCP
scopes prior to actually having the vlans in place?

"Phillip Windell" wrote:

> The scopes look fine to me. But you should use the full Range in the Scope
> and then trim it down using Exclusions. To me it is more flexible that way.
> But the way you have it should not keep it from working.
>
> Example:
>
> DC1:
> 192.168.14.1 thru 192.168.14.254
> 10.1.10.1 thru 10.1.10.254 [Ex 10.1.10.155 - 10.1.10.254]
> DC2:
> 192.168.15.1 thru 192.168.15.254
> 10.1.10.1 thru 10.1.10.254 [Ex 10.1.10.55 - 10.1.10.154]
>
> I would probably follow the same pattern with the 192 segments so that
> either DHCP can serve any segment equally. If you lose one DC the remaining
> one can keep the LAN going until the other is fixed if it is done fairly
> quickly.
>
> Has there changes to the LAN?,...the VLANs Config,...Group Policies?
>
> I have never heard of a DHCP "denying" anything since there is no user
> authentication with them anyway,...they work anonymously. You don't even
> have to be logged in to a workstation for it to get an address, so there
> would not be any user to get "denied".
>
>
> --
> Phillip Windell
> www.wandtv.com
>
> The views expressed, are my own and not those of my employer, or Microsoft,
> or anyone else associated with me, including my cats.
> -----------------------------------------------------
>
> "Chadder" <(E-Mail Removed)> wrote in message
> news:1E71EC6B-3837-4707-B969-(E-Mail Removed)...
> >I am starting to subnet our network along with vlans. I have 2 DC's that
> >are
> > also DHCP servers in the same 192.168.x subnet. The core switch is doing
> > layer 3 routing with ip helper addressing on the vlans pointing to these 2
> > DC's. I had the following DHCP scopes setup
> > DC1:
> > 192.168.14.1 thru 192.168.14.254
> > 10.1.10.55 thru 10.1.10.154
> > DC2:
> > 192.168.15.1 thru 192.168.15.254
> > 10.1.10.155 thru 10.1.10.254
> > Things were working fine and then I suddenly cannot get any DHCP renewals
> > across the network in any subnet and upon an ipconfig /renew I get an
> > "error:
> > access denied". As soon as I disabled all the 10.x DHCP scopes everyone
> > could get 192.x leases.
> > Any ideas? Do the scopes have to be the same range using exclusions
> > instead
> > of starting at different addresses?
>
>
>

"Chadder" <(E-Mail Removed)> wrote in message
news:288F7009-94B7-4A07-AC45-(E-Mail Removed)...
> One more question, do you see any problems with activating all the new
> DHCP
> scopes prior to actually having the vlans in place?

I think it will be alright. They just won't revceive any request for IP
Configs since the segment they serve doesn't exist yet and doesn't have nay
hosts.

Without Helper Addresses in a LAN Router the DHCP will only give out
addresses from a Scope that matches the IP Config of the Nic(s) is
possesses. So the Scope that doesn't have a corresponding Nic will just sit
there doing nothing until it receives requests via Helper Addresses from the
LAN Router.

--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft,
or anyone else associated with me, including my cats.
-----------------------------------------------------