Scope, Reservations ו־Options ב־DHCP

Building a correct Scope: range, exclusions, Gateway, DNS, domain suffix and fixed reservations.

Analogy: Scope is the hotel's room inventory, Exclusion are rooms reserved for staff, Reservation is a permanent room for a specific guest, and Options are instructions each guest receives at the reception: where the exit is (Gateway) and where the information desk is (DNS).

Correct Construction Order

1. Address Range (Start / End) and Subnet Mask — full match to the physical Subnet.
2. Exclusion Range — remove servers, switches, and printers with static IP addresses from the range.
3. Lease Duration — 8 days in an office, a few hours on a guest network or Wi-Fi.
4. Scope-level Options: 003 Router, 006 DNS Servers, 015 DNS Name (domain suffix).
5. Reservation by MAC — for printers, cameras, and any device that requires a stable address.
6. Authorize the server in , otherwise it will not distribute addresses at all.

Server Options — apply to all Scopes on the server.
Scope Options — override server settings for that specific Scope.
Reservation Options — the most specific level, overrides all others.

# Full End-to-End Scope
Add-DhcpServerv4Scope -Name "HR-VLAN20" -StartRange 192.168.20.50 `
  -EndRange 192.168.20.240 -SubnetMask 255.255.255.0 `
  -LeaseDuration 8.00:00:00 -State Active

Add-DhcpServerv4ExclusionRange -ScopeId 192.168.20.0 `
  -StartRange 192.168.20.50 -EndRange 192.168.20.60

Set-DhcpServerv4OptionValue -ScopeId 192.168.20.0 `
  -Router 192.168.20.1 -DnsServer 192.168.20.10 -DnsDomain "lab.local"

Add-DhcpServerv4Reservation -ScopeId 192.168.20.0 `
  -IPAddress 192.168.20.55 -ClientId "AA-BB-CC-11-22-33" -Name "HR-Printer"

# Checks
Get-DhcpServerv4Scope
Get-DhcpServerv4OptionValue -ScopeId 192.168.20.0
Get-DhcpServerv4Lease -ScopeId 192.168.20.0 | Where-Object AddressState -like "*Declined*"

powershell

Architecture and Theory — Under the Hood

DHCP works in DORA: Discover (Broadcast) → Offer → Request → Ack. Crossing a router requires an IP Helper (Relay), because Broadcast does not cross networks.

Option 3 — Default Gateway, Option 6 — DNS, Option 15 — Name, Option 51 — Lease Time.
Reservation — a fixed address by MAC, centrally managed (preferable to manual Static).
Exclusion Range — a range that will not be assigned (servers, printers).
In a domain, the server must Authorize — a mechanism that prevents Rogue DHCP.

Practical Configuration (PowerShell / GUI)

Add-DhcpServerv4Scope -Name "Users" -StartRange 192.168.10.50 -EndRange 192.168.10.200 -SubnetMask 255.255.255.0
Add-DhcpServerv4ExclusionRange -ScopeId 192.168.10.0 -StartRange 192.168.10.50 -EndRange 192.168.10.60
Set-DhcpServerv4OptionValue -ScopeId 192.168.10.0 -Router 192.168.10.1 -DnsServer 192.168.10.10 -DnsDomain corp.com
Add-DhcpServerv4Reservation -ScopeId 192.168.10.0 -IPAddress 192.168.10.55 -ClientId "00-15-5D-01-02-03" -Name PRN01
Add-DhcpServerInDC

powershell

! On the router, if the DHCP is on a different network
Router(config-if)# ip helper-address 192.168.10.10

bash

Troubleshooting

Client receives 169.254.x.x (APIPA) — no response received: check Relay, cable/VLAN, or full Scope.
Get-DhcpServerv4ScopeStatistics — utilization percentage; above 90% requires expansion or shorter Lease.
Address duplication — someone configured Static within the range; add an Exclusion.

Scope, Reservations and Options in DHCP

What you will learn here

Correct Construction Order

Check yourself