DHCP, VLANs, and VPNs
Unit 3: Network Configuration. Lesson 13 of 41 in APlus Academy Core 1.
Three configuration concepts appear in nearly every office network. DHCP gives devices their addresses, VLANs split one switch into several networks, and VPNs stretch the office network across the internet.
DHCP
Dynamic host configuration protocol hands a device everything it needs to talk: an IP address, subnet mask, default gateway, DNS servers, and sometimes more (time server, boot file). The exchange is four UDP messages, remembered as DORA:
- Discover: the client broadcasts "any DHCP servers?"
- Offer: a server proposes an address.
- Request: the client asks for that address.
- Acknowledge: the server confirms and starts the lease.
Vocabulary you will be tested on:
- Scope: the range of addresses a server may hand out on a subnet, such as 192.168.1.100 to 192.168.1.199.
- Lease: how long the client may keep the address before renewing; short leases for guest networks, long for offices.
- Reservation: a fixed address tied to a specific MAC address, so a printer or access point always gets the same one without being configured statically.
- Exclusion: addresses inside the range that the server must never assign, usually because a static device already uses them.
Because Discover is a broadcast, it does not cross routers; a DHCP relay on the router forwards it to a server on another subnet. Ports 67 (server) and 68 (client).
VLANs
A virtual LAN is a logical network created on a managed switch. Ports assigned to VLAN 10 cannot talk to ports on VLAN 20 through the switch, even though they share the hardware. Uses:
- Separating voice phones from data so calls get priority.
- A guest network kept away from servers.
- Isolating cameras, IoT devices, or a lab.
- Reducing broadcast traffic on a big network.
Traffic between VLANs must go through a router or a layer 3 switch, where a firewall rule can control it. A trunk port carries several VLANs between switches with tags on each frame. A device on the wrong VLAN gets no DHCP address or reaches the wrong resources; that is a switch port setting, not a cable problem.
VPNs
A virtual private network makes an encrypted tunnel across a public network.
- A client-to-site (remote access) VPN lets a laptop at home appear to be inside the office network; the VPN client app connects to a VPN concentrator, firewall, or router.
- A site-to-site VPN links two office routers permanently so the branch and headquarters are one network.
With full tunnel every packet goes through the office; with split tunnel only office traffic does and web browsing goes direct. A user who can reach the internet but not internal resources needs the VPN up; a user whose VPN drops every few minutes may have an idle timeout or a flaky connection.
DHCP, VLANs, and VPNs, explained slowly
Three tools, three questions
DHCP answers "what address do I use?" VLANs answer "who am I allowed to share a wire with?" VPNs answer "how do I get onto the office network from somewhere else?" The exam treats them as vocabulary plus a scenario each.
DHCP, the four-step handshake
step message direction content 1 Discover client broadcast "any DHCP server? here is my MAC" 2 Offer server to client "you may have 192.168.1.101, mask, gateway, DNS, lease 8 hours" 3 Request client broadcast "I accept the offer from server X" 4 Acknowledge server to client "confirmed; lease starts now"
Discover is a broadcast because the client has no address and knows no servers. The Request is also broadcast so any other servers that made offers learn they were declined. Halfway through the lease the client renews quietly with a unicast Request; if the server has vanished, the client keeps trying and, at expiry, drops to APIPA.
DHCP vocabulary as a picture
subnet 192.168.1.0/24
.1 router (static)
.2 to .49 static devices: servers, printers, APs (exclusion: DHCP never assigns these)
.50 to .199 scope: the DHCP pool
.60 reservation: printer MAC AA-BB-CC-11-22-33 always gets .60
.200 to .254 unused, or a second exclusion
lease: 8 hours (office), 1 hour (guest Wi-Fi), 7 days (stable desktops)
options: gateway, DNS servers, domain name, NTP, TFTP boot server for phonesA scope is the pool. A reservation lives inside the pool and pins one address to one MAC. An exclusion is carved out so the server never touches addresses that static devices already use; without it, a laptop can be handed the file server's address and both go silent (a duplicate address).
DHCP across routers
Because Discover is a broadcast, it stops at the router. A DHCP relay (also called an IP helper) on the router picks up broadcasts and forwards them as unicast to the DHCP server's address, then relays the reply. One server can then serve every subnet. When a new VLAN "cannot get addresses," the relay was not configured for it.
VLANs, one switch as many
switch ports 1 to 8 VLAN 10 staff data switch ports 9 to 16 VLAN 20 voice (phones) switch ports 17 to 20 VLAN 30 guest Wi-Fi APs switch ports 21 to 22 VLAN 40 cameras port 24 trunk carries VLANs 10, 20, 30, 40 to the router (tagged frames)
Devices in VLAN 10 never see VLAN 40's traffic through the switch. To cross, packets go up the trunk to the router (or a layer 3 switch), which can apply firewall rules: cameras may reach the recorder and nothing else; guests may reach the internet and nothing inside. VLANs need managed switches and each VLAN is its own IP subnet with its own DHCP scope. A PC on the wrong VLAN gets an address from the wrong scope or none at all; a phone plugged into a data port cannot reach the call server.
VPNs
type who endpoint feels like client-to-site a laptop at home or a hotel VPN concentrator, firewall, or router the laptop is in the office site-to-site two office routers each other one network across two buildings
The tunnel encrypts everything inside it, so coffee shop Wi-Fi cannot read the office traffic. Full tunnel sends all the laptop's traffic through the office (safer, slower, uses office bandwidth); split tunnel sends only office-bound traffic through the VPN and browses the internet directly (faster, less control). A remote user who can open web pages but not the file server or the intranet has no VPN connection, or the VPN client is not started.
Worked example
A new branch opens with ten PCs and five IP phones on one managed switch. Design: VLAN 10 for data, VLAN 20 for voice, a trunk to the branch router, a DHCP scope per VLAN on the router with the phone VLAN's option pointing at the call server, a reservation for the branch printer, and a site-to-site VPN from the branch router to headquarters so the branch uses the central file server. A traveling salesperson uses a client VPN to the headquarters firewall.
How the exam asks it
- "Put the DHCP process in order." Discover, Offer, Request, Acknowledge.
- "A printer must always receive the same address without static configuration." DHCP reservation.
- "Which addresses will the DHCP server never assign?" The exclusion range.
- "Which technology separates voice and data traffic on the same switch?" VLANs.
- "A remote employee needs secure access to internal file shares." A client-to-site VPN.
- "Two offices need a permanent secure link." A site-to-site VPN.
What to memorize
- DORA. Scope, lease, reservation (by MAC), exclusion, relay, ports 67 and 68.
- VLAN: logical network on a managed switch; router or layer 3 switch between VLANs; trunk carries tags.
- VPN: encrypted tunnel; client-to-site versus site-to-site; full versus split tunnel.