Compartilhar via

Client Computers Cannot Get DHCP Addresses From SBS 2003 With ISA 2004

  • Artigo

[Today's post comes to us courtesy of Justin Crosby]  

Today we are going to discuss a somewhat common issue caused by an ISA misconfiguration: Clients not getting DHCP addresses from their SBS 2003 server running ISA 2004. On a default install of SBS 2003 with ISA 2004 where the CEICW has been run this issue WILL NOT occur. The CEICW configures the necessary rules to allow clients to access DHCP. This issue is only seen when users start adding custom ISA rules and make a mistake. This blog post will show you how to avoid these mistakes.

The most common mistake is to incorrectly configure the Internal network address range. This range is used by ISA to determine what network the IP address belongs to. If your address range does not include the broadcast address ISA will treat your clients DHCP traffic as spoofed. By default SBS uses the 192.168.16.x range for the internal network. When you use this subnet the range you enter into ISA will be 192.168.16.0 – 192.168.16.255. It is essential to include the .0 and .255. To access the address ranges:

  1. Open ISA Server Management.
  2. Expand your ServerName
  3. Expand Configuration
  4. Select Networks
  5. Select the Networks tab
  6. Double-click the Internal network
  7. Select the Addesses tab
  8. Verify you have your entire IP range defined.

image

Here are two example ranges, one using a class A subnet and one using a class C. We recommend clients avoid using CIDR (variable-length subnet masking) on their private network to keep things simple.

Address Subnet Mask Range Start Range End
192.168.16.0 255.255.255.0 192.168.16.0 192.168.16.255
10.0.0.0 255.0.0.0 10.0.0.0 10.255.255.255

The other common misconfiguration that will break DHCP client addressing is a mistake in rule logic. The most common errors in rule logic are:

  • DHCP traffic is not authenticated traffic, therefore the rule that allows DHCP traffic from your clients to your server must exist above any rules that require authentication. To tell if a rule requires authentication check the Users tab of the rule. If you see a user or group name, instead of “All Users” this rule requires authentication.
  • DHCP traffic uses broadcast addresses which cannot be resolved to a URL. If you have a rule that blocks access to certain URLs above the rule that allows DHCP, ISA will block DHCP. This is because ISA will try to resolve the broadcast IP to a URL to make sure it is not blocked. Since the IP cannot be resolved ISA will block the traffic. The fix is to move the rule that allows DHCP traffic above any rules that block URL sets.

On SBS 2003 the CEICW creates a rule called SBS Protected Networks Access Rule. This is rule that allows DHCP traffic from clients to the server, and a lot more. To test if your issue may be a rule logic issue you can move this rule (SBS Protected Networks Access Rule) to order number 1. If this resolves your issue you know that one of your custom rules was blocking DHCP.

The final DHCP client issue that we will discuss today is not a configuration issue, but more of a clean-up issue. If your client cannot obtain an IP address is will fail back to an APIPA address in the 169.254.x.x subnet. This can happen if DHCP was broken when the client tried to renew it’s address; after you fix ISA you will need to fix this client. ISA does not consider the APIPA range to be a part of your Internal network, therefore if ISA sees traffic from an IP in this range on the internal network adapter it will drop it as a spoofed packet. This prevents clients who have an APIPA address from using DHCP. The easiest way to fix this is to do an IPCONFIG /RELEASE before running your IPCONFIG /RENEW. The /RELEASE will set the client’s IP to 0.0.0.0 which ISA will not treat as a spoofed packet.

Comments

  • Anonymous
    January 01, 2003
    The Official SBS Blog : Client Computers Cannot Get DHCP Addresses From SBS 2003 With ISA 2004: http

  • Anonymous
    January 01, 2003
    The Official SBS Blog : Client Computers Cannot Get DHCP Addresses From SBS 2003 With ISA 2004: http

  • Anonymous
    December 13, 2007
    A more common reason for not getting a DHCP address as of late is misconfiguration of ISA rules. A complete discussion on this can be found on my blog at securesmb.harborcomputerservices.net

  • Anonymous
    December 28, 2007
    See also this hit... http://www.microsoft.com/technet/isa/2004/plan/isaondhcpserver.mspx

  • Anonymous
    January 04, 2008
    It seems that we are now spying on everywhere. When the world does not feel safe, schools and businesses to return to the use of electronic means. Usually, this consists of hidden cameras. Sometimes there is even a bathroom hidden cameras. Schools are using more and more surveillance. That should help keep students safe. It also helps solve crimes that have already occurred. Knowing the cameras have reason to think students before they came to misbehavior. <a href="http://geocities.com/hentaioza">hidden">http://geocities.com/hentaioza">hidden camera</a> [url="http://geocities.com/hentaioza"]hidden camera[/url]