DHCP Manager

Configuration > Networking > DHCP Manager

Starting in Orchestrator 9.7.0, SD-WAN introduces a centralized DHCP Manager that significantly enhances how administrators configure, monitor, and operate DHCP services across appliances. These enhancements are designed to support distributed DHCP architectures, improve operational visibility, and reduce the effort required to manage DHCP scopes, leases, reservations, and failover.

All DHCP-related configuration and monitoring features are consolidated under a single workflow in the Orchestrator UI.

NOTE: For appliances running versions earlier than 9.7.0, DHCP settings must be configured locally on the appliance UI. See DHCP Server Defaults, DHCP Leases, DHCP Failover, and DHCP Failover State.

The DHCP Manager includes the following subtabs, each addressing a distinct aspect of DHCP management:

Address pool

Address pools define the IP subnets and ranges from which DHCP leases are allocated.

Key capabilities include:

  • Support for both directly connected and non-directly connected subnets. Non-directly connected subnets enable DHCP services for remote LAN segments without requiring a physical interface per subnet.
  • Multiple IP ranges per subnet (up to 10 ranges per pool).
  • Optional scope naming for easier identification.
  • Lease duration controls (default and maximum).
  • Gateway, DNS, NTP, and NetBIOS configuration per pool.

NOTE: Address pools can be created, edited, or deleted only when a single appliance is selected in the appliance tree.

NOTE: The scope utilization threshold is not configured per pool. It is a global setting (accessible from the System Information tab in the Orchestrator UI) that applies to both directly connected and non-directly connected address pools.

Lease

The Lease subtab provides centralized visibility and operational control of active DHCP leases. The subtab displays only active leases.

Capabilities include:

  • Viewing all active leases for a selected appliance set.
  • Filtering by IP/subnet, MAC address, or interface.
  • Deleting:
    • Selected leases
    • All leases matching a filter
    • All leases on a single appliance

These functions support faster troubleshooting and IP reclamation during reconfiguration or device replacement scenarios.

DHCP lease statuses

The different lease statuses provide visibility into the state of IP address assignments and help you manage the DHCP pool effectively. IP address status designations are as follows:

  • free: The IP address is available in the DHCP pool and has not been assigned to any client. Typically, the Primary DHCP Failover server allocates free leases.
  • backup: The IP address is not assigned to a client by the DHCP Failover peer servers and can be assigned by any DHCP Failover peer server. This occurs during failover scenarios or when the active server is unavailable. Typically, the Secondary DHCP Failover server allocates backup leases.
  • active: The IP address is assigned to a client, and the lease is currently held by the active DHCP server.
  • abandoned: The IP address was previously assigned to a client, but the lease has expired, and the client has not renewed it. The IP address is not immediately available for reuse and may go through a waiting period before being returned to the free pool.

Each DHCP server of a failover pair acts as a backup for the DHCP leases of its peer. For example, the DHCP server of EdgeConnect-1 hands an IP lease to a client 172.23.2.50. This IP address shows as active on both EdgeConnect-1 and EdgeConnect-2 DHCP Failover peer servers.

Scope

The Scope subtab provides a real-time summary of DHCP scope utilization, including:

  • Subnet and scope name.
  • Total, allocated, and available IP addresses.
  • Utilization percentage per scope.

This view enables administrators to identify potential scope exhaustion issues and plan capacity adjustments before service is impacted.

Reservation

The Reservation subtab allows centralized management of static IP assignments.

Capabilities include:

  • Add, edit, and delete reservations.
  • Validate MAC and IP address formats.
  • Prevent duplicate IP usage (duplicate MAC addresses are allowed).
  • Search reservations by device name, MAC, or IP address.

NOTE: Reservations can only be modified when a single appliance is selected.

NOTE: Reservations can only be made for IP addresses outside the configured IP pool ranges. In addition, a reserved IP address must not belong to the lease file, and it must belong to one of the subnets (local or remote) configured by the user.

Service

The Service subtab displays the current status (Up / Down) of the DHCP and Relay services on each appliance. It is read-only and does not provide control over the service lifecycle.

Profiler

The Profiler subtab supports simultaneous DHCP server operation and DHCP Discovery forwarding, enabling device profiling workflows (for example, integration with ClearPass). This feature is commonly referred to as IP Helper.

IMPORTANT: The Profiler subtab is not a replacement for DHCP/BOOTP Relay mode. DHCP/BOOTP Relay is used when a given interface does not serve DHCP—it instead forwards all client requests for a given interface to a remote DHCP server. The Profiler is used when the appliance is the DHCP server and additionally needs to forward DHCP Discovery traffic to a NAC or profiler system (such as ClearPass) for device fingerprinting. This is referred to as ClearPass Device Insight (CPDI). These are distinct features and can operate simultaneously. Segmentation (VRF) must be enabled before the Profiler subtab is configurable.

Capabilities include:

  • Configure one or more IP helper addresses (maximum: 2).
  • Map IP helpers to segments (VRFs).
  • Validate helper/segment pairings.
  • Enforce segmentation prerequisites.

This enables forwarding DHCP discovery traffic to a profiler for device classification while the appliance continues to assign addresses locally.

Failover state

The Failover state subtab enables real-time monitoring of failover health and synchronization:

  • Monitor real-time failover health and synchronization status.
  • View partner state, timestamps, and failover group details.

This subtab displays the DHCP failover peer states of each server for troubleshooting purposes.

NOTE: Disabling EdgeHA for RMA or other changes invalidates the DHCP failover configuration, and some values—such as My IP and Peer IP—can be deleted.

DHCP failover state fields

Field Description
Appliance Name of the EdgeConnect appliance that is part of the DHCP failover configuration.
Failover Group Name Failover group name that is the same for all the tagged and untagged interfaces corresponding to one physical interface.
My State Failover endpoint state of the selected primary appliance. The states are: Normal, Communications-Interrupted, Partner-Down, Recover, Recover-Wait, Recover-Done, Unknown.
My State Time Date and time when the selected appliance’s DHCP server entered the specified state in the table.
Partner State Failover endpoint state of the partner appliance. The states are: Normal, Communications-Interrupted, Partner-Down, Recover, Recover-Wait, Recover-Done, Unknown.
Partner State Time Date and time when the partner appliance entered the specified state in the table.
MCLT Maximum client lead time: the maximum amount of time that one server can extend a lease for a client’s binding beyond the time known by the partner.

DHCP failover state descriptions

  • Normal: Both EdgeConnect DHCP servers are exchanging keepalives correctly and DHCP bindings are synchronized.
  • Communications-Interrupted: Each EdgeConnect is unable to exchange DHCP failover messages and independently services DHCP requests. In this state, each EdgeConnect assumes that the partner EdgeConnect is not down, but only unable to exchange failover messages.
  • Partner-Down: The local EdgeConnect has determined that its failover partner is down and has taken over responsibility for serving all DHCP requests for the shared address pools. The local server continues to operate independently until the partner returns and the two servers resynchronize.
  • Recover: The local EdgeConnect is trying to establish full synchronization of DHCP bindings with the previously down EdgeConnect. In this state, EdgeConnect does not serve any DHCP requests until the DHCP bindings are fully synchronized between them.
  • Recover-Wait: The DHCP server is waiting for a period equal to the Maximum Client Lead Time (MCLT) before transitioning to the Recover-Done state. During this time, the server is preparing to synchronize its lease database with its peer server so as to avoid any inconsistencies.
  • Recover-Done: EdgeConnects enter this state after recovering from a communication failure and completing the synchronization of DHCP bindings. EdgeConnects transition to this state after they recover state but prior to the normal state.
  • Unknown: This indicates the peer state is unreachable or has not received any responses from the peer for the amount of Max Response Delay timer.

Relay

The Relay subtab centralizes DHCP relay configuration:

  • Select relay interfaces.
  • Configure destination DHCP servers.
  • Enable Option 82 and define relay policies.
  • Support per-segment DHCP relay behavior.

Failover Configuration

DHCP failover is configured through the DHCP Settings dialog box for an interface, not through a dedicated DHCP Manager subtab. The DHCP Manager provides the Failover state subtab for monitoring failover health and synchronization.

DHCP failover configuration supports:

  • Creating and managing DHCP failover relationships.
  • Assigning a failover relationship for all non-directly connected subnets.
  • Assigning Primary and Secondary roles.
  • Configuring peer IPs, ports, MCLT, and load balancing (SPLIT) parameters.

For full details, see DHCP Failover.

Monitoring and Alarms

The DHCP Manager introduces proactive monitoring capabilities:

  • Configurable scope utilization thresholds (default 90%).
  • Alarms when utilization crosses defined high-water marks.
  • Central visibility into DHCP health across appliances.

This supports early detection of scope exhaustion and service degradation risks. See Alarms for a full list of DHCP-related alarms.

Release and Compatibility Notes

  • DHCP Manager is available starting with Orchestrator and appliance version 9.7.0.
  • No new external packages are required.
  • Existing configurations are preserved and upgraded automatically where applicable.