DHCP Manager

Configuration > Networking > DHCP Manager

Starting in Orchestrator 9.7.0, SD-WAN introduces a centralized DHCP Manager that significantly enhances how administrators configure, monitor, and operate DHCP services across appliances. These enhancements are designed to support distributed DHCP architectures, improve operational visibility, and reduce the effort required to manage DHCP scopes, leases, reservations, and failover.

All DHCP-related configuration and monitoring features are consolidated under a single workflow in the Orchestrator UI.

NOTE: For appliances running versions earlier than 9.7.0, DHCP settings must be configured locally on the appliance UI. See DHCP Server Defaults, DHCP Leases, DHCP Failover, and DHCP Failover State. DHCP Manager requires Orchestrator and appliances running 9.7.0 or later. Older appliances display no supported data in DHCP Manager views.

The DHCP Manager includes the following subtabs, each addressing a distinct aspect of DHCP management:

Address pool

Address pools define the IP subnets and ranges from which DHCP leases are allocated.

Key capabilities include:

  • Support for both directly connected and non-directly connected subnets. Non-directly connected subnets enable DHCP services for remote LAN segments without requiring a physical interface per subnet.
  • Multiple IP ranges per subnet (up to 10 ranges per pool).
  • Optional scope naming for easier identification.
  • Lease duration controls (default and maximum).
  • Gateway, DNS, NTP, and NetBIOS configuration per pool.

Address pools can be local or remote.

Pool type Description Configuration path / behavior
Local pool DHCP pool for a directly connected LAN-side subnet where EdgeConnect is in the client broadcast domain. Select one appliance, click DHCP Settings, select a deployed LAN-side interface, and configure DHCP settings. The same dialog box is available from the Deployment page.
Remote pool DHCP pool not bound to a local interface. EdgeConnect responds as a DHCP server when DHCP relay/IP helper sends requests to an EdgeConnect LAN-side IP. Select one appliance and click Add Remote Pool. Pool selection is based on the relay giaddr (gateway IP address).

IMPORTANT: In 9.7.0, remote pools do not start DHCP service by themselves. Enable DHCP server on at least one LAN-side interface before relying on remote pools.

NOTE: Address pools can be created, edited, or deleted only when a single appliance is selected in the appliance tree.

NOTE: The scope utilization threshold is not configured per pool. It is a global setting (accessible from the System Information tab in the Orchestrator UI) that applies to both directly connected and non-directly connected address pools.

Lease

The Lease subtab provides centralized visibility and operational control of active DHCP leases. The subtab displays only active leases.

Capabilities include:

  • Viewing all active leases for a selected appliance set.
  • Filtering by IP/Subnet, MAC address, or interface.
  • Deleting:
    • Selected leases
    • All leases matching a filter
    • All leases on a single appliance

These functions support faster troubleshooting and IP reclamation during reconfiguration or device replacement scenarios.

DHCP lease statuses

The different lease statuses provide visibility into the state of IP address assignments and help you manage the DHCP pool effectively. IP address status designations are as follows:

  • free: The IP address is available in the DHCP pool and has not been assigned to any client. Typically, the Primary DHCP Failover server allocates free leases.
  • backup: The IP address is not assigned to a client by the DHCP Failover peer servers and can be assigned by any DHCP Failover peer server. This occurs during failover scenarios or when the active server is unavailable. Typically, the Secondary DHCP Failover server allocates backup leases.
  • active: The IP address is assigned to a client, and the lease is currently held by the active DHCP server.
  • abandoned: The IP address was previously assigned to a client, but the lease has expired, and the client has not renewed it. The IP address is not immediately available for reuse and may go through a waiting period before being returned to the free pool.

Each DHCP server of a failover pair acts as a backup for the DHCP leases of its peer. For example, the DHCP server of EdgeConnect-1 hands an IP lease to a client 172.23.2.50. This IP address shows as active on both EdgeConnect-1 and EdgeConnect-2 DHCP Failover peer servers.

Scope

The Scope subtab provides a real-time summary of DHCP scope utilization, including:

  • Subnet and scope name.
  • Total, allocated, and available IP addresses.
  • Utilization percentage per scope.

This view enables administrators to identify potential scope exhaustion issues and plan capacity adjustments before service is impacted.

Reservation

The Reservation subtab allows centralized management of static IP assignments.

Capabilities include:

  • Add, edit, and delete reservations.
  • Validate MAC and IP address formats.
  • Prevent duplicate IP usage (duplicate MAC addresses are allowed).
  • Search reservations by device name, MAC, or IP address.

NOTE: Reservations can only be modified when a single appliance is selected.

NOTE: Reservations can only be made for IP addresses outside the configured IP pool ranges. In addition, a reserved IP address must not belong to the lease file, and it must belong to one of the subnets (local or remote) configured by the user.

Service

The Service subtab displays the current status (Up / Down) of the DHCP and Relay services on each appliance. It is read-only and does not provide control over the service lifecycle.

NOTE: If DHCP server status is down, remote pools do not serve clients until DHCP server is enabled on a LAN-side interface.

Profiler

The Profiler subtab supports simultaneous DHCP server operation and DHCP Discovery forwarding, enabling device profiling workflows (for example, integration with ClearPass). This feature is commonly referred to as IP Helper.

IMPORTANT: The Profiler subtab is not a replacement for DHCP/BOOTP Relay mode. DHCP/BOOTP Relay is used when a given interface does not serve DHCP—it instead forwards all client requests for a given interface to a remote DHCP server. The Profiler is used when the appliance is the DHCP server and additionally needs to forward DHCP Discovery traffic to a NAC or profiler system (such as ClearPass) for device fingerprinting. This is referred to as ClearPass Device Insight (CPDI). These are distinct features and can operate simultaneously. Segmentation (VRF) must be enabled before the Profiler subtab is configurable.

Capabilities include:

  • Configure one or more IP helper addresses (maximum: 2).
  • Map IP helpers to segments (VRFs).
  • Validate helper/segment pairings.
  • Enforce segmentation prerequisites.

This enables forwarding DHCP discovery traffic to a profiler for device classification while the appliance continues to assign addresses locally.

Failover state

The Failover state subtab enables real-time monitoring of failover health and synchronization:

  • Monitor real-time failover health and synchronization status.
  • View partner state, timestamps, and failover group details.

This subtab displays the DHCP failover peer states of each server for troubleshooting purposes.

Failover group name support allows failover to work when peers use different LAN-side interface names (for example, lan0 on one appliance and lan1 on the other).

NOTE: Disabling EdgeHA for RMA or other changes invalidates the DHCP failover configuration, and some values—such as My IP and Peer IP—can be deleted.

DHCP failover state fields

Field Description
Appliance Name of the EdgeConnect appliance that is part of the DHCP failover configuration.
Failover Group Name Failover group name that is the same for all the tagged and untagged interfaces corresponding to one physical interface.
My State Failover endpoint state of the selected primary appliance. The states are: Normal, Communications-Interrupted, Partner-Down, Recover, Recover-Wait, Recover-Done, Unknown.
My State Time Date and time when the selected appliance’s DHCP server entered the specified state in the table.
Partner State Failover endpoint state of the partner appliance. The states are: Normal, Communications-Interrupted, Partner-Down, Recover, Recover-Wait, Recover-Done, Unknown.
Partner State Time Date and time when the partner appliance entered the specified state in the table.
MCLT Maximum client lead time: the maximum amount of time that one server can extend a lease for a client’s binding beyond the time known by the partner.

DHCP failover state descriptions

  • Normal: Both EdgeConnect DHCP servers are exchanging keepalives correctly and DHCP bindings are synchronized.
  • Communications-Interrupted: Each EdgeConnect is unable to exchange DHCP failover messages and independently services DHCP requests. In this state, each EdgeConnect assumes that the partner EdgeConnect is not down, but only unable to exchange failover messages.
  • Partner-Down: The local EdgeConnect has determined that its failover partner is down and has taken over responsibility for serving all DHCP requests for the shared address pools. The local server continues to operate independently until the partner returns and the two servers resynchronize.
  • Recover: The local EdgeConnect is trying to establish full synchronization of DHCP bindings with the previously down EdgeConnect. In this state, EdgeConnect does not serve any DHCP requests until the DHCP bindings are fully synchronized between them.
  • Recover-Wait: The DHCP server is waiting for a period equal to the Maximum Client Lead Time (MCLT) before transitioning to the Recover-Done state. During this time, the server is preparing to synchronize its lease database with its peer server so as to avoid any inconsistencies.
  • Recover-Done: EdgeConnects enter this state after recovering from a communication failure and completing the synchronization of DHCP bindings. EdgeConnects transition to this state after they recover state but prior to the normal state.
  • Unknown: This indicates the peer state is unreachable or has not received any responses from the peer for the amount of Max Response Delay timer.

Relay

The Relay subtab centralizes DHCP relay configuration:

  • Select relay interfaces.
  • Configure destination DHCP servers.
  • Enable Option 82 and define relay policies.
  • Support per-segment DHCP relay behavior.

DHCP relay forwards client DHCP packets to a DHCP server, receives the server responses, and returns the responses to the clients.

Failover Configuration

DHCP failover is configured through the DHCP Settings dialog box for an interface, not through a dedicated DHCP Manager subtab. The DHCP Manager provides the Failover state subtab for monitoring failover health and synchronization.

DHCP failover configuration supports:

  • Creating and managing DHCP failover relationships.
  • Assigning a failover relationship for all non-directly connected subnets.
  • Assigning Primary and Secondary roles.
  • Configuring peer IPs, ports, MCLT, and load balancing (SPLIT) parameters.

For full details, see DHCP Failover.

Monitoring and Alarms

The DHCP Manager introduces proactive monitoring capabilities:

  • Configurable scope utilization thresholds (default 90%).
  • Alarms when utilization crosses defined high-water marks.
  • Central visibility into DHCP health across appliances.

This supports early detection of scope exhaustion and service degradation risks. See Alarms for a full list of DHCP-related alarms.

Release and Compatibility Notes

  • DHCP Manager is available starting with Orchestrator and appliance version 9.7.0.
  • No new external packages are required.
  • Existing configurations are preserved and upgraded automatically where applicable.

DHCP settings Integration

The DHCP settings subtab in DHCP Manager opens the same DHCP configuration dialog box used from the Deployment page.

  1. Select exactly one appliance in the tree.
  2. Click DHCP settings.
  3. Select the deployed LAN-side interface.
  4. Configure DHCP server, relay, and related interface-level settings.
  5. Click Save.

DHCP Pseudo LAN Client Isolation

A DHCP-based pseudo LAN Client Isolation pattern can use a /32 subnet mask option so clients ARP for the default gateway and traffic is routed through EdgeConnect for policy evaluation.

CAUTION: This pattern is not universal segmentation. Some clients might not behave correctly with /32 mask behavior.

ARP Visibility

The web UI provides ARP table visibility and supports clearing individual or all ARP entries.

Logging and Troubleshooting Notes

  • There is no new dedicated DHCP CLI for this enhancement set.
  • In ECOS 9.6.0.0 and later, feature-level debug can capture DORA (Discover, Offer, Request, Acknowledge) DHCP events in audit logs.
  • Formal top-level DHCP logging is not available as a separate feature.

Known Limitations

  • DHCPv6 server is not available in this feature set.
  • DHCP configuration and failover are not orchestrated automatically. Configuration remains per appliance.
  • The UI does not directly start, stop, or restart the DHCP service.