3.1.3. Common Network Configuration Concepts (DNS, DHCP, VLAN)

💡 First Principle: To create a scalable, manageable, and secure network, you must use DHCP for automated IP assignment, DNS for name resolution, and VLANs for logical traffic segmentation.

Scenario: You are setting up a new office network. You need to ensure that all corporate computers automatically receive an IP address from the 10.10.10.0/24 range, can resolve public domain names, and that all guest Wi-Fi traffic is on a separate, isolated network that cannot access internal resources.

These services are the unsung heroes of modern networking.

• DHCP (Dynamic Host Configuration Protocol): Automatically assigns IP addresses, subnet masks, default gateways, and DNS servers to clients.
  • Key Concepts: Scope (the range of available IPs), Leases (how long a client can keep an IP), Reservations (assigning the same IP to a specific device every time).
  • Scope exhaustion: When every address in the scope is leased, new devices cannot get an address (they show no IP or fall back to APIPA) while devices that already hold leases keep working.
  • Static configuration: A host without DHCP needs an IP address, subnet mask and default gateway (the router interface that forwards traffic to other networks), plus a DNS server, to reach the internet.
• DNS (Domain Name System): Translates human-readable domain names (e.g., www.comptia.org) into machine-readable IP addresses (e.g., 104.26.10.179).
  • Key Records: A (maps a name to an IPv4 address), AAAA (maps a name to an IPv6 address), CNAME (an alias for another name), MX (identifies a mail server).
  • TXT Records: Free-form text records, used for domain-ownership verification and email authentication: SPF lists the mail servers authorized to send email for the domain (RFC 7208 publishes it as a TXT record), alongside DKIM and DMARC.
• VLAN (Virtual LAN): Allows you to create logically separate networks on the same physical switch.
  • Use Case: Segregating traffic for security or organizational purposes (e.g., creating a separate VLAN for guests, VoIP phones, or a specific department).
• VPN (Virtual Private Network): Creates a secure, encrypted tunnel over a public network (like the internet) to allow remote access to a private network.
• VPN split tunneling: Only traffic bound for the corporate network goes through the VPN; other traffic goes straight to the internet. A wrong split-tunnel setting on one client can leave that user connected to the VPN yet unable to reach internal resources while other VPN users are fine.
• IP Addressing Basics:
  • IPv4 format: four decimal octets, each 0-255 (an octet of 256 or more is invalid).
  • Private (RFC 1918, not routable on the internet): Class A 10.0.0.0/8 (10.0.0.0-10.255.255.255), Class B 172.16.0.0/12 (172.16.0.0-172.31.255.255) and Class C 192.168.0.0/16 (192.168.0.0-192.168.255.255). Addresses just outside them, such as 172.32.x.x, are public, as is 8.8.8.8. Private hosts reach the internet through NAT on the router, which translates their private addresses to its public address.
  • Special-purpose: APIPA 169.254.0.0/16 is self-assigned when no DHCP server answers and works only on the local segment; loopback 127.0.0.0/8 (127.0.0.1) is the host itself.
  • IPv6: 128-bit address written as eight colon-separated hexadecimal groups, with :: abbreviating a run of zeros (e.g., fe80::200:5aee:feaa:20a2, a link-local address). Dotted decimal is IPv4 and dash-separated hex is a MAC address.
  • Network ID: The IP address ANDed with the subnet mask; 192.168.1.100 with 255.255.255.0 is on network 192.168.1.0 (192.168.1.255 is the broadcast address). Hosts on different subnets need a router to communicate.
  • CIDR Notation: The number after the slash counts the network bits in the subnet mask: /24 = 255.255.255.0, /16 = 255.255.0.0, /8 = 255.0.0.0 (and /32 = 255.255.255.255, a single host).

Sizing a private range (RFC 1918): 10.0.0.0/8 holds about 16.7 million addresses (2^24), 172.16.0.0/12 about 1 million (2^20), and 192.168.0.0/16 about 65,000 (2^16), so a network expected to grow past 100,000 devices needs 10.0.0.0/8. 169.254.0.0/16 is never assigned on purpose; it is the APIPA fallback.

⚠️ Common Pitfall: A "rogue DHCP server" – a misconfigured device (like a home router plugged into the corporate network) that starts handing out incorrect IP addresses, causing widespread connectivity issues.

Key Trade-Offs:

• Static vs. Dynamic IP Addressing: Dynamic (DHCP) is easy to manage for clients. Static IP addresses are manually configured and are necessary for servers, printers, and other devices that need a permanent, predictable address.

Reflection Question: How would you use DHCP, DNS, and VLANs together to solve the scenario of setting up a new office network with separate guest and corporate access?