What information does a DHCP server give to clients beyond just an IP address, and why does the firewall make a good DHCP server?
DHCP delivers at least 8 categories of network information, not just the IP: subnet mask, gateway, DNS server, lease time, domain name, WINS, MTU, PXE config, NTP server. Putting DHCP on the firewall is convenient because the firewall already knows the gateway IP (itself), the DNS proxy IP (itself), and the routing topology.
* A single DHCP offer hands the client far more than an IP address. *
The full DHCP-supplied parameter list:
| Parameter | Why it matters |
|---|---|
| IP address | Unique address for this client |
| Subnet mask | Defines which other addresses are local |
| Gateway (default route) | Where to send packets for unknown destinations |
| DNS server(s) | Where to resolve domain names |
| Lease time | How long the client can use this IP before renewal |
| Domain name | DNS suffix for unqualified hostnames |
| WINS server | Windows-specific name resolution (legacy) |
| MTU | Maximum packet size on this network segment |
| PXE configuration | Network boot info for diskless clients |
| NTP server | Time sync (for log correlation, certificate validation) |
Why running DHCP on the firewall is convenient:
- Gateway = the firewall itself, no extra config
- DNS server = the firewall's DNS proxy (also configured on this same FW)
- Lease tracking = audit trail of which IP was used by which MAC, when
- No extra hardware for small networks
The "Inheritance Source" mechanism:
"Inheritance Source unter dem Options-Tab würde es uns ermöglichen, Angaben, die wir vom externen DHCP-Server erhalten haben, der das Interface ethernet1/4 konfiguriert, an die Clients weiterzureichen."
If the firewall's WAN interface is itself a DHCP client (getting an IP from the ISP), the Inheritance Source option says: "for the DNS server I tell my clients, just pass through whatever the ISP gave me." This avoids hardcoding DNS server IPs.
Here it is deliberately disabled so the firewall can use its own DNS proxy as the DNS server for clients — letting clients resolve internal names.
The lease-time tradeoff:
| Lease time | Trade-off |
|---|---|
| Short (1 hour) | Quick reuse of IPs; more DHCP traffic |
| Long (8 days) | Fewer renewals; harder to clean stale leases |
| Unlimited | "Static" DHCP; easy for servers but no churn detection |
Tip: The DHCP audit trail (which MAC got which IP when) is forensically valuable. If a security incident happens, you'll want DHCP logs alongside firewall logs to correlate "this IP at this time was Bob's laptop." Make sure DHCP logging is enabled and retained.
Go deeper:
Dynamic Host Configuration Protocol (Wikipedia) — the Options tables enumerating gateway/DNS/NTP/MTU/domain parameters.