Forum Discussion

Worm_IsThe_Spice's avatar
Worm_IsThe_Spice
Copper Contributor
Apr 01, 2021

Best method for on prem DHCP when migrating all servers to Azure?

I'm moving all servers from our branch on prem sites to Azure including the domain controllers which provide dns/dhcp for clients and office phones. We have fortigate FWs which can provide dns and dhcp. What's the best way to align the dhcp addresses with dns? Forward dns to the azure dns servers? We do have an existing on prem DC with dns at our main site we also can forward dns to. Thanks a lot.

1 Reply

  • Seshadrr's avatar
    Seshadrr
    Iron Contributor
    Apr 01, 2021
    Technically feasible to make it to work as demonstrated in GitHub post - https://github.com/dmauser/DHCPServer-On-Azure
    however, migrating DHCP servers to Azure which is not supported officially, Since you mentioned that the existing DHCP server is serving client machines and few more devices It’s always recommended to keep DHCP On-Prem itself for admin related activities in an On-Prem environment.

    https://docs.microsoft.com/en-US/troubleshoot/azure/virtual-machines/server-software-support

    Apart from that Migrating Roles such as DC , FSMO & DNS Forwarders are reliable in Azure infra.

    High-Level strategy-
    1) Prepare a new VM in Azure Platform with necessary specification
    2) Prepare VNET and extend to On-Prem either S2S VPN or Express route Model
    3) Prepare Default NSG and also behind Fortigate Rule to accept Incoming rule of DCs Ports
    2) Perform Additional DC promotion to the existing forest with DNS AD integrated
    3) Migrate FSMO Role from On-Prem to Azure DC
    4) Migrate DNS Scavenge Role from On-Prem to Azure DC if appicable
    5) Ensure Small site boundary- Serverless site DC target LDAP binding to datacenter targetted to Azure
    6) Ensure Forwarders are properly defined to MS DNS standard
    6) All Branch site DHCP - DNS order design should target to Azure Domain Controller for DNS resolution
    7) All Application and other members servers in domain need to properly targetted DNS order reffered to Azure DC if it considered as datacenter


    Firewall Ports for AD

    https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts

Resources