DHCP

Configure DHCP scopes served by your Service Gateways. Each scope is an IP range plus options handed to guest devices.

For Sign-In Contexts served by a Service Gateway, DHCP runs in the Netgraph cloud. The Service Gateway relays guest DHCP requests up to the cloud DHCP service, so no separate on-site DHCP server is required. The DHCP tab under Service Gateway is where you configure the scopes the cloud hands out.

What a scope is

A scope is one range of IP addresses a Service Gateway will allocate to guests. Each scope carries the options handed to devices when they request a lease:

Address range — the pool of IPs the scope issues.
Subnet mask / prefix length.
Default gateway — the router IP guests should use.
DNS servers — the resolver guests should use; override if you want guests to resolve through something else.
Lease time — how long an allocation is valid before the device has to renew.
DHCP Option 114 — the Captive Portal URL, advertised per RFC 8910.

A Sign-In Context can have many scopes — typically one per VLAN, subnet, or physical site.

Scopes list

The DHCP tab shows all scopes configured on this Context. Each row identifies the scope with columns for network, start, stop, size, gateway, the Service Gateways it’s enabled on, its Option 114 policy (pill: Default, Always On, or Always Off), and the Connected to Site. Click a row for the per-scope detail editor.

Adding a scope

Create scopes one at a time from the DHCP tab, or use Batch upload to onboard many at once.

Batch upload

For deployments with many VLANs or subnets, upload a scope file instead of clicking through the UI per scope. The batch-upload view validates each row and reports errors line-by-line before committing the set.

Site matching through scopes

A scope’s IP range identifies which site a guest belongs to — see Site-based redirects. Keep scopes non-overlapping with sites; one scope should map to one site for unambiguous matching.

DHCP Option 114

Sign In populates DHCP Option 114 with the Captive Portal URL automatically on scopes served by the Service Gateway. Modern clients (recent iOS, Android, Windows, macOS) read this option and surface a “Sign in to network” prompt directly, avoiding the probe-redirect dance.

Two controls decide whether a given scope advertises it:

A Context-wide default — the Enable Option 114 checkbox in the DHCP Common Settings card (on by default). Scopes without their own override inherit this.
A per-scope policy — the Option 114 Policy dropdown on each scope, with three values: Default (as configured in Dhcp - Common Settings), Override - Always On, Override - Always Off. The scopes list shows the resolved state as a pill: Default, Always On, or Always Off.

See DHCP Option 114 for background and the full configuration walkthrough.

Troubleshooting guest IP assignment

If guests aren’t getting IPs:

Confirm the scope is attached to the correct Gateway.
Check the scope’s exhaustion — a fully allocated scope produces “no address available” errors.
Confirm the cloud DHCP service for this Context is active; the Status card on the Context Dashboard shows this at a glance.
Check for overlapping scopes served by upstream DHCP relays.