I've got a scenario where I need administrators to be able to browse a large number of lower privilege users.

If my understanding of the whole thing is correct, I am planning two DHCP scopes each listening on separate ethernet interfaces. The following config should work such that Pool_0 can communicate with Pool_1.

Pool_0 (not many users here)
DHCP Range 172.16.0.10 - 172.16.0.50
Netmask: 255.255.252.0
Network: 172.16.0.0/22
Broadcast: 172.16.3.255
HostMin: 172.16.0.1
HostMax: 172.16.3.254

Pool_1 (MANY users here)
DHCP Range: 172.16.2.1 - 172.16.3.254
Netmask: 255.255.254.0
Network: 172.16.2.0/23
Broadcast: 172.16.3.255
HostMin: 172.16.2.1
HostMax: 172.16.3.254

The 300+ users in Pool_1 will(?) not be able to reach Pool_0. I intend to limit the range of addresses given out by each DHCP server so there are no conflicts.

Will this work as I've described?

The main problem with your approach is that you have overlapping subnets. This is not a valid configuration.

What happens when a host in the upper half of the 172.16.0.0/22 subnet tries to contact a host in the 172.16.2.0/23 subnet? It will assume that the host exists on the local segment, and if that's not the case, it will be unable to reach it.

The only way that could possibly sort-of work, is if:

1. the two subnets were sharing the same ethernet segment, and
2. the router is willing to forward packets out the same interface that they came in on (most firewall products will not allow this)

However, (1) will not work in this case, as you're using DHCP. DHCP is a broadcast-based protocol, and both interfaces will receive the broadcast packets simultaneously.

In short, it cannot be done. Use separate, non-overlapping subnets and separate (V)LANs.

1 members found this post helpful.

Thanks for the feedback. I knew I'd have two VLANs but I didn't think it through.

The revised plan is one VLAN with the hosts that WERE in Pool_0 statically assigned as described. Meanwhile the devices that are assigned an address via DHCP will get an address as described in Pool_1