Back to Checks
openstack

DHCP is enabled on subnets

networking_subnet_dhcp_disabled
Service: networkingSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:OS::Neutron::Subnet

OpenStack subnets are evaluated to verify that DHCP is enabled (enable_dhcp=True). DHCP automatically assigns IP addresses, DNS servers, and gateway information to instances at boot. Subnets with DHCP disabled require manual configuration, increasing operational complexity and IP conflict risk. Enable DHCP to simplify deployment and ensure cloud-init functionality.

Prowler logoProwlerprowler-provider-openstack

Risk

Instances fail to acquire IP addresses and cannot communicate without manual intervention, breaking automated deployment pipelines (Heat, Terraform, Ansible). Manual configuration increases deployment time, error rates, and IP conflict risk. Cloud-init depends on DHCP for metadata service discovery; without DHCP, instances cannot retrieve SSH keys or user-data, breaking bootstrapping.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler openstack --checks networking_subnet_dhcp_disabled

Recommendation

Enable DHCP on all subnets unless there is a documented reason for static IP assignment. Use DHCP for automated IP management, simplified instance deployment, and proper cloud-init functionality. For environments requiring static IPs, use DHCP reservations or allowed-address-pairs instead of disabling DHCP entirely.

Remediation

CLI

openstack subnet set --dhcp <subnet_id>

Terraform

resource "openstack_networking_subnet_v2" "subnet" {
  name            = "app-subnet"
  network_id      = openstack_networking_network_v2.network.id
  cidr            = "192.168.1.0/24"
  ip_version      = 4
  enable_dhcp     = true  # GOOD: DHCP enabled
  dns_nameservers = ["8.8.8.8", "8.8.4.4"]
}

Other

1*Enable DHCP via Horizon Dashboard:**
2Navigate to **Project > Network > Networks**
3Click on the network containing the subnet
4Click the **Subnets** tab
5For each subnet, click **Edit Subnet**
6In the **Subnet Details** tab:
7- Ensure **Enable DHCP** checkbox is **checked**
8Click **Save**

Check Code

"""OpenStack Network Subnet DHCP Check."""

from typing import List

from prowler.lib.check.models import Check, CheckReportOpenStack
from prowler.providers.openstack.services.networking.networking_client import (
    networking_client,
)


class networking_subnet_dhcp_disabled(Check):
    """Ensure DHCP is enabled on subnets."""

    def execute(self) -> List[CheckReportOpenStack]:
        """Execute networking_subnet_dhcp_disabled check.

        Iterates over all subnets and verifies that DHCP is enabled
        to ensure instances can obtain IP addresses automatically.

        Returns:
            list[CheckReportOpenStack]: List of findings for each subnet.
        """
        findings: List[CheckReportOpenStack] = []

        for subnet in networking_client.subnets:
            report = CheckReportOpenStack(metadata=self.metadata(), resource=subnet)
            report.resource_id = subnet.id
            report.resource_name = subnet.name or f"subnet-{subnet.id[:8]}"
            report.region = subnet.region

            if not subnet.enable_dhcp:
                report.status = "FAIL"
                report.status_extended = f"Subnet {subnet.name} ({subnet.id}) on network {subnet.network_id} has DHCP disabled, which may prevent instances from obtaining IP addresses automatically."
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Subnet {subnet.name} ({subnet.id}) has DHCP enabled."
                )

            findings.append(report)

        return findings

References