DHCP is enabled on subnets

Check ID: networking_subnet_dhcp_disabled
Provider: OpenStack
Service: networking
Severity: MEDIUM
Categories: resilience
Resource type: OS::Neutron::Subnet

What this check verifies

OpenStack subnets are evaluated to verify that DHCP is enabled (enable_dhcp=True). DHCP automatically assigns IP addresses, DNS servers, and gateway information to instances at boot. Subnets with DHCP disabled require manual configuration, increasing operational complexity and IP conflict risk. Enable DHCP to simplify deployment and ensure cloud-init functionality.

Risk

Instances fail to acquire IP addresses and cannot communicate without manual intervention, breaking automated deployment pipelines (Heat, Terraform, Ansible). Manual configuration increases deployment time, error rates, and IP conflict risk. Cloud-init depends on DHCP for metadata service discovery; without DHCP, instances cannot retrieve SSH keys or user-data, breaking bootstrapping.

Recommendation

Enable DHCP on all subnets unless there is a documented reason for static IP assignment. Use DHCP for automated IP management, simplified instance deployment, and proper cloud-init functionality. For environments requiring static IPs, use DHCP reservations or allowed-address-pairs instead of disabling DHCP entirely.

Remediation

CLI
Terraform
Dashboard steps

openstack subnet set —dhcp <subnet_id>

resource "openstack_networking_subnet_v2" "subnet" {
  name            = "app-subnet"
  network_id      = openstack_networking_network_v2.network.id
  cidr            = "192.168.1.0/24"
  ip_version      = 4
  enable_dhcp     = true  # GOOD: DHCP enabled
  dns_nameservers = ["8.8.8.8", "8.8.4.4"]
}

Where this check fires

This check runs on every scheduled scan against your OpenStack account. Findings appear at Cloud Security → Findings filterable by Check ID = networking_subnet_dhcp_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires