WebChecks

Moves Windows Server DHCP configuration to a SonicWall: scopes, exclusions, reservations and options, imported as disabled entries for you to review and cut over by hand.

Downloads are temporarily unavailable.

What it does

Retiring a Windows server often means moving its DHCP role to the site firewall. Recreating scopes by hand is slow and error-prone because firewalls model DHCP differently: SonicWall has no exclusion ranges, and its static entries cannot sit inside a dynamic range. ScopeShift translates the Windows configuration and shows you the result before anything is written.

  1. 1

    Export

    DHCP server

    Reads the DHCP configuration and writes a plan folder. Read-only, with no network connection. You then copy the plan folder to your workstation.

  2. 2

    Review

    Workstation: the app, or the CSV files in Excel

    Include or skip scopes, reservations and options; set the interface mapping; choose what happens to the address of a skipped reservation.

  3. 3

    Check

    Workstation, read-only connection to the firewall

    Validates the plan, reads the firewall's existing DHCP configuration, reports conflicts and scope capacity, and shows the computed firewall configuration. The firewall's certificate is accepted on the first Check, and ScopeShift stops if it changes.

  4. 4

    Import

    Workstation, writing to the firewall

    Re-checks, then creates or updates ScopeShift's tagged entries, all disabled, and commits.

  5. 5

    Verify

    Workstation, firewall read-only

    Reads the entries back and compares them field by field with the plan.

  6. 6

    Cutover

    You, by hand

    Follow the generated checklist: deactivate each Windows scope, then enable the matching firewall entries.

  7. 7

    Post-cutover check

    DHCP server and workstation, read-only

    Reports any subnet where both servers, or neither server, is serving.

ScopeShift never switches DHCP over. Every entry it creates on the firewall is disabled. You deactivate the Windows scopes and enable the firewall entries yourself, in the order the checklist gives.

A plan can be checked and imported again after edits. A re-import updates ScopeShift's own disabled entries and lists entries that are no longer in the plan, for you to remove by hand.

What it never does

  • Change the Windows DHCP server
  • Enable DHCP or scopes on the firewall
  • Delete firewall objects
  • Modify firewall objects ScopeShift did not create
  • Create interfaces or VLANs
  • Change relay or IP helper configuration

What is migrated, and what is only reported

Migrated

  • IPv4 scopes
  • Exclusions
  • Reservations
  • Lease duration
  • Server-, scope- and reservation-level options. Common options map to native firewall fields; other standard options become firewall option objects where the target supports them.

Reported, not migrated

  • Inactive scopes (skipped by default)
  • Superscope grouping
  • Multicast scopes
  • Failover relationships
  • DHCP policies
  • Vendor and user classes
  • DNS dynamic update settings
  • Reservations whose client ID is not a MAC address
  • Options the target cannot represent
  • IPv6

Requirements

DHCP server
Windows Server 2012 through 2025 with Desktop Experience and the DHCP Server role. Server 2008 R2 SP1 and Small Business Server 2011 on a best-effort basis. Server Core is not supported. The export needs local administrator or DHCP Administrators rights.
Workstation
Windows 10 22H2, Windows 11, or Windows Server 2019 or later, with HTTPS access to the firewall's management interface.
Firewall
SonicWall running SonicOS 7 or SonicOS 8, with the SonicOS API and HTTPS management enabled on the interface the workstation reaches. SonicOS 6 and earlier are refused.
Account
A firewall administrator account. For an account with two-factor authentication, turn on the API's two-factor bearer token setting. Do not sign in to the firewall's web interface as the same administrator while ScopeShift is connected; on SonicOS 7.2 that ends ScopeShift's session.

Privacy and security

  • Firewall credentials are prompted for on each run and never stored: not on disk, in logs, in the plan folder, in process arguments or on the clipboard. The app keeps the firewall's API session in memory between steps while a plan is open; the password is not kept.
  • There is no telemetry, no crash upload and no update check.
  • The only network connection ScopeShift makes is from your workstation to the firewall you configure. The export on the DHCP server makes no network connection at all.
  • The firewall's certificate is accepted and pinned on a plan's first Check. If it changes later, every step stops.
  • The plan folder holds customer network data: subnets, host names, MAC addresses and reports. Keep it only where customer data may be kept, and delete it when the migration is finished.

How webchecks.io serves these files and what it records about downloads is on the security page.

Download and verify

Downloads are temporarily unavailable.

These files are not code-signed: a matching SHA-256 hash proves a file is the one published here, not who published it.

  1. Download the executables you need and SHA256SUMS.txt into one folder.

  2. In PowerShell in that folder, hash each file:

    Get-FileHash .\scopeshift-gui.exe -Algorithm SHA256

    The hash must equal the one shown on this page and the line for that file in SHA256SUMS.txt, ignoring case. If it differs, delete the file.

  3. Remove the downloaded-file mark, so Windows does not block the file:

    Unblock-File .\scopeshift-gui.exe

  4. On first start, Windows SmartScreen may say the publisher is unknown: choose More info, then Run anyway.