CCNA online course

Dynamic Host Configuration Protocol (DHCP) for CCNA

Learn DHCP for CCNA: IPv4 configuration, DORA, leases, Cisco IOS DHCP servers, relay agents, verification, security, and troubleshooting.

Dynamic Host Configuration Protocol (DHCP) automatically supplies IPv4 configuration to network clients. Instead of manually entering an address, subnet mask, gateway, and DNS server on every device, a client requests these settings from a DHCP service.

This lesson covers DHCP operation, the DORA exchange, lease behavior, Cisco IOS configuration, relay agents, verification, troubleshooting, and basic security. It assumes familiarity with the OSI reference model, IPv4 addressing, VLANs, default gateways, and Cisco IOS configuration modes.

Why DHCP Is Used

A host needs a valid IPv4 address and subnet mask to communicate on its local network. It also normally needs a default gateway to reach other networks and a DNS server to translate names such as example.local into IP addresses.

DHCP provides these values automatically and manages them centrally. This reduces typing mistakes, prevents many duplicate-address errors, and makes it practical to configure large groups of devices.

  • Client devices: laptops, desktops, phones, tablets, and other user endpoints can receive settings when they join a network.
  • User VLANs: each VLAN can have a separate address pool and policy.
  • Voice endpoints: phones can receive voice-network information and optional voice-related DHCP parameters when the platform requires them.
  • Temporary devices: visitors, contractors, and test systems can receive time-limited access without permanent manual configuration.

What DHCP Supplies

A DHCP response contains an IPv4 address and options. An option is a field that communicates configuration beyond the address itself.

Option or setting | Purpose | Common Cisco IOS pool command | Example value

IPv4 address range | Addresses that clients may lease | network | 192.168.10.0 255.255.255.0

Subnet mask | Identifies the local network and host portion | Included by network | 255.255.255.0

Default gateway | Router address used for remote networks | default-router | 192.168.10.1

DNS server | Resolves host names | dns-server | 192.168.10.10 8.8.8.8

Domain name | Supplies the client's DNS search domain | domain-name | example.local

Lease duration | Limits how long the address may be used | lease | 7 days

Optional services | Can identify TFTP, NTP, or voice-related services | Platform- or option-specific | Depends on the deployment

DHCP Architecture and Roles

A DHCP client is a host or interface requesting configuration. A DHCP server manages address pools, options, leases, and often a lease database. A DHCP relay agent is a Layer 3 device that forwards DHCP messages between a client subnet and a server on another subnet.

A scope, also called a DHCP pool, is the collection of addresses and settings for one IPv4 subnet. A pool usually contains a network statement, gateway, DNS settings, and lease duration.

  • An excluded address is inside the subnet but is not dynamically assigned. Use exclusions for router interfaces, switch management addresses, servers, printers, and other infrastructure.
  • A reservation maps a planned address to a particular client identity, commonly its MAC address. The client still uses DHCP, but receives a predictable address.
  • A lease is the time-limited right to use an address. Expired addresses can return to the available pool.

Characteristic | DHCP server | DHCP relay agent

Primary role | Allocates addresses and options | Forwards client DHCP messages

Address pools | Maintains scopes or pools | Does not normally allocate addresses

Typical location | Router, server, or network service | Client-facing router interface or SVI

Required for remote server | Provides the service | Yes, when the server is on another subnet

Lease database | Tracks bindings and lease state | May maintain relay information but is not the lease authority

The DHCP DORA Exchange

DORA means Discover, Offer, Request, and Acknowledgment. It describes initial address acquisition.

  1. DHCPDISCOVER: the client broadcasts a request because it may not yet have an address or know the DHCP server's address.
  2. DHCPOFFER: a server proposes an available address, lease duration, and options.
  3. DHCPREQUEST: the client selects an offer and broadcasts or sends a request identifying the selected server and address.
  4. DHCPACK: the selected server confirms the lease. The client installs the address and options and begins using them.

Stage | Message | Sender | Recipient | Purpose | Typical transport behavior

1 | DHCPDISCOVER | Client | Broadcast or relay | Find available DHCP servers | UDP source port 68 to destination port 67

2 | DHCPOFFER | Server | Client or relay | Propose an address and options | UDP source port 67 to destination port 68

3 | DHCPREQUEST | Client | Broadcast or selected server through relay | Select an offer or request renewal | UDP source port 68 to destination port 67

4 | DHCPACK | Server | Client or relay | Finalize the lease | UDP source port 67 to destination port 68

Before configuration is complete, the client may use an IPv4 source of 0.0.0.0 and a broadcast destination such as 255.255.255.255. Ethernet and IP broadcasts remain within the local broadcast domain unless a relay agent forwards the request.

DHCP uses UDP port 67 for servers and UDP port 68 for clients. A server that cannot honor a request may send a DHCPNAK. The client must discard the invalid configuration and begin discovery again, often because the address belongs to another subnet or the requested lease is no longer valid.

DHCP Lease Lifecycle

After a DHCPACK, the client has an active lease. The client tracks the lease duration and attempts renewal before expiration, normally by sending a DHCPREQUEST to the original server. If the original server cannot be reached, the client enters a rebinding phase and tries to obtain confirmation from any available DHCP server.

  • Allocation: the server selects an available address and records a binding.
  • Renewal: the client asks the original server to extend the lease.
  • Rebinding: if the original server is unavailable, the client broadcasts a request so another authorized server can respond.
  • Release: when shutting down or leaving the network, a client may send DHCPRELEASE. The server can then reuse the address.
  • Expiration: if the lease expires without renewal, the client must stop using the address. The server can later return it to the available pool.

A client may remember its previous address and request it again after reconnecting. The server may approve it with a DHCPACK, offer a different address, or reject it with a DHCPNAK. A remembered address is not a permanent entitlement.

Planning DHCP Address Pools

Design each pool around one subnet and broadcast domain. For a 192.168.10.0/24 user VLAN, 192.168.10.1 is commonly the gateway, but the exact design is up to the administrator.

  • Define the correct network and mask for the VLAN.
  • Exclude infrastructure addresses before clients begin leasing addresses.
  • Keep dynamic ranges from overlapping other pools.
  • Make the pool's default-router value match the gateway interface for that VLAN.
  • Use a separate pool for each VLAN or routed broadcast domain.
  • Choose lease durations based on endpoint turnover. Shorter leases suit guest or temporary networks; longer leases reduce renewal traffic for stable user networks.
  • Keep manually configured static addresses outside the dynamic range, or use reservations instead.

For example, reserve 192.168.10.1 through 192.168.10.20 for routers, switches, printers, and servers. The remaining addresses can be dynamically assigned to users. An address-pool diagram should distinguish excluded infrastructure, reserved addresses, active bindings, and available addresses.

Configuring a Cisco IOS DHCP Server

The following example configures a router as the DHCP server for a local user LAN. The router's LAN interface must already have 192.168.10.1/24 and be operational.

ip dhcp excluded-address 192.168.10.1 192.168.10.20
!
ip dhcp pool USERS
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.1
 dns-server 192.168.10.10 8.8.8.8
 domain-name example.local
 lease 7

The network command defines the subnet, not merely an arbitrary range. The default-router command supplies the client gateway. The DNS and domain commands supply name-resolution information and a search domain. The lease value above is measured in days.

For multiple VLANs, create a separate pool for each subnet. For example, staff and guest VLANs should have different network statements, gateways, DNS policy, exclusions, and usually different lease durations. Inter-VLAN routing can be provided by a multilayer switch or by router-on-a-stick.

Save the configuration after testing:

copy running-config startup-config

DHCP Relay Agents

Routers do not forward ordinary IPv4 broadcasts between interfaces. Therefore, a client broadcast cannot normally reach a DHCP server located on another subnet.

Configure ip helper-address on the client-facing Layer 3 interface, such as an SVI or routed interface:

interface Vlan20
 ip address 192.168.20.1 255.255.255.0
 ip helper-address 192.168.100.10

The relay receives the client request, forwards it toward 192.168.100.10, and includes relay information such as the gateway address field. The DHCP server uses that originating-subnet information to select the correct scope. A matching scope for 192.168.20.0/24 must exist on the server.

Ensure routing exists in both directions between the relay and server, and check ACLs or firewalls that could block DHCP traffic. Cisco helper behavior can forward additional UDP broadcast services besides DHCP, so review the platform behavior and restrict forwarding when the design requires it.

DHCP Client Operation

Endpoint operating systems normally use a network adapter setting such as “obtain an IPv4 address automatically.” The operating system then performs the DHCP exchange and installs the address, mask, gateway, DNS servers, and lease data.

A Cisco router interface can also act as a DHCP client, commonly on a WAN link:

interface GigabitEthernet0/0
 ip address dhcp
 no shutdown

In this design, the branch router's WAN interface receives its address from an upstream provider or router, while a separate LAN interface may serve internal clients with a local DHCP pool.

Verification and Monitoring

Command | What it displays | When to use it

show ip dhcp pool | Pool names, subnets, utilization, and available addresses | Check scope definition and exhaustion

show ip dhcp binding | Active client-to-address bindings and lease information | Confirm that clients received leases

show ip dhcp conflict | Addresses detected as conflicting | Investigate duplicate-address symptoms

show running-config | section dhcp | Exclusions, pools, and DHCP-related configuration | Review the configured design

show ip interface brief | Interface status and assigned addresses | Check gateway, SVI, and relay interface state

From a client, verify the received IPv4 address, subnet mask, default gateway, DNS server, and lease expiration. Test in order: the local gateway, a reachable remote IP address, and the configured DNS server. Then test name resolution.

In a controlled lab or maintenance window, debugging can reveal message and event details:

debug ip dhcp server events
debug ip dhcp server packet
undebug all

DHCP Troubleshooting

Symptom | Likely cause | Verification step | Corrective action

No usable address or 169.254.0.0/16 address | Server unavailable, wrong VLAN, down gateway, missing relay, or exhausted pool | Check link, VLAN, interface state, pool utilization, and bindings | Correct connectivity, relay, interface, or pool capacity; renew the client

Address received but remote networks fail | Wrong default gateway, mask, or VLAN | Inspect client settings and ping the configured gateway | Correct the pool gateway or mask and VLAN assignment

IP connectivity works but names fail | Incorrect or unreachable DNS server | Inspect DNS option and test DNS-server reachability | Correct the dns-server setting or repair DNS service

Remote VLAN receives no lease while local clients work | Missing helper, missing matching scope, routing, ACL, or filtering problem | Check the client-side SVI, routes, ACLs, and server scopes | Add or correct helper configuration and the remote scope

Pool has no available addresses | Address pool exhaustion or excessively long leases | Use show ip dhcp pool and show ip dhcp binding | Expand the subnet when appropriate, shorten leases, or remove stale clients

Duplicate IP warnings | Static address inside dynamic range, unauthorized server, or overlapping pools | Check conflicts, configuration, and DHCP server responses | Exclude static addresses, remove overlap, and investigate unauthorized service

  1. Confirm the physical link and client access-port VLAN.
  2. Check that the VLAN's routed interface or SVI is up and has the expected gateway address.
  3. Verify that a DHCP pool matches the client subnet exactly.
  4. Check exclusions, available addresses, bindings, and conflicts.
  5. If the server is remote, verify the helper address and two-way routing.
  6. Inspect the received mask, gateway, DNS server, and domain name.
  7. Renew the client lease after correcting the problem.

DHCP Security and Operations

An unauthorized DHCP server can give clients a false gateway or DNS server, redirecting traffic or disrupting communication. A DHCP starvation attack attempts to consume all available addresses by generating many requests with different client identities.

DHCP snooping is a switch security feature that filters DHCP server messages on untrusted ports and can build bindings of client MAC addresses, VLANs, IP addresses, and switch ports. Ports toward an authorized DHCP server or relay are marked trusted; ordinary client-facing ports remain untrusted.

ip dhcp snooping
ip dhcp snooping vlan 10,20
!
interface GigabitEthernet1/0/1
 ip dhcp snooping trust

Apply the feature according to the switch topology and platform syntax. Combine it with appropriate rate limits and other access-layer controls where supported. Keep infrastructure addresses outside dynamic pools, document exclusions and reservations, and maintain backups of DHCP configuration and lease-management records.

Key Terms and Exam Notes

  • DHCP: a protocol that automatically supplies IP configuration information to clients.
  • DORA: Discover, Offer, Request, Acknowledgment.
  • DHCPNAK: a server rejection indicating that the requested address or network context is invalid.
  • UDP 67 and 68: server and client DHCP ports, respectively.
  • ip helper-address: Cisco IOS interface configuration used to relay DHCP requests to a remote server.
  • Default gateway versus server: the gateway routes client traffic; the DHCP server supplies the lease. These roles may be on different devices.
  • One pool per subnet: every VLAN or routed broadcast domain needs matching DHCP addressing and options.
  • Static-address protection: exclude manually assigned infrastructure addresses or use reservations.

DHCP is an IPv4 service. IPv6 uses different mechanisms, including SLAAC and DHCPv6. Related Cisco skills include trunk configuration, NTP configuration, and basic routing such as OSPF.