DHCPv4 on IOS: client, server and relay

Why this matters

Almost every laptop, phone, printer and access point gets its IPv4 address from DHCP. When DHCP fails, users do not see an error that says "DHCP". They see a 169.254 address, a "no internet" icon, or a printer that worked yesterday and is unreachable today. A help-desk analyst moving into networking will meet this on day one, and a junior network engineer is expected to find out within minutes whether the fault is the client, the server, or the relay between them.

On Cisco networks, routers and Layer 3 switches often play all three DHCP roles. A branch router may be the DHCP server for its LANs, a relay for a central server, and a DHCP client of its internet provider, all at once. Each role has its own commands and its own failure modes: a missing ip helper-address on a new VLAN, a pool that has run out, a server with no route back to the relay, or a security feature that quietly adds an option the server rejects. Knowing which show command exposes which fault is what turns a building full of 169.254 addresses back into a working network.

The lesson

Finding and fixing DHCPv4 faults on IOS clients, servers and relays

DHCP runs over UDP. The server listens on port 67 and the client on port 68. A new client has no address, knows no server and has no gateway, so it starts with broadcasts.

The four-message exchange

The normal exchange has four messages, often remembered as DORA:

So the first message is DHCPDISCOVER, broadcast to UDP port 67. DHCPREQUEST is also a broadcast to port 67, but it comes third. It is broadcast so that any other server that made an offer learns it was not chosen.

Other messages you should know: DHCPNAK (the server refuses a request, for example for an address from the wrong subnet), DHCPDECLINE (the client found the offered address already in use), DHCPRELEASE (the client gives the address back) and DHCPINFORM (a client with a static address asks only for options).

Lease timers. A lease is granted for a fixed time. At T1, half the lease, the client tries to renew by sending a unicast DHCPREQUEST to the server that granted it. If that fails, at T2, 87.5 percent of the lease, it rebinds by broadcasting to any server. Only if both fail does the lease expire. With an 8-hour lease from 10.1.99.5, the first renewal attempt is after 4 hours, by unicast to 10.1.99.5. The broadcast at 7 hours is the fallback.

IOS as a DHCP server

A router or Layer 3 switch can serve addresses from a pool. Here R1 serves VLAN 30, whose gateway is 10.30.0.1:

R1(config)#ip dhcp excluded-address 10.30.0.1 10.30.0.10
R1(config)#ip dhcp pool VLAN30
R1(dhcp-config)#network 10.30.0.0 255.255.255.0
R1(dhcp-config)#default-router 10.30.0.1
R1(dhcp-config)#dns-server 10.1.1.53 10.1.1.54
R1(dhcp-config)#domain-name corp.example
R1(dhcp-config)#lease 0 8
R1(dhcp-config)#exit

What each line does:

• ip dhcp excluded-address is a global command. It keeps addresses out of every pool, here the gateway and room for static devices. Exclusions are always entered globally, not in the pool.
• network defines the subnet the pool serves. It accepts a dotted mask or a prefix length, so network 10.10.12.0 /23 is the same as network 10.10.12.0 255.255.254.0, and clients receive 255.255.254.0 as their mask.
• default-router supplies the default gateway (DHCP option 3). Without it, clients get an address but no gateway, and reach nothing outside their own subnet. Do not confuse it with ip default-gateway, a global command that sets the gateway for the device itself when it is not routing. That hands nothing to DHCP clients.
• dns-server supplies name servers (option 6). domain-name supplies the DNS suffix.
• lease sets the lease in days, hours and minutes. The default is one day.

The DHCP server and relay both depend on one global command, service dhcp. It is on by default. If a hardening script runs no service dhcp, the router stops leasing from its pools and stops relaying for ip helper-address. service dhcp restores both.

Worked example: what a pool can hand out

The pool's network statement is subnetting, so use the block-size method from lesson 3.

Pool OFFICE uses network 192.168.20.64 255.255.255.224, with no exclusions. What is the highest address it can lease?

1. 255.255.255.224 is a /27, block size 32.
2. The block runs from 192.168.20.64 to 192.168.20.95.
3. 192.168.20.95 is the broadcast address and cannot be leased.
4. The highest leasable address is 192.168.20.94.

A pool using network 10.4.8.0 255.255.252.0 is a /22: 1,024 addresses from 10.4.8.0 to 10.4.11.255. Minus the network and broadcast addresses, at most 1,022 clients can hold leases at once.

Verifying the server

Three show commands answer three different questions:

R1#show ip dhcp pool VLAN30

Pool VLAN30 :
 Utilization mark (high/low)    : 100 / 0
 Subnet size (first/next)       : 0 / 0
 Total addresses                : 254
 Leased addresses               : 2
 Excluded addresses             : 10
 Pending event                  : none
 1 subnet is currently in the pool :
 Current index        IP address range                    Leased/Excluded/Total
 10.30.0.13           10.30.0.1        - 10.30.0.254       2     / 10    / 254

R1#show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address      Client-ID/              Lease expiration        Type       State      Interface
                Hardware address/
                User name
10.30.0.11      0100.50b6.1a2b.3c       Oct 19 2026 09:02 AM    Automatic  Active     GigabitEthernet0/0/1
10.30.0.12      0100.1b2c.4d5e.6f       Oct 19 2026 09:15 AM    Automatic  Active     GigabitEthernet0/0/1

R1#show ip dhcp conflict
IP address        Detection method   Detection time
10.30.0.45        Ping               Oct 18 2026 09:14 AM

• show ip dhcp pool gives counts per pool: total, leased and excluded addresses. It does not say which client holds which address.
• show ip dhcp binding lists each lease: the IP address, the client ID or hardware address (the leading 01 means Ethernet, followed by the MAC), the lease expiry and the type.
• show ip dhcp conflict lists addresses the server found already in use. By default, an IOS server pings an address before offering it. If something replies, it logs a conflict with the method "Ping" and stops offering that address until the conflict is cleared with clear ip dhcp conflict. A conflict reported by a client's own check after it received the address shows as "Gratuitous ARP" instead.

Pool exhaustion looks like this:

R1#show ip dhcp pool STAFF

Pool STAFF :
 Total addresses                : 62
 Leased addresses               : 62
 Pending event                  : none

Every address is leased, so new laptops get no offer and fall back to 169.254 addresses, while clients that already hold leases keep renewing them and work normally. The fixes are a larger subnet, a shorter lease, or removing stale bindings. A missing helper address cannot be the cause here, because the server has clearly been reaching this pool's clients.

DHCP relay with ip helper-address

A Layer 3 device does not forward broadcasts between subnets. So when clients and the DHCP server are on different subnets, the client's DHCPDISCOVER never reaches the server. The fix is a DHCP relay agent, configured with ip helper-address on the interface that faces the clients:

DSW1(config)#interface Vlan20
DSW1(config-if)#ip address 10.20.0.1 255.255.255.0
DSW1(config-if)#ip helper-address 10.1.99.5

If PCs in VLAN 20 boot with 169.254 addresses, their gateway is interface Vlan20 on a Layer 3 switch, and the server 10.1.99.5 is on another subnet, this is the missing line. ip dhcp snooping trust is a switch security setting, and ip default-gateway relays nothing.

What the relay does:

1. It receives the client's broadcast on Vlan20.
2. It writes the address of that receiving interface, 10.20.0.1, into the giaddr (gateway IP address) field.
3. It forwards the message to 10.1.99.5 as a unicast. It never forwards it as a broadcast.

The server then uses giaddr twice:

• To choose the pool. It leases from the pool whose network contains the giaddr. It cannot use the client's source address, which is 0.0.0.0. Nor does it use its own receiving interface; that only works when the server is on the clients' own subnet.
• To send the reply. It unicasts the DHCPOFFER back to the giaddr, and the relay delivers it to the client.

Worked example: matching a pool to a relay

Interface Vlan60 on relay switch DSW1 is 172.16.40.129/26. Which network statement must the server's pool for VLAN 60 contain?

1. The giaddr will be 172.16.40.129.
2. A /26 has a block size of 64. Blocks: 0, 64, 128, 192.
3. 129 is in the block 128 to 191.
4. The pool must be network 172.16.40.128 255.255.255.192.

A pool for 172.16.40.192/26 would not match, because that block starts just after this subnet's broadcast address.

Troubleshooting a relay path

Debugging on the server shows which relay a discover came through:

R1#debug ip dhcp server packet
DHCPD: DHCPDISCOVER received from client 0100.50b6.77a1.c2 through relay 10.40.0.1.
DHCPD: Sending DHCPOFFER to client 0100.50b6.77a1.c2 (10.40.0.21).
DHCPD: unicasting BOOTREPLY for client 0050.b677.a1c2 to relay 10.40.0.1.

If the discovers arrive with giaddr 10.40.0.1, R1 has a pool for 10.40.0.0/24, and branch clients still get nothing, the offers are not getting back. R1 needs a route to the giaddr subnet, 10.40.0.0/24, through the relay R2. Without one, the offer never leaves R1. Check with show ip route 10.40.0.1 on the server (lesson 13 covers reading the routing table).

By default, ip helper-address also forwards several other UDP broadcasts, such as TFTP, DNS and NetBIOS. That is rarely a problem, but it explains extra traffic arriving at the server.

DHCP snooping and option 82. When an access switch runs DHCP snooping (lesson 23), it inserts option 82 (relay agent information) into client requests by default, but it leaves giaddr as 0.0.0.0 because it is not a relay. An IOS DHCP server on the same VLAN, with no relay in between, sees option 82 with a zero giaddr and drops the packet:

DHCPD: inconsistent relay information.
DHCPD: relay information option exists, but giaddr is zero.

The fix on the switch is no ip dhcp snooping information option, which stops the insertion. The server-side alternative is ip dhcp relay information trust-all on R1.

IOS as a DHCP client

A router's internet-facing interface often gets its address from the provider by DHCP. Configure it with ip address dhcp:

R3(config)#interface GigabitEthernet0/0/0
R3(config-if)#ip address dhcp
R3(config-if)#no shutdown
%DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet0/0/0 assigned DHCP address 203.0.113.42, mask 255.255.255.0, hostname R3

Two commands confirm it worked:

R3#show ip interface brief | include 0/0/0
GigabitEthernet0/0/0   203.0.113.42    YES DHCP   up                    up

R3#show dhcp lease
Temp IP addr: 203.0.113.42  for peer on Interface: GigabitEthernet0/0/0
Temp  sub net mask: 255.255.255.0
   DHCP Lease server: 203.0.113.1, state: 5 Bound
   Lease: 86400 secs,  Renewal: 43200 secs,  Rebind: 75600 secs
Temp default-gateway addr: 203.0.113.1

The Method column of show ip interface brief reads DHCP instead of manual. show dhcp lease is the client-side view, with the address, mask, server, gateway and timers. The renewal and rebind values are T1 and T2: half and 87.5 percent of the 86,400-second lease. show ip dhcp binding is a server command: it lists the leases the router hands out, not the one it received. ip unnumbered borrows another interface's address and is a different thing altogether.

A fault-finding order

1. The client. A 169.254 address means no offer arrived. Check the link and the VLAN first (lesson 6).
2. The relay. If the server is on another subnet, is ip helper-address on the client-facing interface, pointing at the right server?
3. The server. Is service dhcp on? Does a pool's network match the client subnet, or the giaddr? Is the pool full? Are there conflicts?
4. The return path. Does the server have a route to the giaddr subnet?
5. The options. Clients with an address but no gateway or DNS point to missing default-router or dns-server lines.
6. Security features. Snooping inserting option 82 towards a local IOS server.

What the exam is really asking

• DORA order and addressing. DISCOVER first, broadcast from 0.0.0.0:68 to 255.255.255.255:67. REQUEST is third and also broadcast.
• default-router versus ip default-gateway. The first gives clients a gateway; the second is for the device itself.
• Exclusions are global. ip dhcp excluded-address is not a pool command.
• Which show command. show ip dhcp pool for counts and exhaustion, show ip dhcp binding for who has what, show ip dhcp conflict for addresses that answered a ping, show dhcp lease for the router as a client.
• Relay placement. ip helper-address goes on the interface facing the clients, and the relay forwards as unicast.
• giaddr picks the pool and is where the offer goes. The server needs a route back to it.
• service dhcp controls both the server and the relay.
• Lease timers. T1 at 50 percent, unicast renew to the same server. T2 at 87.5 percent, broadcast rebind.
• Snooping option 82 with a zero giaddr breaks a local IOS server; no ip dhcp snooping information option fixes it.