Introduction
DHCP removes guesswork from IP addressing and keeps client settings consistent. When you configure DHCP on a Cisco router, you give endpoints the right IP address, subnet mask, gateway, DNS, and more without touching each device. This guide walks you through a clean design process, proven IOS and IOS XE commands, and fast verification steps. You will see when to make the router a DHCP server, when to use relay with ip helper-address, and how to support multiple VLANs. We also cover security, phone and access point options, and a practical troubleshooting checklist. Follow the sequence from planning to configuration to validation, and you will deploy DHCP with confidence.
What DHCP Does on Cisco Routers
A Cisco router can serve DHCP or relay it. As a server, the router allocates addresses from local pools, records bindings, and sends options like default gateway and DNS servers. As a relay, the router forwards broadcasts from clients to a central DHCP server across subnets, then returns replies back to the correct VLAN. Both roles cut manual work and reduce errors. Your choice depends on scale, availability goals, and how you manage branches versus data centers. We start with a simple local server build, then extend to router-on-a-stick and finally compare server versus relay so you can choose the best model.
Lab Topology and Address Plan
Sample IP Subnets and Gateways
Begin with a small but realistic plan. Example: VLAN 10 uses 192.168.10.0 slash 24 with 192.168.10.1 as the gateway. VLAN 20 uses 192.168.20.0 slash 24 with 192.168.20.1. Keep the first few addresses reserved for gateways, infrastructure, and monitoring tools. Use a consistent pattern across sites so engineers can predict where to look.
Device Roles and Interfaces
Use one Cisco router and one switch. Create a trunk between them, and place test clients in each VLAN. If you own a multilayer switch, you can host SVIs there and keep the router for WAN or edge tasks. Either way, provide an L3 interface per client subnet so the router can serve or relay DHCP.
Addressing Conventions and Notation
Choose a clear documentation style. Reserve dot1 for the default gateway, dot2 through dot20 for static gear, and the rest for dynamic scope. Record pools, exclusions, DNS servers, and special options in a shared document. With the addressing pattern set, confirm that your hardware and software support the features you need.
Prerequisites: Hardware, IOS or IOS XE, and Access
Supported Platforms and Versions
Check feature support on your platform. ISR, ASR, and Catalyst routing families support DHCP server and relay on modern IOS or IOS XE releases. If you plan to use VRFs or advanced relay, confirm support in your running version.
Required Privileges and Connectivity
You need console or SSH access with full privileges. Verify L3 interfaces are up and that switch VLANs exist and match. If you plan router-on-a-stick, confirm the trunk is operational and carries the right VLANs.
Backups and Change Windows
Back up the running configuration to external storage. Schedule a change window for production. Keep a rollback plan that documents which lines you will remove if something goes wrong. With preparation complete, decide the DHCP parameters you will implement.
Planning Exclusions, Lease, DNS, and Reservations
Excluded Addresses and Reservation Strategy
Mark off static IPs as exclusions so the pool never hands them out. Decide which devices need reservations, such as printers, APs, and management stations. Gather client identifiers or MAC addresses for these reservations before you start.
Lease Duration and Renewal Behavior
Set lease times to fit client churn. Guest or highly mobile WLANs do well with shorter leases to recycle addresses quickly. Stable wired networks often use longer leases to cut renewal traffic. Start with one day for busy segments and three to seven days for steady desks, then adjust as monitoring data arrives.
DNS, Domain Name, and NTP Options
Choose DNS servers and a domain name that match your environment. Consider providing NTP to keep client clocks accurate. If you deploy IP phones, plan for Option 150 or Option 66 as needed. With all parameters defined, you can configure your first scope.
Basic DHCP Server Configuration
ip dhcp excluded-address
1) Define exclusions for gateways and static hosts so the router never allocates those IPs.
– Example:
– ip dhcp excluded-address 192.168.10.1 192.168.10.20
ip dhcp pool and network
2) Create a DHCP pool for the subnet and define the network and mask.
– Example:
– ip dhcp pool VLAN10
– network 192.168.10.0 255.255.255.0
default-router, dns-server, domain-name, lease
3) Add gateway, DNS, domain, and lease duration inside the pool.
– default-router 192.168.10.1
– dns-server 8.8.8.8 1.1.1.1
– domain-name corp.example
– lease 1 0 0
Static Bindings for Specific Clients
4) Reserve addresses for known devices.
– host 192.168.10.50 255.255.255.0
– client-identifier 0100.1c23.abcd.ef or hardware-address 001c.23ab.cdef
With pools built, you should verify server health and client results before expanding to more VLANs.
Verifying DHCP Operation
show ip dhcp pool, binding, and server statistics
Run show ip dhcp pool to confirm free and used addresses, and pool utilization. Use show ip dhcp binding to see active leases and renewal timers. Review server statistics to spot drops or errors quickly.
debug ip dhcp server events and packets
If a client fails to get an address, enable debug ip dhcp server events or debug ip dhcp server packet. Watch for the discover, offer, request, and ack sequence. Disable debugging once you capture enough data to avoid excessive logs.
Client-Side Validation Steps
On a Windows client, use ipconfig release and ipconfig renew. On Linux or macOS, renew the interface lease. Confirm the IP, mask, gateway, and DNS. Ping the gateway and test name resolution with nslookup. If things look wrong, inspect the interfaces and VLANs carrying the traffic.
Interface-Level Considerations
L3 Interfaces, SVIs, and Routed Ports
Each subnet must exist as an L3 interface on the router or a multilayer switch. You can use a routed port, an SVI, or a router subinterface. The DHCP server or relay function will only work if the interface is up and in the correct VLAN.
Subinterfaces and 802.1Q Tagging
For router-on-a-stick, create a subinterface per VLAN. Use encapsulation dot1q with the VLAN ID and assign the correct IP. On the switch side, set the port as a trunk and allow the relevant VLANs. A mismatch in tagging or native VLAN often breaks DHCP.
Local DHCP versus ip helper-address
If the router serves DHCP locally, clients in that subnet receive responses directly. If you use a central server, place ip helper-address on the L3 interface for each client subnet. The helper forwards DHCP and several other UDP services by default. With the interfaces stable, scale the design to multiple VLANs.
DHCP for Multiple VLANs (Router-on-a-Stick)
Creating Subinterfaces with encapsulation dot1q
1) On the router interface facing the switch, create subinterfaces per VLAN:
– interface g0/0.10
– encapsulation dot1q 10
– ip address 192.168.10.1 255.255.255.0
– interface g0/0.20
– encapsulation dot1q 20
– ip address 192.168.20.1 255.255.255.0
Confirm the switch trunk carries VLANs 10 and 20.
Per-VLAN DHCP Pools and Exclusions
2) Build a pool per VLAN and exclude the static range:
– ip dhcp excluded-address 192.168.20.1 192.168.20.20
– ip dhcp pool VLAN20
– network 192.168.20.0 255.255.255.0
– default-router 192.168.20.1
– dns-server 8.8.8.8 1.1.1.1
Keep your format identical across VLANs so future audits are easy.
Example Multi-VLAN Address Plan
Use predictable ranges. Put the gateway at dot1, reserve dot2 through dot20 for servers and network gear, and allocate dot21 and up for dynamic clients. Consistency speeds troubleshooting and cutovers. With multi-VLAN scopes working, decide if you should keep DHCP local or centralize it.
Server vs Relay: Choosing the Right Model
Centralized DHCP with ip helper-address
Relay favors centralized operations and tight control. Place ip helper-address on each L3 interface pointing to your DHCP servers. This model reduces configuration drift and keeps policy and logs in one place.
Branch-Local DHCP Pros and Cons
Local DHCP on branch routers survives WAN outages and reduces round trip time. It does, however, require careful configuration and monitoring across many sites. If you choose local pools, standardize templates and automate deployments.
Mixed Designs and Fallback Options
You can combine both approaches. Use relay in normal conditions and keep a small local pool as a backup. With IP SLA or track objects, you can detect a failed central server and switch to the local pool until service recovers. After you select a model, harden the environment to stop rogue servers and spoofing.
Security Hardening for DHCP on Routers
Limiting DHCP Exposure with ACLs
Apply ACLs to limit who can reach DHCP server ports on the router. Block DHCP traffic on untrusted inter-VLAN boundaries. If the router only relays, restrict traffic flows to known central servers.
DHCP Snooping on Switches and Trust Boundaries
Enable DHCP snooping on access switches. Mark uplinks to the router as trusted. Keep access ports untrusted to block rogue DHCP offers. Use the snooping binding table to correlate IPs, MACs, and interfaces and to support IP source guard.
Anti-Spoofing and uRPF Considerations
Where supported, enable uRPF on access VLAN interfaces to block spoofed sources. Filter or rate limit UDP 67 and 68 where they should not traverse. Log violations to a SIEM so analysts can act quickly. With defenses in place, turn to the special options some devices need during boot and provisioning.
Common DHCP Options for Phones and APs
Option 150 and TFTP for IP Phones
Many Cisco IP phones expect Option 150 with one or more TFTP servers. Add it inside the pool so phones can download firmware and configuration at boot. Provide redundant servers if possible to avoid outages during maintenance.
Option 66 vs 150 Differences
Option 66 supplies a single hostname or IP for TFTP and suits mixed-vendor phones. Option 150 supports multiple IPs and often works best for Cisco phones. Use the option your devices expect and verify with a small pilot before wide rollout.
Option 43 for CAPWAP or Controller Discovery
Lightweight access points may need Option 43 suboptions to locate controllers. Vendors format Option 43 differently, so follow the specific encoding from the controller and AP documentation. After adding options, validate that endpoints pick them up in a fresh lease cycle.
Troubleshooting Checklist
No Offers, Address Conflicts, Wrong Gateway or DNS
- Confirm the pool has free addresses
- Ensure exclusions do not cover the entire subnet
- Verify default router and DNS values inside the pool
- Look for stale conflicts; clear them if needed
Interface Down, VLAN Tagging, Native VLAN
- Check show ip interface brief for up or down status
- Confirm dot1q tags on both router and switch sides
- Align the native VLAN on both ends of the trunk
- Validate that the SVI or subinterface has the correct IP
NAT, Firewalls, MTU, and Relay Path Issues
- If relaying, allow UDP 67 and 68 between clients and servers
- Verify ip helper-address points to the right server IPs
- Inspect NAT rules to avoid breaking return traffic
- Use debug and a switch span session to observe packet flow
With this checklist, you can isolate most failures within minutes. Once the path is clean, lock in a full configuration that you can reuse.
Sample End-to-End Configuration
Single Subnet DHCP Server Example
- ip dhcp excluded-address 192.168.10.1 192.168.10.20
- ip dhcp pool VLAN10
- network 192.168.10.0 255.255.255.0
- default-router 192.168.10.1
- dns-server 8.8.8.8 1.1.1.1
- domain-name corp.example
- lease 1 0 0
- interface g0/0
- ip address 192.168.10.1 255.255.255.0
- no shut
Multi-VLAN Router-on-a-Stick Snippet
- interface g0/0.10
- encapsulation dot1q 10
- ip address 192.168.10.1 255.255.255.0
- interface g0/0.20
- encapsulation dot1q 20
- ip address 192.168.20.1 255.255.255.0
- ip dhcp excluded-address 192.168.20.1 192.168.20.20
- ip dhcp pool VLAN20
- network 192.168.20.0 255.255.255.0
- default-router 192.168.20.1
Verification and Rollback Plan
Verify with these commands and tests:
– show ip dhcp pool and show ip dhcp binding
– show ip interface brief and show interfaces trunk on the switch
– Ping the gateway and resolve a hostname with nslookup from clients
If results fail, remove recent lines, restore the backup, and reapply in small steps. Keep logs of each change and result so you can pinpoint the offending line.
Maintenance and Best Practices
Monitoring Pools and Bindings
Monitor free addresses, pool utilization, and lease churn. Alert when a pool drops below a safe threshold. As you see trends, expand scope size, shorten leases, or add more subnets before users feel pain.
Logging, Syslog, and SNMP
Send DHCP server events to syslog for audit and forensics. Use SNMP to track pool stats and bindings. Keep time in sync with NTP so logs line up across systems and support accurate incident timelines.
Documentation and Change Control
Maintain a living document for each site with subnets, exclusions, reservations, and special options. Use templates and version control for consistency. Test changes in a lab and roll them out during planned windows. With operations stable and documented, you can close the loop with a short recap.
Conclusion
You can configure DHCP on a Cisco router with speed and accuracy by following a clear plan. Define exclusions and leases, set DNS and domain options, and verify bindings before scaling up. Use router-on-a-stick to support multiple VLANs, or relay to centralized servers when scale and control matter most. Secure the edge with ACLs and DHCP snooping, and provide options like 150 or 43 for phones and APs. Keep watch on pool capacity and logs to prevent outages. With these practices, your clients will receive the right IP settings every time and your team will spend less time on manual fixes.
Frequently Asked Questions
Do I need ip helper-address if the router is the DHCP server?
No. If the router serves DHCP for a subnet, it answers client broadcasts locally. Use ip helper-address only when the actual DHCP server resides on a different subnet.
How do I reserve a specific IP for a device on a Cisco router?
Create a static binding inside the DHCP pool. Specify the host IP and mask, then add the client-identifier or hardware-address. Renew the client lease to apply it.
What is the difference between Option 66 and Option 150 for IP phones?
Option 66 carries one TFTP hostname or IP and fits mixed vendors. Option 150 supports multiple IPs and suits Cisco phones. Use the option your devices expect.