What Is DHCP and How to Configure It on a Cisco Router

Every device on an IP network needs an address, a subnet mask, a default gateway and DNS servers. Typing these by hand on hundreds of laptops, phones and printers is slow and error-prone. When you configure DHCP, the network hands out these settings automatically instead.

This guide explains how DHCP works and how to configure DHCP on a Cisco router step by step. It also covers DHCP relay, verification commands and common security settings.

What is DHCP?

The Dynamic Host Configuration Protocol (DHCP) automatically assigns IP settings to clients. For this, a DHCP server keeps a pool of addresses and leases them to clients for a set time. When the lease expires, the client renews it or the server reuses the address.

Besides the IP address, DHCP can deliver:

• the subnet mask
• the default gateway (router)
• DNS servers and a domain name
• lease time
• extra options, such as TFTP servers for IP phones

In addition, DHCP for IPv4 uses UDP port 67 on the server and UDP port 68 on the client.

How DHCP works: the DORA process

A client gets its address in four steps, often called DORA:

1. Discover: the client broadcasts a request, because it does not yet know any server.
2. Offer: a DHCP server replies with an available address and settings.
3. Request: the client asks to use the offered address.
4. Acknowledge: the server confirms the lease, and the client configures itself.

Later, the client renews the lease directly with the server, usually at half of the lease time.

How to configure DHCP on a Cisco router

For example, in this lab the router’s LAN interface is 192.168.1.1/24. We want to hand out addresses from 192.168.1.101 to 192.168.1.254, and keep the lower addresses for servers and printers.

Step 1: Set the LAN interface address

Router> enable
Router# configure terminal
Router(config)# interface GigabitEthernet0/0
Router(config-if)# ip address 192.168.1.1 255.255.255.0
Router(config-if)# no shutdown
Router(config-if)# exit

Step 2: Exclude addresses you do not want to lease

Router(config)# ip dhcp excluded-address 192.168.1.1 192.168.1.100

The router will not lease any address in this range. Therefore, you can safely use these for static devices.

Step 3: Create the DHCP pool

Router(config)# ip dhcp pool LAN
Router(dhcp-config)# network 192.168.1.0 255.255.255.0
Router(dhcp-config)# default-router 192.168.1.1
Router(dhcp-config)# dns-server 8.8.8.8 1.1.1.1
Router(dhcp-config)# domain-name example.local
Router(dhcp-config)# lease 7
Router(dhcp-config)# exit

The lease 7 command sets a seven-day lease. If you leave it out, the default is one day.

Step 4: Make sure the DHCP service is running

Router(config)# service dhcp
Router(config)# end
Router# copy running-config startup-config

The DHCP service is on by default in Cisco IOS. However, if someone disabled it with no service dhcp, the router stops serving and relaying DHCP.

How to verify the DHCP configuration

After that, use these commands to check that clients receive addresses:

Also, on a Windows client, run ipconfig /all. On Linux, run ip addr to confirm the address.

DHCP relay: clients on another subnet

DHCP Discover messages are broadcasts, and routers do not forward broadcasts. So when the server sits on a different subnet, configure a relay on the interface facing the clients:

Router(config)# interface GigabitEthernet0/1
Router(config-if)# ip helper-address 10.10.10.5

As a result, the router forwards DHCP requests as unicast to the server at 10.10.10.5.

Secure your DHCP service

However, a rogue DHCP server can hand out a fake gateway and intercept traffic. To prevent this:

• Enable DHCP snooping on access switches, and trust only uplink ports.
• Use port security to limit MAC addresses per port.
• Turn on Dynamic ARP Inspection, which uses the DHCP snooping table.
• Keep the DHCP pool sized to real needs, which limits address exhaustion.

For more on controlling traffic with access lists, read our ACL questions and answers.

Troubleshooting tips

• Client gets a 169.254.x.x address: it received no DHCP reply. Check cabling, VLANs and the helper address.
• Pool exhausted: shorten the lease time or enlarge the subnet.
• Wrong gateway: check the default-router line in the pool.
• Address conflicts: clear them with clear ip dhcp conflict * after fixing the duplicate device.

Sources

• RFC 2131: Dynamic Host Configuration Protocol

Need help with network security? We test routers, firewalls, ACLs and segmentation as part of our VAPT services and hardening audits. Contact us for a quote.