Cisco DHCP: Server Pools, Relay, and ip helper-address

DHCP (Dynamic Host Configuration Protocol) hands a client an address, a mask, a default gateway, and DNS servers through a four-message exchange: Discover, Offer, Request, Acknowledgment. Clients send from UDP port 68 to server port 67, and because Discover is a broadcast it stops at the first router. A Cisco router can play all three parts in this system: it can be the server with ip dhcp pool, the client with ip address dhcp, or the relay with ip helper-address, and the relay command belongs on the interface sitting in the clients’ subnet, not the one facing the server.

The DORA exchange

A client that has no address begins with a Discover. The packet leaves with a source address of 0.0.0.0 (the client has nothing else to use) and a destination of 255.255.255.255, sourced from UDP 68 and aimed at UDP 67. Every DHCP server on that segment sees it.

Each server that can serve the segment replies with an Offer containing a candidate address, the mask, the lease duration, and options such as the default gateway and DNS servers. The Offer travels from UDP 67 to UDP 68.

The client picks one Offer and broadcasts a Request. The broadcast matters: it names the server whose offer was accepted, which implicitly tells every other server that its offer was declined and its reserved address can go back into the pool.

The chosen server closes with an Acknowledgment, at which point the lease is real and the client starts using the address. The client will attempt renewal at 50 percent of the lease (T1) by unicasting directly to the server that granted it, and will fall back to broadcasting at 87.5 percent (T2) if renewal has not succeeded.

Configuring IOS as a DHCP server

Two things happen in different modes, and reversing them is a common configuration error. Address exclusions are global. The pool itself is a sub-mode with its own prompt, R1(dhcp-config)#, which follows the same pattern as every other submode in the IOS command hierarchy.

R1(config)# ip dhcp excluded-address 10.20.30.1 10.20.30.25
R1(config)# ip dhcp pool BRANCH-DATA
R1(dhcp-config)# network 10.20.30.0 255.255.255.0
R1(dhcp-config)# default-router 10.20.30.1
R1(dhcp-config)# dns-server 10.1.1.53 10.1.1.54
R1(dhcp-config)# domain-name branch.example
R1(dhcp-config)# lease 3

ip dhcp excluded-address reserves the range you have already assigned by hand, typically the gateway, the switch management addresses, and any printers or servers with static configuration. Leave it out and the router will cheerfully hand a client an address that a server is already using. Note that it is entered before or after the pool but never inside it.

network sets the scope, and it takes a dotted-decimal mask in this command. default-router is the option that becomes the client’s default gateway, and omitting it produces the classic symptom of hosts that can ping their neighbours but reach nothing off-subnet. lease 3 is three days; the argument list is days, hours, minutes, and lease infinite is also valid.

The router as a DHCP client

An interface can take its address from an upstream server, which is how most small-branch WAN links and lab uplinks are built:

R1(config)# interface gigabitethernet0/0/0
R1(config-if)# ip address dhcp
R1(config-if)# no shutdown

There is no mask argument. The router learns the address, mask, and default gateway, and installs a default route pointing at the gateway it was given, which then shows up as the gateway of last resort in the routing table output. show dhcp lease prints what the router received in that role.

Relay with ip helper-address

Because a Discover is a broadcast, a router does not forward it, so a client in one subnet cannot find a server in another. Relay solves that. The router receives the broadcast, rewrites it as a unicast toward the configured server address, and stamps the giaddr (gateway IP address) field with the IP of the interface it arrived on. That giaddr is how the server knows which scope to serve from, and it is the entire reason the command’s placement is not negotiable.

R1(config)# interface vlan 30
R1(config-if)# ip address 10.20.30.1 255.255.255.0
R1(config-if)# ip helper-address 10.1.1.10

The interface carrying ip helper-address is the one whose IP address the clients use as their default gateway. Putting it on the interface toward the server accomplishes nothing, since no client broadcast ever arrives there. On a router-on-a-stick design the command goes on the subinterface for that VLAN; on a Layer 3 switch it goes on the SVI. If you are still deciding where the gateway lives, see inter-VLAN routing options.

Relay forwards more than DHCP. By default ip helper-address relays eight UDP services, including TIME (37), TACACS (49), DNS (53), DHCP server (67), DHCP client (68), TFTP (69), and the two NetBIOS services (137 and 138). no ip forward-protocol udp 69 trims a service you do not want relayed.

	Router as DHCP server	Router as DHCP relay
Command family	ip dhcp pool, network, default-router	ip helper-address <server-ip>
Configuration mode	global plus dhcp-config sub-mode	interface configuration
Where it is applied	anywhere on the device	the interface in the clients’ subnet
Who owns the address space	the router	the external DHCP server
Key verification	show ip dhcp binding, show ip dhcp pool	bindings appear on the server, debug ip dhcp server packet on the relay

Verification and debugging

show ip dhcp binding is the primary check on a router acting as server. It lists what has actually been leased:

R1# show ip dhcp binding
Bindings from all pools not associated with VRF:
IP address       Client-ID/              Lease expiration        Type
                 Hardware address/
                 User name
10.20.30.26      0100.5079.6668.01       Aug 06 2026 09:14 AM    Automatic
10.20.30.27      0100.5079.71b2.4c       Aug 06 2026 09:31 AM    Automatic

show ip dhcp pool reports the scope size, how many addresses are leased, and the high-water mark, which is the fastest way to find a pool that is running dry. show ip dhcp conflict lists addresses the router pinged before offering and found already in use, which usually means a static host inside the pool range that nobody excluded.

Two server-side debugs exist and they answer different questions. debug ip dhcp server events reports the decisions: an address assigned, a lease expiring and being returned, a pool with nothing left to allocate. debug ip dhcp server packet decodes each individual message in the exchange, which is what you want when one specific client is being refused. The client-side view uses debug dhcp detail and shows what the router received for its own interface, not what it granted to anyone else.

How the 200-301 exam tests this

• A troubleshooting item gives you clients in one VLAN with no addresses and a server on a different subnet, then asks where a single command goes. The discrimination being tested is direction: the relay command belongs on the interface that clients treat as their default gateway.
• A monitoring scenario describes wanting to observe lease grants, expiries, and pool exhaustion as they happen without a per-message decode. That description maps to the server events debug rather than the server packet debug.
• A configuration item shows a pool without ip dhcp excluded-address and asks what will go wrong. The failure is a duplicate address handed to a client that collides with a statically configured device.
• A port-and-direction question asks which UDP port a client sources from and which a server listens on. Client 68, server 67, and Offer and Acknowledgment travel the other way, 67 to 68.

Direction is the recurring trap — relay on the client side, ports by role — so test yourself against a bank of practice questions until neither reversal slips past you.

Quick reference

• Message order is Discover, Offer, Request, Acknowledgment. Discover and Request are broadcast.
• UDP 67 is the server port, UDP 68 is the client port.
• ip dhcp excluded-address is a global command, not a pool sub-command.
• Inside the pool, network takes a dotted-decimal mask, default-router sets the gateway, dns-server sets name servers.
• ip address dhcp makes an interface a DHCP client and installs a learned default route.
• ip helper-address goes on the client-facing interface, and the giaddr it inserts is how the server chooses a scope.
• show ip dhcp binding proves leases exist, show ip dhcp pool shows how much space is left, show ip dhcp conflict finds address collisions.
• debug ip dhcp server events for lease and pool activity, debug ip dhcp server packet for per-message decoding.