I’ve configured DHCP on Cisco routers more times than I can count, and it’s one of those features that seems trivially simple right up until you’re troubleshooting why one specific VLAN isn’t getting addresses while everything else works fine. This guide covers DHCP on Cisco IOS from first principles through to the kind of multi-VLAN, relay-based designs you’ll actually run into in enterprise networks.
Why Configure DHCP on a Router Instead of a Dedicated Server
Plenty of enterprises run DHCP on Windows Server, Infoblox, or another dedicated platform, but Cisco IOS DHCP service remains extremely common for smaller sites, branch offices, and lab/test environments — and even in larger networks, routers frequently act as DHCP relay agents forwarding requests to a centralized server. Understanding both roles — DHCP server and DHCP relay — is essential for anyone managing enterprise routing infrastructure.
Networking Fundamentals: How DHCP Works
DHCP operates through the well-known DORA process:
- Discover: The client broadcasts a DHCPDISCOVER looking for any available DHCP server.
- Offer: A DHCP server responds with a DHCPOFFER, proposing an IP address and lease parameters.
- Request: The client broadcasts a DHCPREQUEST confirming it wants the offered address (broadcast so any other offering servers know they weren’t chosen).
- Acknowledge: The server responds with a DHCPACK, finalizing the lease.
Because DISCOVER and REQUEST messages are broadcasts, they don’t cross Layer 3 boundaries on their own — this is exactly why DHCP relay (ip helper-address) exists: to forward these broadcasts as unicast packets to a DHCP server on a different subnet.
Step 1: Configuring a Basic DHCP Pool
Router(config)# ip dhcp excluded-address 10.1.1.1 10.1.1.10
Router(config)# ip dhcp excluded-address 10.1.1.254
Router(config)# ip dhcp pool VLAN10-POOL
Router(dhcp-config)# network 10.1.1.0 255.255.255.0
Router(dhcp-config)# default-router 10.1.1.1
Router(dhcp-config)# dns-server 10.1.1.5 8.8.8.8
Router(dhcp-config)# domain-name example.local
Router(dhcp-config)# lease 8
Router(dhcp-config)# exit
Always configure ip dhcp excluded-address before creating the pool, or immediately after — otherwise the router may hand out addresses (like the gateway’s own IP) that should never be leased to a client. The lease 8 sets an 8-day lease; you can also specify hours and minutes, e.g., lease 0 8 0 for 8 hours.
Step 2: Configuring Multiple VLANs/Subnets
In a router-on-a-stick or multilayer switch scenario, you’ll typically need a separate pool per VLAN/subnet.
Router(config)# ip dhcp excluded-address 10.1.2.1 10.1.2.10
Router(config)# ip dhcp pool VLAN20-POOL
Router(dhcp-config)# network 10.1.2.0 255.255.255.0
Router(dhcp-config)# default-router 10.1.2.1
Router(dhcp-config)# dns-server 10.1.1.5
Router(dhcp-config)# domain-name example.local
Router(dhcp-config)# lease 8
Router(dhcp-config)# exit
The IOS DHCP server automatically matches incoming requests to the correct pool based on the subnet of the interface (or relay agent) the request arrived on — you don’t need to manually bind a pool to an interface for local DHCP service.
Step 3: Configuring DHCP Relay (IP Helper)
When your DHCP server lives centrally — whether that’s another router, a dedicated appliance, or a Windows/Linux server — the router acting as the default gateway for client VLANs needs to relay broadcast DHCP requests to it.
Router(config)# interface Vlan30
Router(config-if)# description Branch-Users
Router(config-if)# ip address 10.1.3.1 255.255.255.0
Router(config-if)# ip helper-address 10.1.100.5
Router(config-if)# exit
ip helper-address doesn’t just relay DHCP — by default it also relays several other broadcast-based UDP services (TFTP, DNS, NetBIOS, and a few others). If you only want DHCP relayed, you can be more selective using ip forward-protocol udp tuning, though in most designs relaying the full default set is harmless and even useful.
Step 4: Reserving Static Addresses via DHCP (Host Bindings)
For devices that need a predictable, fixed IP but you still want to manage that assignment centrally through DHCP rather than statically configuring the device itself:
Router(config)# ip dhcp pool PRINTER-RESERVATION
Router(dhcp-config)# host 10.1.1.20 255.255.255.0
Router(dhcp-config)# client-identifier 0100.1122.3344.55
Router(dhcp-config)# exit
The client-identifier is typically the MAC address prefixed with 01 (indicating Ethernet media type) — this trips people up the first time they try it, since simply pasting the raw MAC address won’t match.
Step 5: Verifying the DHCP Configuration
Router# show ip dhcp pool VLAN10-POOL
Expected output:
Pool VLAN10-POOL :
Utilization mark (high/low) : 100 / 0
Subnet size (first/next) : 0 / 0
Total addresses : 254
Leased addresses : 47
Pending event : none
1 subnet is currently in the pool :
Current index IP address range Leased addresses
10.1.1.11 10.1.1.1 - 10.1.1.254 47
Check active leases:
Router# show ip dhcp binding
IP address Client-ID/ Lease expiration Type
Hardware address/
User name
10.1.1.15 0100.5679.abcd.ef Jul 30 2026 09:12 AM Automatic
10.1.1.20 0100.1122.3344.55 Infinite Manual
Check overall server statistics and conflicts:
Router# show ip dhcp server statistics
Router# show ip dhcp conflict
A non-empty show ip dhcp conflict output means the DHCP server has detected an address already in use on the network that it also considered available — a strong sign of either a rogue static assignment or a second, uncoordinated DHCP server on the segment.
Practical Lab: Multi-VLAN DHCP with Relay to a Central Server
Build a lab with a Layer 3 switch or router as the gateway for VLANs 10, 20, and 30, and a separate router simulating a centralized DHCP server for all three subnets.
On the central DHCP server router:
Router(config)# ip dhcp excluded-address 10.1.1.1 10.1.1.10
Router(config)# ip dhcp excluded-address 10.1.2.1 10.1.2.10
Router(config)# ip dhcp excluded-address 10.1.3.1 10.1.3.10
Router(config)# ip dhcp pool VLAN10
Router(dhcp-config)# network 10.1.1.0 255.255.255.0
Router(dhcp-config)# default-router 10.1.1.1
Router(dhcp-config)# exit
Router(config)# ip dhcp pool VLAN20
Router(dhcp-config)# network 10.1.2.0 255.255.255.0
Router(dhcp-config)# default-router 10.1.2.1
Router(dhcp-config)# exit
Router(config)# ip dhcp pool VLAN30
Router(dhcp-config)# network 10.1.3.0 255.255.255.0
Router(dhcp-config)# default-router 10.1.3.1
Router(dhcp-config)# exit
On the gateway switch/router, each VLAN SVI gets a helper address pointing to the DHCP server:
Router(config)# interface Vlan10
Router(config-if)# ip address 10.1.1.1 255.255.255.0
Router(config-if)# ip helper-address 10.1.100.5
Router(config-if)# exit
Router(config)# interface Vlan20
Router(config-if)# ip address 10.1.2.1 255.255.255.0
Router(config-if)# ip helper-address 10.1.100.5
Router(config-if)# exit
Router(config)# interface Vlan30
Router(config-if)# ip address 10.1.3.1 255.255.255.0
Router(config-if)# ip helper-address 10.1.100.5
Router(config-if)# exit
Confirm end-to-end lease assignment from a test client on each VLAN, and cross-check with show ip dhcp binding on the server router.
Real-World Enterprise Scenario
At a company with dozens of branch offices, each branch router ran local DHCP for its own subnet rather than relaying to a central server, largely because WAN links to headquarters weren’t always reliable enough to depend on for something as fundamental as address assignment. The design used IOS DHCP pools locally at each branch, with DNS servers pointed at headquarters (since DNS resolution could tolerate brief WAN outages better than clients failing to get an IP at all), and centralized IPAM tooling that periodically pulled show ip dhcp binding data via SSH/Netconf from every branch router for inventory and audit purposes. This is a good example of when local DHCP service on the router — not just relay — is the architecturally correct choice.
Security Best Practices
- Combine router-based DHCP (or relay) with DHCP snooping on your access-layer switches to prevent rogue DHCP servers from handing out malicious gateway/DNS information.
- Always exclude infrastructure addresses (gateways, printers with static IPs, management interfaces) from the DHCP pool’s assignable range.
- Use reasonable, not excessively long, lease times in environments with high device turnover (guest networks, BYOD) to reclaim addresses faster and keep binding tables accurate.
- Regularly review
show ip dhcp conflictfor signs of rogue static addressing or duplicate DHCP servers. - Where possible, use
ip dhcp snoopingin conjunction withip source bindingverification on switches to add another layer of protection against spoofed DHCP or IP traffic.
Optimization and Performance Tuning
- For a router serving many pools, monitor
show ip dhcp server statisticsforMalformed messagesor unusually highAddress pool exhaustioncounts, as either indicates a scope sizing or a client behavior problem. - Right-size your subnet/scope to actual host count needs plus reasonable growth — oversized scopes on small subnets waste address space; undersized scopes on growing subnets lead to exhaustion incidents.
- Use
ip dhcp databaseto configure lease database backup to a remote server (via TFTP/FTP), so a router reload doesn’t force every client to re-DORA simultaneously and lose reservation continuity.
Router(config)# ip dhcp database ftp://user:pass@10.1.100.20/dhcp-backup.txt write-delay 300
- If relaying to a central server across a WAN, monitor WAN latency and reliability — DHCP relay adds a round trip dependency on that link for every new lease.
Troubleshooting and Common Mistakes
- Forgetting
ip dhcp excluded-address: Leads to the router itself, or other statically assigned infrastructure, being handed out as a lease to a random client — a classic and disruptive mistake. - Helper-address pointed at the wrong server, or missing entirely on a new VLAN: The most common cause of “new VLAN has no DHCP” tickets — always confirm
ip helper-addressis applied to the SVI/subinterface, not just configured somewhere in general. - Overlapping pools across routers: If two DHCP servers (or a server and a relay pointing to the wrong destination) serve overlapping address ranges, you’ll see duplicate address conflicts — check
show ip dhcp conflict. - DHCP snooping on switches blocking legitimate router-based DHCP replies: If DHCP snooping is enabled on access switches between clients and the router, make sure the port facing the router (or the relay’s upstream path) is marked trusted.
- Client-identifier mismatch on reservations: Forgetting the
01media-type prefix on the client-identifier for Ethernet MAC-based reservations is an extremely common gotcha.
Frequently Asked Questions
Can a single router act as both a DHCP server and a DHCP relay agent, for different VLANs? Yes — a router can run local ip dhcp pool service for some subnets and use ip helper-address to relay to an external server for others, simultaneously.
Why isn’t my new VLAN getting DHCP addresses even though the pool is configured correctly? Check first whether ip helper-address (if relaying) is applied to the correct interface, and second whether the pool’s network statement matches the SVI/subnet exactly — a mismatched subnet mask is a very common cause.
How does the router know which pool to use for an incoming request? For locally attached subnets, it matches the pool whose network matches the receiving interface’s subnet. For relayed requests, it matches the pool whose network matches the giaddr (gateway IP address) field set by the relay agent, i.e., the relaying interface’s IP.
Is ip helper-address only for DHCP? No — by default it relays several UDP broadcast services including DHCP, TFTP, DNS, and NetBIOS. You can adjust this default forwarded protocol list with ip forward-protocol if you want to be more selective.
Summary
Cisco IOS DHCP configuration is approachable once you understand the DORA process and the distinction between local DHCP server pools and relay-based designs using ip helper-address. The details that actually cause outages — excluded addresses, helper-address placement, lease database backup, and DHCP snooping trust boundaries — are exactly what separates a configuration that works in testing from one that holds up reliably in production. Get comfortable with show ip dhcp pool, show ip dhcp binding, and show ip dhcp conflict, and DHCP troubleshooting stops being guesswork.
References
- Cisco IOS IP Addressing Services Configuration Guide — DHCP chapter, cisco.com/c/en/us/support/ios-nx-os-software
- Cisco Command Reference —
ip dhcp pool,ip dhcp excluded-address,ip helper-address,ip dhcp database - RFC 2131 (Dynamic Host Configuration Protocol), referenced throughout Cisco’s DHCP documentation
