Cisco DHCP Cheat Sheet (Server, Relay, Client)
Every DHCP command on Cisco IOS in configuration order — a pool that hands out addresses, the exclusions that protect your static ones, relay for clients on a different subnet, and verification. Values in <angle brackets> are yours. Verified on IOS 17.16, so commands the image rejects are not listed.
Part of the DHCP learning hub
1. Reserve the addresses you do not want handed out
This is global configuration, NOT inside the pool — putting it under 'ip dhcp pool' is the usual mistake. Exclude your gateway, your servers and anything else statically addressed BEFORE the pool starts leasing, because the router will happily lease an address you are already using.
| Command | What it does |
|---|---|
ip dhcp excluded-address <first-ip> <last-ip> | Keep a range out of every pool. Repeat the command for each range you need. |
ip dhcp excluded-address <ip> | Exclude a single address, typically the router's own interface. |
2. Build the pool
The pool's network statement must match the subnet of the interface receiving the request, or the router has nothing to offer. A prefix typed as /24 is stored back as 255.255.255.0 — the device rewrites it, your line was fine.
| Command | What it does |
|---|---|
ip dhcp pool <name> | Create the pool and drop into pool configuration. |
network <network> <mask> | The subnet to lease from. Also accepts a /prefix, which is stored back as a dotted mask. |
default-router <ip> | The gateway handed to clients — nearly always this router's interface on that subnet. |
dns-server <ip> [<ip2>] | Name servers for clients. Several addresses can go on one line. |
domain-name <domain> | The DNS domain suffix given to clients. |
lease <days> <hours> <minutes> | How long a lease lasts, e.g. 'lease 7 12 30'. Default is one day. |
lease infinite | Never expire the lease. |
option 150 ip <tftp-ip> | TFTP server address — the option Cisco IP phones use to find their config. |
3. Reserve a fixed address for one client
A reservation is its own pool containing a single host, not an entry inside the main pool. Identify the client and it gets the same address every time.
| Command | What it does |
|---|---|
ip dhcp pool <name> | One pool per reserved host. |
host <ip> <mask> | The single address this client will always receive. |
client-identifier <id> | Identify the client, e.g. 0100.5079.6668.17 — the MAC prefixed with the media type 01. |
hardware-address <mac> | The alternative to client-identifier: match the raw hardware address. |
4. Relay — when the server is on another subnet
DHCP DISCOVER is a broadcast, and routers do not forward broadcasts. ip helper-address turns it into a unicast aimed at the server, and it goes on the interface FACING THE CLIENTS, not the one facing the server.
| Command | What it does |
|---|---|
interface <type/number> | The client-facing interface — the one receiving the broadcast. |
ip helper-address <server-ip> | Forward DHCP (and a few other UDP services) to the server. Repeat for multiple servers. |
ip dhcp relay information option | Insert option 82, identifying which relay and port the request came from. |
5. Make the router itself a DHCP client
Common on the interface facing an ISP, where the address is assigned to you rather than chosen.
| Command | What it does |
|---|---|
interface <type/number> | The interface that should obtain its address automatically. |
ip address dhcp | Take the address from a DHCP server instead of configuring it statically. |
6. Verify and tune
An empty binding table means no client has completed a lease yet. Check the pool's network matches the client subnet, and that the interface is up, before assuming the server is broken.
| Command | What it does |
|---|---|
show ip dhcp binding | Which addresses are currently leased, to which client, and until when. |
show ip dhcp pool | Per-pool totals: how many addresses exist, how many are leased, and the high-water mark. |
debug ip dhcp server events | Watch requests and offers as they happen. Noisy — turn it off with 'undebug all'. |
ip dhcp ping packets <n> | How many pings the server sends to check an address is free before offering it (default 2). |
no ip dhcp conflict logging | Stop recording address conflicts. Leave conflict logging ON unless you have a reason. |
Frequently asked questions
Why is my DHCP pool not handing out addresses?
Most often the pool's network statement does not match the subnet of the interface the request arrived on, so the router has nothing valid to offer. After that, check that the interface is up with an address in that subnet, that you have not excluded the whole range, and — if the clients are on a different subnet — that ip helper-address is on the client-facing interface. 'show ip dhcp pool' tells you whether any addresses are considered available at all.
Does ip dhcp excluded-address go inside the pool?
No, and this is the classic mistake. It is a global configuration command that applies across all pools, so it sits outside 'ip dhcp pool' entirely. Configure your exclusions before the pool starts leasing, because addresses already handed out are not reclaimed by adding an exclusion afterwards.
Which interface does ip helper-address go on?
The one facing the clients — the interface that receives the broadcast — not the one facing the server. The relay's job is to catch a broadcast on the client subnet and forward it as a unicast to the server, so it has to be listening where the clients are.
Why does my network statement show a mask when I typed a slash?
IOS accepts both and stores one. Typing 'network 192.168.20.0 /24' is valid and comes back in the running configuration as 'network 192.168.20.0 255.255.255.0'. Your line was correct; the device just normalises the form it saves.
Now build it
Labs that drill this on real Cisco IOS — configure it yourself, then grade your config against the answer key.
Stop memorizing — configure it on real Cisco IOS
A cheat sheet gets you unstuck; a graded lab makes it stick. Edit a real Cisco config and grade it instantly — free, no signup.