Configure and verify DHCP client and relay

The broadcast problem

Section 4.3 explained that a DHCP client starts with a broadcast Discover to 255.255.255.255. A broadcast reaches every device in the same VLAN and stops at the router; routers do not forward broadcasts (that is much of the reason we have routers). So if the DHCP server sits in the data center on VLAN 100 and the client is on VLAN 20 in another building, the Discover never reaches the server.

Two fixes are possible. You could run a DHCP server on every subnet (often the local router), which does not scale and scatters your address management. Or you can make the router a DHCP relay agent: the router listens for DHCP broadcasts on the client-facing interface, converts each one into a unicast packet addressed to the real server, and forwards it. The server’s replies come back to the router, which delivers them to the client. One central server can then serve every subnet in the company.

How relay works in detail

1. Client broadcasts Discover (source 0.0.0.0, destination 255.255.255.255, UDP 68 to 67).
2. The router’s interface configured with ip helper-address receives it. The router rewrites the destination IP to the helper address (the DHCP server) and sets the source IP to its own interface address on the client subnet. It also fills in the giaddr (gateway address) field of the DHCP message with that same interface address.
3. The server receives a unicast Discover. It looks at giaddr to learn which subnet the client is on, picks the matching pool, and unicasts the Offer back to the router at the giaddr address.
4. The router forwards the Offer to the client on the local subnet (as a broadcast or unicast, depending on flags).
5. The Request and Ack follow the same path.

The giaddr field is the key. It is how a central server with pools for fifty subnets knows which one to use.

Configuring the relay

The ip helper-address command goes on the interface facing the clients (the interface where the broadcasts arrive), not on the interface facing the server. This is the detail exams test.

! DHCP server is at 10.10.100.5 on a different subnet
R2(config)# interface GigabitEthernet0/0
R2(config-if)# description Sales LAN, DHCP clients here
R2(config-if)# ip address 10.10.20.1 255.255.255.0
R2(config-if)# ip helper-address 10.10.100.5

On a Layer 3 switch doing inter-VLAN routing, the same command goes on the SVI (interface Vlan20). You can list several helper addresses for redundancy; the router forwards to all of them.

By default ip helper-address relays more than DHCP. It forwards UDP broadcasts for a set of well-known ports: TFTP (69), DNS (53), Time (37), IEN-116 name service (42), TACACS (49), BOOTP/DHCP server (67), BOOTP/DHCP client (68), NetBIOS name (137), and NetBIOS datagram (138). You can add or remove ports with ip forward-protocol udp <port> / no ip forward-protocol udp <port>, but for the exam, just know that DHCP is included by default.

Verification: show ip interface GigabitEthernet0/0 includes the line Helper address is 10.10.100.5. The DHCP server’s show ip dhcp binding will show the remote clients. debug ip dhcp server packet on the server router shows requests arriving with the relay’s giaddr.

R2# show ip interface GigabitEthernet0/0
GigabitEthernet0/0 is up, line protocol is up
  Internet address is 10.10.20.1/24
  Broadcast address is 255.255.255.255
  Address determined by setup command
  MTU is 1500 bytes
  Helper address is 10.10.100.5
  Directed broadcast forwarding is disabled

Router as a DHCP client

A router can also receive an address by DHCP, most commonly on the WAN interface of a small-office router whose ISP assigns addresses dynamically (cable, fiber, or DSL services).

R1(config)# interface GigabitEthernet0/1
R1(config-if)# description ISP uplink
R1(config-if)# ip address dhcp
R1(config-if)# no shutdown

Along with the address and mask, the router learns a default gateway from DHCP option 3 and installs it as a default route (shown as S* with the note “via DHCP” or as a static route with AD 254 in the routing table, depending on IOS version). It may also learn DNS servers (option 6), which it uses if ip name-server is not configured.

Verify with show ip interface brief (the method column reads DHCP) and show dhcp lease on the router, which shows the leased address, server, lease time, and the T1/T2 renewal timers.

R1# show ip interface brief
Interface              IP-Address      OK? Method Status    Protocol
GigabitEthernet0/0     192.168.1.1     YES manual up        up
GigabitEthernet0/1     203.0.113.2     YES DHCP   up        up

R1# show dhcp lease
Temp IP addr: 203.0.113.2  for peer on Interface: GigabitEthernet0/1
Temp  sub net mask: 255.255.255.248
   DHCP Lease server: 203.0.113.1, state: 5 Bound
   DHCP transaction id: 1A2B
   Lease: 86400 secs,  Renewal: 43200 secs,  Rebind: 75600 secs
Temp default-gateway addr: 203.0.113.1
   Next timer fires after: 11:52:10
   Retry count: 0   Client-ID: cisco-0011.2233.4455-Gi0/1

A common combination is a router with ip address dhcp on the outside interface, ip nat inside source list 1 interface GigabitEthernet0/1 overload for PAT, and its own DHCP pool for the LAN. That is exactly what a home router does.