DHCP Configuration Lab

Step 1 — How DHCP Works (DORA)

# DORA = Discover → Offer → Request → Acknowledge

Client                          DHCP Server
  |                                  |
  |──── DHCPDISCOVER ───────────────>|  "I need an IP! Anyone there?"
  |     (broadcast)                  |
  |                                  |
  |<──── DHCPOFFER ──────────────────|  "Here, take 192.168.1.10"
  |                                  |
  |──── DHCPREQUEST ────────────────>|  "Yes! I'll take 192.168.1.10"
  |     (broadcast - tells others)   |
  |                                  |
  |<──── DHCPACK ────────────────────|  "Confirmed! Lease: 24 hours"

# DHCP provides:
IP Address      → e.g. 192.168.1.10
Subnet Mask     → e.g. 255.255.255.0
Default Gateway → e.g. 192.168.1.1
DNS Server      → e.g. 8.8.8.8
Lease Time      → how long the IP is valid

Step 2 — Configure DHCP Pool

# Configure router as DHCP server
! Step 1: Create a pool
ip dhcp pool LAN_POOL
 network 192.168.1.0 255.255.255.0    # subnet to assign from
 default-router 192.168.1.1           # gateway to give to clients
 dns-server 8.8.8.8 8.8.4.4           # DNS servers
 lease 1 12 0                          # lease: 1 day 12 hours 0 minutes
 domain-name kalirange.local           # optional domain name

# Multiple pools (for multiple VLANs/subnets):
ip dhcp pool VLAN10
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 8.8.8.8

ip dhcp pool VLAN20
 network 10.20.20.0 255.255.255.0
 default-router 10.20.20.1
 dns-server 8.8.8.8

Step 3 — Exclude Static IPs

# Exclude IPs used by routers, servers, printers (static devices)
# Must be done BEFORE defining the pool

# Exclude a single IP:
ip dhcp excluded-address 192.168.1.1

# Exclude a range (most common):
ip dhcp excluded-address 192.168.1.1 192.168.1.20
# Excludes .1 through .20
# DHCP will only assign .21 onward

# Best practice: exclude first 20 addresses for infrastructure
ip dhcp excluded-address 192.168.1.1 192.168.1.20

ip dhcp pool LAN_POOL
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
 dns-server 8.8.8.8
# Clients will receive 192.168.1.21 – 192.168.1.254

Step 4 — DHCP Relay Agent (ip helper-address)

# Problem: DHCP uses broadcast — doesn't cross router boundaries
# Solution: ip helper-address forwards DHCP broadcasts as unicast to the server

# Topology:
PC (VLAN10) → Router → DHCP Server (192.168.1.1)

# On the router interface facing the client VLAN:
interface GigabitEthernet0/0.10     # sub-interface for VLAN10
 encapsulation dot1Q 10
 ip address 10.10.10.1 255.255.255.0
 ip helper-address 192.168.1.1       # forward DHCP to this server

# Now PCs on VLAN10 can get IPs from the centralized DHCP server
# ip helper-address also relays: TFTP, DNS, NTP, NetBIOS

Step 5 — DHCP Snooping (Security)

# DHCP Snooping prevents rogue DHCP servers from poisoning the network
# Rogue DHCP = attacker sets up fake DHCP server to give clients
# their own IP as default gateway → man-in-the-middle

# Enable globally
ip dhcp snooping
ip dhcp snooping vlan 10,20,30      # enable on these VLANs

# Trust only the port connecting to the real DHCP server
interface GigabitEthernet0/0        # uplink to DHCP server
 ip dhcp snooping trust

# ALL other ports are untrusted by default
# Untrusted ports: DHCP Discover/Request = allowed (client traffic)
#                  DHCP Offer/Ack = DROPPED (only servers send these)

# Rate-limit DHCP on access ports (prevent DHCP exhaustion attack)
interface GigabitEthernet0/1
 ip dhcp snooping limit rate 10     # max 10 DHCP packets/second

Step 6 — Verify DHCP

# Show active DHCP leases
show ip dhcp binding
IP address     Client-ID/HW address  Lease expiration
192.168.1.21   0100.5056.aabb.cc     Jun 16 2025 10:30 AM

# Show pool statistics
show ip dhcp pool
Pool LAN_POOL:
 Utilization mark (high/low) : 100/0
 Total addresses              : 233
 Leased addresses             : 45
 Available addresses          : 188

# Show conflicts (IPs refused because they're already in use)
show ip dhcp conflict

# Clear all DHCP bindings (force re-issue of all IPs)
clear ip dhcp binding *

# Verify a client received IP (on the client):
ipconfig /all            # Windows
ip a                     # Linux

# Force a client to request new IP:
ipconfig /release && ipconfig /renew    # Windows
dhclient -r && dhclient eth0             # Linux