Cisco IOS DHCP Server: Pools, Exclusions and Options

Small offices, branch sites and lab racks often need DHCP without a dedicated Windows or Linux server, and the DHCP server built into Cisco IOS and IOS XE is capable enough to serve them: multiple address pools, exclusions for servers and routers, DNS and domain options, static reservations and even relay support. It costs nothing but a few lines of configuration and it is already running on the router that owns the default gateway, so there is no extra host to patch or monitor. The two mistakes that bite everyone are forgetting that excluded addresses are configured globally rather than inside the pool, and saving nothing - so the whole scope vanishes on the next reload. This guide configures a working Cisco IOS DHCP server with the classic commands and explains what each option actually does, so you can reason about the server instead of copying lines.

Step 1: Exclude Addresses (Global, Not Per-Pool)

Anything that must never be leased - router interfaces, servers, printers, switches, APs - is excluded at global configuration level, outside any pool. The exclusion list is a property of the server, not of a scope, which is why you type it in global configuration mode:

Router(config)# ip dhcp excluded-address 192.168.0.1 192.168.0.10
Router(config)# ip dhcp excluded-address 192.168.0.50
Router(config)# ip dhcp excluded-address 192.168.0.200 192.168.0.254

Note the interface IP of the router itself is always excluded automatically. This is the classic trap: engineers look for the exclusion inside the pool (like Windows Server scopes) and cannot find it - on IOS, exclusions are top-level commands. A range form excludes everything between the two addresses; a single address excludes just that one. The server never selects an excluded address when handing out leases, which is exactly what you want for static infrastructure. Exclusions are evaluated at allocation time only, so adding one later does not forcibly reclaim an address that is already leased to a host.

Step 2: Define the Address Pool

Router(config)# ip dhcp pool LAN-COMPUTERS
Router(dhcp-config)# network 192.168.0.0 255.255.255.0
Router(dhcp-config)# default-router 192.168.0.1
Router(dhcp-config)# dns-server 8.8.8.8 1.1.1.1
Router(dhcp-config)# domain-name example.com
Router(dhcp-config)# lease 7
Router(dhcp-config)# exit

The pool name can be a word or a number; entering it drops you into (dhcp-config)# mode, which you leave with exit. The network statement tells the server which subnet the pool serves, and IOS matches incoming requests against it using the interface or relay address that received them. The default-router value is what becomes the client's default gateway, so it should be the router's own interface on that segment in almost every design. Typical pool options:

• network - the subnet served, with mask.
• default-router - gateway(s) handed to clients.
• dns-server - one or more resolvers.
• domain-name - DNS search suffix.
• lease - days/hours/minutes (e.g. lease 0 12 0 for 12 hours).
• netbios-name-server / netbios-node-type - legacy WINS options when still needed.

Step 3: Manual Bindings (Static Reservations)

Give a fixed address to a specific MAC (for example a management device) with a manual binding:

Router(config)# ip dhcp pool PRINTER-BINDING
Router(dhcp-config)# host 192.168.0.50 255.255.255.0
Router(dhcp-config)# client-identifier 01aa.bbcc.ddee.ff
Router(dhcp-config)# exit

The client-identifier is the MAC with a leading 01 (ARP media type) prefix; alternatively use hardware-address aabb.ccdd.eeff when you prefer the plain MAC form. A manual binding pool is separate from the dynamic one and only ever serves that single host, so it never appears in the dynamic allocation count. This is the IOS equivalent of a Windows reservation and is ideal for printers, CCTV cameras and building-management gear. Remember that the reserved address should also be inside an excluded range so the dynamic pool cannot hand it to someone else first.

Optional: Split Subnets Across Two Servers

For redundancy without DHCP failover, two servers split the subnet with complementary exclusions:

! Server A
ip dhcp excluded-address 10.0.20.126 10.0.20.255
ip dhcp pool A
 network 10.0.20.0 255.255.255.0

! Server B
ip dhcp excluded-address 10.0.20.0 10.0.20.125
ip dhcp pool B
 network 10.0.20.0 255.255.255.0

Each server is allowed to serve only its half of the subnet, so a client that hears one OFFER from each simply takes the first and the two servers never collide on the same address. This "split scope" approach is crude but reliable, and it keeps working when one router is power-cycled. Both routers must be reachable by broadcast (or via relay) from the same segment. It is a good fit for a pair of routers running a first-hop redundancy protocol, where either device can be the active gateway.

Relaying to a Central Cisco DHCP Server

When the DHCP server is not on the same segment as the clients, the client broadcasts never reach it. Configure the client-facing interface of any Layer 3 device with ip helper-address 192.168.0.1 pointing at this router, and the router will see the relayed request as a normal pool match. The relay side is covered in detail in our DHCP relay guide. The important thing to remember is that the server answers based on the relay's giaddr (the interface that received the broadcast), so the pool must match that subnet - not the address of the relay device in some other range.

Bindings, Leases and Where They Live

By default IOS stores active bindings in RAM, but it also maintains a persistent database in flash so that leases survive a reload. Enable it explicitly on platforms that do not do so automatically, and consider pointing it at a remote server so that bindings survive the loss of the router itself:

Router(config)# ip dhcp database flash:/dhcp-binding
Router(config)# ip dhcp database ftp://user:pass@10.0.0.5/dhcp-binding timeout 60
Router(config)# ip dhcp ping packets 2
Router(config)# ip dhcp ping timeout 500

The optional ip dhcp ping settings make the server ping an address before offering it, which prevents handing out an address that a statically configured host is already using. The database command lets you centralise bindings so that a router replacement does not cause a wave of duplicate-address conflicts. Both features are cheap insurance for a service that is otherwise easy to get wrong, and they make a migrated or replaced router behave as if nothing happened.

Verification and Troubleshooting

Router# show ip dhcp binding          # active leases
Router# show ip dhcp pool             # pool config and utilization
Router# show ip dhcp conflict         # addresses the server considers in use
Router# show ip dhcp server statistics
Router# debug ip dhcp server events   # watch DISCOVER/OFFER/REQUEST/ACK

The show ip dhcp pool output is the fastest health check: look at "Total addresses", "Leased addresses" and "Excluded addresses". If "Leased" is climbing and "Excluded" is not what you configured, a previous pool definition is still in the running config. The statistics command shows how many messages the server has received, sent and dropped, which tells you immediately whether requests are arriving at all. Clients not getting addresses: check that the relay (if any) points at this router with ip helper-address (see our DHCP relay guide), that the pool subnet matches the client's broadcast domain, and that ip dhcp snooping (covered in our DHCP snooping article) is not dropping server replies on the path. For IPv6 networks the equivalent service is DHCPv6 or SLAAC - compared in our SLAAC vs DHCPv6 guide.

Custom Options and Vendor-Specific Tags

The basic pool covers addressing and name resolution, but real networks often need extra DHCP options - an NTP server, a PXE boot server, a SIP registrar for IP phones, or a WPAD proxy for browsers. IOS lets you define any option number and attach it either globally or per pool:

Router(config)# ip dhcp pool VOICE-PHONES
Router(dhcp-config)# network 192.168.30.0 255.255.255.0
Router(dhcp-config)# default-router 192.168.30.1
Router(dhcp-config)# option 42 ip 192.168.0.12
Router(dhcp-config)# option 150 ip 192.168.0.13
Router(dhcp-config)# exit

Option 42 is the NTP server for the voice VLAN, and option 150 is the TFTP server address that Cisco IP phones use to fetch their configuration. Vendor-specific strings (option 43) are also common for wireless controllers. Options can be defined as an ip address, an ascii string, a hex value or an array, depending on the data type the client expects, so always check the option's specification before guessing the format. A single mistyped option type is enough to make a whole class of clients ignore the response and fall back to APIPA, which then looks like a connectivity fault rather than a configuration error.

Securing the IOS DHCP Server

An IOS DHCP server is convenient but it must be protected, because anyone who can reach the segment can request - and potentially exhaust - addresses. The first line of defence is ip dhcp snooping on the switches, which blocks rogue DHCP servers and rate-limits client DISCOVER messages per port. The second is to limit which chunks of the pool can be allocated, and to monitor utilisation so that a lease-exhaustion attack is visible before users complain. Because the server is enabled by default on many platforms, an interface you never intended to serve can start answering requests, so verify which pools exist with show running-config | section dhcp. On IOS XE you can also bind the service to a VRF so that only the intended routing domain is served. Finally, choose lease times that match client behaviour: short leases (1-8 hours) suit guest and wireless networks where devices come and go, while long leases reduce churn on stable wired segments. Getting this wrong is the usual cause of a pool that looks correctly sized on paper yet runs out of free addresses during the working day.

Common Mistakes to Avoid

• Looking for exclusions inside the pool. They are global ip dhcp excluded-address commands.
• Forgetting to save. Run write memory after the change, always.
• Overlapping pools. Two pools serving the same subnet without complementary exclusions will cause duplicate-address conflicts.
• Wrong mask in network. A /24 declared as network 192.168.0.0 255.255.0.0 will hand out addresses outside your segment.
• No default-router. Clients get an address but cannot reach anything off-subnet.
• Lease too long. In a high-churn guest network, a seven-day lease exhausts the pool before addresses are recycled.

原文链接：https://www.cisco.com/c/en/US/docs/ios/12_4t/ip_addr/configuration/guide/htdhcpsv.html