DHCP on Cisco IOS: server pools, exclusions, static bindings and DHCP clients
In short: A Cisco router or Layer 3 switch can be a small DHCP server: you define a pool, exclude the addresses you use for static devices, and set the gateway, DNS and lease time. A static binding always gives one device the same address. An interface can also be a DHCP client, which is common on internet links.
Why run DHCP on the router?
Large organisations usually run DHCP on Windows Server, Linux or an IP address management (IPAM) platform. In a small office, a branch or a lab, the router or Layer 3 switch that is already the default gateway can do the job. It saves a server, it keeps working if the link to head office fails, and it is quick to set up. The basic exchange (Discover, Offer, Request, Acknowledge) is explained in DHCP: how devices get an IP address automatically. Here we focus on the Cisco IOS side.
Building a pool
A pool is a named set of settings for one subnet. Before you create it, exclude the addresses you hand out by hand, such as the gateway, printers and servers. The router never offers an excluded address.
ip dhcp excluded-address 192.168.20.1 192.168.20.30
!
ip dhcp pool STAFF-VLAN20
network 192.168.20.0 255.255.255.0
default-router 192.168.20.1
dns-server 192.168.10.5 192.168.10.6
domain-name office.example
lease 3- network sets the subnet the pool serves. The router uses the pool whose network matches the interface the request arrived on (or the relay address, covered in the relay note).
- default-router and dns-server become DHCP options 3 and 6 for the client.
- lease is in days (you can add hours and minutes). Short leases suit busy guest Wi-Fi; longer leases suit fixed desks.
- For special needs, the
optioncommand sends extra options, for example option 150 telling Cisco IP phones where their TFTP server is.
Check the result with these commands:
show ip dhcp pool
show ip dhcp binding
show ip dhcp conflict
show ip dhcp server statisticsThe binding table lists each address, the client and the lease expiry. The conflict table lists addresses the router found already in use (it pings an address before offering it) and therefore took out of service.
Static bindings: always the same address
Some devices, such as a label printer or a door controller, should keep one address but still be managed through DHCP. A static binding (often called a reservation) does this. On IOS each reservation is its own small pool with a host address and the client's identity.
ip dhcp pool PRINTER-RECEPTION
host 192.168.20.40 255.255.255.0
client-identifier 0100.1a2b.3c4d.5e
default-router 192.168.20.1
dns-server 192.168.10.5The identity can be a client-identifier or a hardware-address. Most clients send a client identifier, which for Ethernet is usually 01 (the Ethernet type) followed by the MAC address. If the reservation does not work, run show ip dhcp binding to see exactly what identifier the device sent and copy it. Keep the reserved address inside the subnet but outside the excluded range only if you want IOS to manage it; many teams simply exclude it as well to avoid surprises.
Making a router a DHCP client
A router can also receive an address. This is common on a broadband or cable internet connection where the provider assigns the public address dynamically.
interface GigabitEthernet0/1
description Internet link
ip address dhcp
no shutdown
!
show ip interface brief
show dhcp leaseIf the provider's server sends a default gateway, IOS installs a default route automatically with a high administrative distance (254), so a static default route you configure will be preferred. Combine the client interface with NAT and an access list so the internet only sees what it should.
Real-world example: a clinic branch with no local server
A small dental clinic, part of a fictional group with eight sites, had one router per branch and no server on site. Staff PCs, two printers and a card terminal all used fixed addresses typed by hand, and a new laptop once took the card terminal's address, stopping payments for an afternoon. The group's engineer moved the branch to DHCP on the router: one pool for staff devices, a separate pool on the guest Wi-Fi VLAN with a four-hour lease, an excluded block for infrastructure, and static bindings for the printers and the card terminal. Conflicts stopped, new devices worked straight away, and the binding table gave the support desk a simple list of what was connected.
Tip: protect any network that runs DHCP with DHCP snooping on the access switches, so a rogue device cannot act as a second server. See Securing switches and routers.
Practice
Why should you create excluded addresses before the pool?
A static binding is not working for a Windows PC. What should you check first?
A router gets its internet address with ip address dhcp. Where does its default route come from?
Key takeaways
- A Cisco router or Layer 3 switch can serve DHCP for small sites and labs.
- Exclude static addresses first, then build one pool per subnet with gateway, DNS and lease.
- Static bindings give a device the same address every time, matched by client identifier or MAC.
- ip address dhcp makes an interface a DHCP client and can install a default route.
- Verify with show ip dhcp binding, pool, conflict and server statistics.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.