Dynamic Host Configuration Protocol
▪ Dynamic IP assignment
▪ Built-in DHCP in Home internet Gateways
(routers/modems)
▪ Router, Server, WiFi, Broadband
DHCP uses UDP as transport
Server: port 67
Client: port 68
RFC 2131
Dynamic Host Configuration Protocol
Benefits of using DHCP
DHCP reduces the complexity and amount of administrative work by using automatic
IP configuration
Automatic IP configuration Manual IP configuration
Supplies IP addresses automatically Type IP addresses manually
Ensures correct configuration Typing incorrect IP address is a
information possibility
Updates client configuration Can result in possible communication
automatically and network issues
Eliminates a common source of Frequent computer moves increase
network problems administrative effort
Dynamic Host Configuration Protocol
DHCP is a server process that assigns IP addresses from a
“pool” to network devices.
A cisco router can be used as a DHCP server but you can
also configure in Microsoft or Linux servers.
Dynamic Host Configuration Protocol
A DHCP pool has been configured with IP address
[Link] – [Link].
Once the computer boots it will request an IP address by
broadcasting a DHCP discover message:
Dynamic Host Configuration Protocol
The computer has no IP address so it will broadcast this
DHCP discover message. The DHCP server will hear this
message and respond as following:
The DHCP server will send a DHCP offer message which
contains the IP address that the computer can use. Besides
giving an IP address we can also supply a default gateway
and a DNS server IP address.
Dynamic Host Configuration Protocol
After receiving the DHCP offer our computer will send a
DHCP request to ask if it’s OK to use this information…
Dynamic Host Configuration Protocol
And the final step in this process will be a DHCP ACK from
the DHCP server to “acknowledge” the request from the
computer.
Dynamic Host Configuration Protocol
Dynamic Host Configuration Protocol
How DHCP lease renewal works?
▪ DHCP client sends a DHCPREQUEST packet
▪ DHCP Server sends a DHCPACK packet
▪ If the client fails to renew its lease after 50% of the lease duration
has expired (T1 (50%) → Unicast renewal), the DHCP lease renewal
process begins again after 87.5% of the lease duration has
expired. (T2 (87.5%) → Broadcast rebinding)
▪ If the client fails to renew its lease after 87.5% of the lease has
expired, the DHCP lease generation process starts over again with
a DHCP client broadcasting a DHCPDISCOVER (Expiry → Restart
DHCP process)
Dynamic Host Configuration Protocol
How DHCP lease renewal works?
If lease time = 8 hours:
● T1 = 4 hours (50%) → Try original DHCP server
● T2 = 7 hours (87.5%) → Try any DHCP server
Expiry = 8 hours → IP becomes invalid
Balance Between Efficiency and Safety
● If T2 started too early:
It would create unnecessary broadcast traffic
● If T2 started too late:
Risk of IP lease expiration increases
Dynamic Host Configuration Protocol
DHCP vs. BOOTP
▪ DHCP was designed to replace the older BOOTP (Bootstrap
Protocol).
▪ BOOTP can only provide an IP to a computer while it is booting
whereas DHCP can provide an IP when the OS is already
loaded.
▪ DHCP is primarily used to seamlessly provide IP addresses to
computers while BOOTP is used to configure and boot diskless
computers or thin clients.
▪ BOOTP has a 30 days lease on the IP address as a default
while DHCP only sets 8 days as a default.
▪ DHCP can automatically rebind or renew their leases while
BOOTP requires a system restart.
DHCP Options
In Dynamic Host Configuration Protocol, options are
additional configuration parameters that a DHCP server
sends to clients along with the IP address. These help devices
communicate properly on the network and the internet.
▪ Gateway
▪ DNS (Domain Name System)
▪ Domain Name
▪ WINS (Windows Internet Name Service) Resolves
NetBIOS names → IP addresses
Used mainly in older Windows networks
DHCP Reservations
In Dynamic Host Configuration Protocol, MAC Reservation
(also called DHCP Reservation) means assigning a fixed IP
address to a specific device based on its MAC address.
▪ How to get MAC of any PC
DHCP server keeps a mapping:
MAC address → Specific IP
Whenever that device connects:
It always receives the same IP address
Example: Laptop MAC: 00:1A:2B:AA:BB:CC
Reserved IP: [Link]
Every time → gets [Link]
DHCP Commands
▪ ipconfig (Displays basic IP configuration of your
system.)
▪ ipconfig/all (Shows detailed network
configuration.)
▪ ipconfig/release (Releases the current IP address
assigned by DHCP.)
▪ ipconfig/renew (Requests a new IP address lease
from the DHCP server.)
Automatic Private IP Addressing
(APIPA)
APIPA will automatically assign an IP address to the local
computer when DHCP is unavailable.
APIPA IP addresses are:
169.254.x.x
[Link]
If a computer has an APIPA IP address it will send a
DHCPDISCOVER message every 5 minutes.
Installing and configuring the DHCP
The server hosting DHCP requires a static IP address
You can install the DHCP server role by using:
The Add Roles and Features Wizard in Server Manager
Windows PowerShell:
Install-WindowsFeature DHCP -IncludeManagementTools
Post-installation tasks include:
Creating DHCP security groups
Restarting the DHCP Server service
Authorizing the DHCP server in AD DS (Active Directory Domain Services)
AD DS main function is to provide centralized authentication, authorization, and
management of users, computers, and other resources.
Installing and configuring the DHCP
You must create scopes to define the network information that will be
distributed to clients. A scope must contain:
A range of IP addresses
A subnet mask
A lease duration
A scope might contain:
Default gateway address
DNS server and suffix
Other network options
IP addresses can be reserved based on the MAC address of the client
network interface
Maintaining the DHCP database
The DHCP database ([Link]) contains information relating to scopes,
leases, reservations, and all other configuration information
The default location of DHCP database files is
%systemroot%\system32\DHCP
The DHCP database is automatically backed up every 60 minutes. You
can also perform a manual backup.
You can reconcile/settle or resolve the DHCP database to repair
inconsistencies.
You can move the DHCP database to a new DHCP server when the
DHCP Server service is moved.
Migrating the DHCP server
You can migrate the DHCP server by exporting the DHCP data from the
old server, and then importing it to the new server
Windows DHCP Server
1. Install VMWare Workstation / Oracle Virtual Box
2. Install Server OS and Client OS (Windows 7/8.1/10/11)
3. Install AD on the Server and Add another server
4. Rename with DHCP_Server (login to the server with the domain administrator)
5. Install DHCP role (If you have multiple DHCP servers, you can remotely
install DHCP on other machines)
6. Authorize the DHCP server (you will see DHCP admin & User group in the local users and groups
folder of This PC).
7. Create and define a scope of IP address (with any class of address)
8. Authorize it
9. Try to assign an IP address to clients (Test on the client)
[Link] a reservation address
[Link] Filter (Enable/Disable)
Windows DHCP Server
[Link] Scope (DNS/Router/Time Server/etc.)
[Link] Multiple scopes (by defining different network id)
[Link] Super Scope with different networks and test it.
[Link] between Server option and Scope option
[Link] a RAID, Backup, and Restore the DHCP
[Link] of Failover DHCP (Server 1 and Server 2) (Test it)
[Link] of Failover (Load Balance) DHCP (Server 1 and Server 2)
[Link] control using DHCP Admin and DHCP User groups
[Link] Wireshark to demonstrate the DHCP packets
Time Server IPs
[Link]
[Link]
[Link]
DHCP Server on Layer 3 Device
DHCP Server on Layer 3 Device
Router>enable
Router#Configure terminal
Router (config)#Interface gigabit0/0
Router (config-if)#ip address [Link] [Link]
Router (config-if)#no shutdown
Router (config-if)#exit
Router (config)#ip dhcp pool ABC
Router (config)#network [Link] [Link]
Router (config)#default-router [Link]
Router (config)#dns-server [Link]
Router (config)#do write
Multiple DHCP Server on Layer 3 Device
Multiple DHCP Server on Layer 3 Device
Router (config)#Interface gigabit0/0
Router (config-if)#ip address [Link] [Link]
Router (config-if)#no shutdown
Router (config)#Interface gigabit0/1
Router (config-if)#ip address [Link] [Link]
Router (config-if)#no shutdown
Router (config-if)#exit
Router (config)#ip dhcp pool 100
Router (config)#network [Link] [Link]
Router (config)#default-router [Link]
Router (config)#ip dhcp pool 200
Router (config)#network [Link] [Link]
Router (config)#default-router [Link]
One DHCP Server for multiple networks
One DHCP Server for multiple networks
One DHCP Server for multiple networks
One DHCP Server for multiple networks
Step 1: Configure Both Interfaces of the Router
Step 2: Access the interface that does not have DHCP Server
Step 3: Give the following command (by providing the DHCP server IP address):
Router (config)#Interface gigabit0/0
Router (config-if)#ip helper-address [Link] [Link]
Router (config-if)#do write
Router (config-if)#exit
DHCP Server for Multiple VLANs
DHCP Server for Multiple VLANs
R1(config)# interface g0/1
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface g0/1.10
R1(config-subif)# description Management Network
R1(config-subif)# encapsulation dot1q 10
R1(config-subif)# ip address [Link] [Link]
R1(config-subif)# interface g0/1.20
R1(config-subif)# description Operations Network
R1(config-subif)# encapsulation dot1q 20
R1(config-subif)# ip address [Link] [Link]
R1(config-subif)# interface g0/1.30
R1(config-subif)# description Operations Network
R1(config-subif)# encapsulation dot1q 30
R1(config-subif)# ip address [Link] [Link]
DHCP Server for Multiple VLANs
Router (config)#ip dhcp pool 10
Router (config)#network [Link] [Link]
Router (config)#default-router [Link]
Router (config)#ip dhcp pool 20
Router (config)#network [Link] [Link]
Router (config)#default-router [Link]
Router (config)#ip dhcp pool 30
Router (config)#network [Link] [Link]
Router (config)#default-router [Link]
S1(config)# interface f0/24
S1(config-if)# switchport mode trunk
Verify the IP address on all the PCs
Bad things about DHCP Server
1. Multiple DHCP servers in a network
DHCP Snooping
DHCP Snooping is a security feature used on network switches to prevent
unauthorized DHCP servers from assigning IP addresses to clients.
Cisco was the first vendor to release DHCP snooping as a feature in its
network switches, designed to mitigate issues with unauthorized (rogue)
DHCP servers.
DHCP Snooping is available on both the Cisco Catalyst and Cisco Nexus
platform switches. Both platforms are classified as enterprise-grade switches
and fully support all DHCP Snooping functions.
The way DHCP Snooping works is fairly straightforward. DHCP Snooping
categorizes all switch ports into two simple categories:
▪ Trusted Ports
▪ Untrusted Ports
DHCP Snooping
DHCP Snooping Configuration
Step 1: Enable DHCP Snooping Globally
SW(config)#ip dhcp snooping
Step 2: After enabling DHCP snooping, configure FastEthernet 0/1 and
FastEthernet 0/2 as a trusted port.
SW(config)#interface range FastEthernet 0/1 - FastEthernet 0/2
SW(config-if-range)#ip dhcp snooping trust
SW(config-if-range)#no shutdown
SW(config-if-range)#exit
DHCP Snooping Configuration
Step 3: Assign IP DHCP Snooping to the VLAN that is currently using
the following command.
SW(config)#ip dhcp snooping vlan 1
Step 4: Disable the insertion of option 82 in the DHCP packets
SW1(config)#no ip dhcp snooping information option
SW2(config)#no ip dhcp snooping information option
NOTE: The above configuration will disable the switch from inserting option
82 in the DHCP packets. This will offer better compatibility with DHCP
servers because some servers drop packets with option 82.
DHCP Snooping Configuration
NOTE: The above configuration will disable the switch from inserting option
82 in the DHCP packets. This will offer better compatibility with DHCP
servers because some servers drop packets with option 82.
Why are packets with Option 82 dropped?
1. Security: Prevent DHCP Spoofing
Only trusted switches should insert Option 82.
If a packet already contains Option 82 from an untrusted source, it may be:
Forged or manipulated
The switch/server drops it to prevent attacks.
DHCP Snooping Configuration
Step 5: Assign an IP address to the gateway router’s interface
gigabitEthernet 0/0.
Router(config)#interface gigabitEthernet 0/0
Router(config-if)#ip address [Link] [Link]
Router(config-if)#no shutdown
Step 6: Configure DHCP Server in the same VLAN and Verify
Disconnect the legitimate DHCP server and observe that PC0 and PC1 are not getting any IP
and PC0 will get an APIPA address. The PCs will not be able to get connected to the rogue
DHCP server.
Step 7: DHCP Snooping Verification Commands
Switch#show ip dhcp snooping
Switch#show ip dhcp snooping binding
DHCP Snooping Configuration
Step 5 (Optional): Configure rate limit on DHCP requests from clients
SW1(config)# interface FastEthernet0/1
SW1(config-if)# ip dhcp snooping limit rate 20
SW2(config)# interface FastEthernet0/1
SW2(config-if)# ip dhcp snooping limit rate 20
Step 6: Verification
SW1#show ip dhcp snooping
Thank you