Skip to content
Log in Sign up My account

4.4 Troubleshooting DHCPv4 and DHCPv6

Blueprint 4.4: Troubleshoot IPv4 and IPv6 DHCP

  • DHCP client, IOS DHCP server, DHCP relay, DHCP options
  • IPv6: SLAAC, stateless DHCPv6, stateful DHCPv6, DHCPv6 relay

The verb is troubleshoot. Most questions describe clients without addresses (or with the wrong ones) and show one relay or pool configuration. Know the message flow well enough to say where it stops.

DHCPv4 message flow

Message From To Purpose
DISCOVER Client, UDP 68 Broadcast, UDP 67 Find a server
OFFER Server, UDP 67 Client (unicast or broadcast) Proposed address and options
REQUEST Client Broadcast Accept one offer (and decline the others)
ACK Server Client Confirm the lease
NAK Server Client Reject a request (wrong subnet, address taken)
DECLINE Client Server The offered address is already in use (ARP check)
RELEASE Client Server Give the lease back
INFORM Client Server Ask for options only, already has an address

Clients renew at T1 (50% of the lease) with a unicast REQUEST to the server, and at T2 (87.5%) they broadcast to any server.

DHCP relay

Broadcasts stop at the router. ip helper-address on the interface that receives the client broadcasts turns them into unicasts to the server.

sequenceDiagram
  participant C as HOST1
  participant R as R1 Gi2 10.10.10.1 relay
  participant S as R2 DHCP server 10.255.255.2
  C->>R: DISCOVER broadcast
  R->>S: Unicast, giaddr 10.10.10.1
  Note over S: Picks the pool whose network contains giaddr
  S->>R: OFFER to 10.10.10.1
  R->>C: OFFER
  C->>R: REQUEST broadcast
  R->>S: Unicast, giaddr 10.10.10.1
  S->>R: ACK
  R->>C: ACK
interface GigabitEthernet2
 description Branch LAN, clients here
 ip address 10.10.10.1 255.255.255.0
 ip helper-address 10.255.255.2

What the relay does:

  1. Receives the broadcast on Gi2.
  2. Writes the receiving interface address (10.10.10.1) into the giaddr field.
  3. Sends a unicast to each configured helper address, sourced from the interface toward the server.
  4. The server uses giaddr to choose a pool and sends the reply to giaddr. The server needs a route back to the client subnet.

ip helper-address also relays a default set of other UDP broadcasts, including TFTP (69), DNS (53), Time (37), TACACS (49) and NetBIOS (137, 138). Turn off what you do not want with no ip forward-protocol udp PORT.

Exam trap

The helper must be on the client-facing interface (the SVI for that VLAN, or the LAN subinterface), not on the interface toward the server. If the exhibit shows ip helper-address on the WAN link, that is the fault.

Option 82 and DHCP snooping

A Catalyst access switch running DHCP snooping inserts option 82 (relay agent information) into client requests by default, but it is not a Layer 3 relay, so giaddr stays 0.0.0.0. An upstream IOS router or server that receives a packet with option 82 and a zero giaddr on an untrusted interface drops it. Clients get nothing, and debug ip dhcp server packet on the router mentions inconsistent relay information.

Fix it on one side:

! On the relay or server router, trust the interface
interface GigabitEthernet2
 ip dhcp relay information trusted
! or globally
ip dhcp relay information trust-all
!
! Or on the switch, stop inserting option 82
no ip dhcp snooping information option

The IOS DHCP server

ip dhcp excluded-address 10.10.10.1 10.10.10.20
!
ip dhcp pool BRANCH-LAN
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
 dns-server 192.168.100.53
 domain-name lab.example
 lease 2                         ! days; the default is 1 day
 option 150 ip 192.168.100.60    ! TFTP server for Cisco IP phones

Options you are expected to recognise

Option Meaning IOS pool command
1 Subnet mask From network
3 Default gateway default-router
6 DNS servers dns-server
15 Domain name domain-name
43 Vendor specific (for example, WLC addresses for APs) option 43 hex ...
51 Lease time lease
66 TFTP server name option 66 ascii ... or next-server (siaddr)
82 Relay agent information Inserted by relays and snooping switches
150 Cisco TFTP server address list option 150 ip ...

How the server chooses a pool

  • Relayed request: the pool whose network contains giaddr.
  • Direct request (client on a connected interface): the pool whose network contains the receiving interface's address.
  • No match: no reply. debug ip dhcp server packet reports that there is no pool for the giaddr or interface address.

Conflict detection

Before offering an address, the IOS server pings it (two echo requests by default, set with ip dhcp ping packets). A reply means someone already uses it: the address goes into the conflict table and is not offered until the conflict is cleared. A client may also send DECLINE after its own ARP check.

R2# show ip dhcp conflict
IP address        Detection method   Detection time          VRF
10.10.10.21       Ping               Oct 07 2026 09:42 AM
R2# clear ip dhcp conflict *

A pool full of conflicts and no free addresses usually means a statically addressed range overlapping the pool. Fix it with ip dhcp excluded-address.

Verification and failure output

R2# show ip dhcp pool BRANCH-LAN
Pool BRANCH-LAN :
 Utilization mark (high/low)    : 100 / 0
 Subnet size (first/next)       : 0 / 0
 Total addresses                : 254
 Leased addresses               : 3
 Excluded addresses             : 20
 Pending event                  : none
 1 subnet is currently in the pool :
 Current index        IP address range                    Leased/Excluded/Total
 10.10.10.24          10.10.10.1       - 10.10.10.254      3     / 20    / 254

R2# show ip dhcp binding
IP address      Client-ID/              Lease expiration        Type       State      Interface
                Hardware address/
                User name
10.10.10.21     0063.6973.636f.2d30.    Oct 08 2026 09:42 AM    Automatic  Active     GigabitEthernet0/0

Other commands: show ip dhcp server statistics (message counters), debug ip dhcp server packet, debug ip dhcp server events. On the relay, show ip interface Gi2 | include Helper confirms the helper.

Symptom Likely cause
No DISCOVER reaches the server Helper missing or on the wrong interface; ACL dropping UDP 67; option 82 drop
DISCOVER arrives, no OFFER No pool matches giaddr; pool exhausted; every free address excluded or in conflict; no service dhcp
OFFER sent, client never gets it Server has no route back to giaddr; ACL on the return path
Address received, no internet Wrong or missing default-router or dns-server in the pool
Clients get addresses from the wrong subnet Helper on the wrong VLAN interface, or a rogue server (use DHCP snooping)

Exam trap

no service dhcp disables both the DHCP server and the relay function on IOS. A router with correct pools and helpers that does nothing at all for DHCP may simply have the service turned off.

The IOS DHCP client

interface GigabitEthernet0/0
 ip address dhcp

show dhcp lease shows the leased address, server, lease time and renewal timers. show ip interface brief shows DHCP in the Method column. A router can also install a default route from option 3 learned through DHCP.

IPv6 address assignment

graph TB
  RA["Router Advertisement from R1"] --> F{"Flags"}
  F -->|"A=1, M=0, O=0"| S1["SLAAC<br/>address from prefix<br/>DNS via RDNSS or nothing"]
  F -->|"A=1, O=1"| S2["Stateless DHCPv6<br/>address from SLAAC<br/>DNS and domain from DHCPv6"]
  F -->|"M=1"| S3["Stateful DHCPv6<br/>address and options from DHCPv6"]
  RA --> GW["Default gateway is ALWAYS the RA source<br/>link-local address"]
Mode Address from Options from Router interface config Server keeps bindings?
SLAAC RA prefix (A flag, /64 only) RA (RDNSS where supported) default No server
Stateless DHCPv6 SLAAC DHCPv6 Information-Request/Reply ipv6 nd other-config-flag No
Stateful DHCPv6 DHCPv6 Solicit/Advertise/Request/Reply DHCPv6 ipv6 nd managed-config-flag Yes, show ipv6 dhcp binding

DHCPv6 facts:

  • Clients use UDP 546, servers and relays UDP 547.
  • Clients send to the multicast address ff02::1:2 (All_DHCP_Relay_Agents_and_Servers).
  • Four-message exchange: Solicit, Advertise, Request, Reply. With rapid commit (both sides configured) it shortens to Solicit and Reply.
  • Clients are identified by a DUID, not by MAC address.
  • DHCPv6 does not hand out a default gateway. Hosts always learn it from RAs.

Exam trap

Hosts have DHCPv6 addresses but cannot leave the subnet. DHCPv6 is fine; the RA path is broken. Common causes are ipv6 unicast-routing missing on the router (without it, IOS does not send RAs), or ipv6 nd ra suppress all on the interface.

Exam trap

"show ipv6 dhcp binding is empty" is normal for stateless DHCPv6, because the server leases no addresses. If the design calls for stateful, the interface needs ipv6 nd managed-config-flag. If hosts still get both a SLAAC and a DHCPv6 address, add ipv6 nd prefix 2001:db8:10::/64 no-autoconfig to clear the A flag.

Configuration

ipv6 unicast-routing
ipv6 dhcp pool V6-INFO
 dns-server 2001:db8:100::53
 domain-name lab.example
!
interface GigabitEthernet2
 ipv6 address 2001:db8:10::1/64
 ipv6 nd other-config-flag
 ipv6 dhcp server V6-INFO


! R1, the relay on the client LAN
interface GigabitEthernet2
 ipv6 address 2001:db8:10::1/64
 ipv6 nd managed-config-flag
 ipv6 nd prefix 2001:db8:10::/64 no-autoconfig
 ipv6 dhcp relay destination 2001:db8:100::1
!
! R2, the server
ipv6 dhcp pool V6-BRANCH
 address prefix 2001:db8:10::/64
 dns-server 2001:db8:100::53
 domain-name lab.example
interface GigabitEthernet0/0
 ipv6 dhcp server V6-BRANCH
The server needs a route back to the relay. An interface is either a DHCPv6 server or a relay, not both.

interface GigabitEthernet0/0
 ipv6 enable
 ipv6 address autoconfig       ! SLAAC, and default route from RA
 ipv6 address dhcp             ! stateful DHCPv6

Verification

R1# show ipv6 dhcp interface GigabitEthernet2
GigabitEthernet2 is in relay mode
  Relay destinations:
    2001:DB8:100::1

R2# show ipv6 dhcp pool
DHCPv6 pool: V6-BRANCH
  Address allocation prefix: 2001:DB8:10::/64 valid 172800 preferred 86400 (2 in use, 0 conflicts)
  DNS server: 2001:DB8:100::53
  Domain name: lab.example
  Active clients: 2

R1# show ipv6 interface GigabitEthernet2 | include hosts
  Hosts use DHCP to obtain routable addresses.

show ipv6 interface is the quickest way to see what the RA tells hosts. Without the M flag it reads Hosts use stateless autoconfig for addresses.; with the O flag it adds that hosts use DHCP to obtain other configuration. debug ipv6 dhcp and debug ipv6 dhcp relay show the message exchange.

Lab: DHCPv4 relay and DHCPv6 stateless/stateful break/fix

Topology: module lab. HOST1 (IOSv as client) on R1 Gi2, R2 as server, OSPF running so R2 can reach 10.10.10.0/24 and R1 can reach R2 Lo0.

  1. On R2 configure the BRANCH-LAN pool above, with excluded addresses 10.10.10.1 to 10.10.10.20.
  2. On R1 Gi2 configure ip helper-address 10.255.255.2. On HOST1 configure ip address dhcp and verify with show dhcp lease and, on R2, show ip dhcp binding.
  3. Configure stateless DHCPv6 on R1 (tab 1). On HOST1 use ipv6 address autoconfig. Confirm the SLAAC address and that show ipv6 dhcp binding is empty.
  4. Change to stateful with relay (tab 2), with R2 as the server. On HOST1 add ipv6 address dhcp. Confirm the binding on R2.
  5. Save the baseline.
  6. Fault A. Move ip helper-address from Gi2 to Gi1. Release and renew on HOST1 (shutdown/no shutdown). Run debug ip dhcp server packet on R2: silence. Fix it.
  7. Fault B. On R2 change network to 10.10.11.0 255.255.255.0. Watch the debug on R2 report no pool for 10.10.10.1. Fix it.
  8. Fault C. On R2 change the excluded range to 10.10.10.1 10.10.10.254. The DISCOVER arrives, but there is no OFFER. Find it with show ip dhcp pool.
  9. Fault D. On R1 run no ipv6 unicast-routing. HOST1 keeps or gets an IPv6 address but loses its default route (show ipv6 route on HOST1). Restore it.
  10. Fault E. Remove ipv6 nd managed-config-flag on R1 Gi2. Clear the binding on R2 and bounce HOST1. Note that HOST1 no longer requests a stateful address.

Expected verification output (baseline):

HOST1# show dhcp lease
Temp IP addr: 10.10.10.21  for peer on Interface: GigabitEthernet0/0
Temp  sub net mask: 255.255.255.0
   DHCP Lease server: 10.255.255.2, state: 5 Bound
   DHCP transaction id: 1A2B
   Lease: 172800 secs,  Renewal: 86400 secs,  Rebind: 151200 secs
Temp default-gateway addr: 10.10.10.1

Quick check

Clients on VLAN 30 receive addresses from the VLAN 20 scope. Both SVIs are on the same switch. What is the most likely cause?

The server picks the pool by giaddr. If clients in VLAN 30 get VLAN 20 addresses, their broadcasts are being relayed with giaddr from the VLAN 20 SVI, which points to a cabling or VLAN assignment problem (the clients are really in VLAN 20), or a misconfigured pool whose network statement covers the wrong subnet. Check the access port VLAN and the pool definitions.

Which DHCPv6 mode leaves the server with no bindings, and what flag does the router set for it?

Stateless DHCPv6. The router sets the O flag (ipv6 nd other-config-flag). Hosts build their address with SLAAC and ask DHCPv6 only for options such as DNS.

A Catalyst access switch with DHCP snooping sits between clients and an IOS router acting as relay. After snooping was enabled, clients stopped getting addresses. What happened?

The switch inserts option 82 with giaddr 0.0.0.0, and the router drops such packets on an untrusted interface. Configure ip dhcp relay information trusted on the router interface (or trust-all), or no ip dhcp snooping information option on the switch.

References