25 DHCP, DNS and NTP · CCNA

Exam topics covered

4.2 Configure and verify NTP operating in a client and server mode

4.3 Explain the role of DHCP and DNS within the network

4.6 Configure and verify DHCP client and relay

Foundation. Three small services quietly hold every network together. DHCP hands each host the IP settings it needs to communicate at all; DNS turns the names people type into the addresses packets need; and NTP keeps every clock in agreement so that logs, certificates and authentication make sense. None of them carries user data, yet if any one fails, users notice within minutes. In this chapter you will follow the DHCP conversation message by message, configure a Cisco router as a DHCP server, relay agent and client, trace a DNS lookup, and build an NTP hierarchy in which a router is both client and server. All CLI output is illustrative of Cisco IOS 15 and IOS XE; spacing and a few fields vary by release.

25.1 DHCP Concepts

Before a host can send a packet beyond its own link it needs an IP address, a subnet mask, a default gateway and at least one DNS server. Typing these into every laptop, phone and printer does not scale, invites duplicate addresses and breaks when a laptop moves to another subnet. The Dynamic Host Configuration Protocol (DHCP), RFC 2131, automates the job. A server owns a pool of addresses for each subnet and leases them for a limited time, together with options such as the gateway (option 3), DNS servers (option 6), domain name (option 15) or a TFTP server for IP phones (option 150).

DHCP inherited its transport from BOOTP: UDP port 67 on the server and UDP port 68 on the client. A client with no address cannot be reached by unicast, so the first messages are broadcasts. That one fact explains most of what follows, including why routers need a relay feature.

25.1.1 The DORA exchange

A client obtains its first lease with four messages, remembered as DORA: Discover, Offer, Request, Acknowledge (Figure 25-1).

DHCP client DHCP server R1 (.1)

1 DHCPDISCOVER "Is there a DHCP server out there?"

src 0.0.0.0:68 → dst 255.255.255.255:67 (broadcast) · carries client MAC (chaddr) 2 DHCPOFFER "You can have 192.168.10.11/24"

src 192.168.10.1:67 → dst broadcast or 192.168.10.11:68 · mask, gateway, DNS, lease 3 DHCPREQUEST "I accept the offer from 192.168.10.1"

src 0.0.0.0:68 → dst 255.255.255.255:67 (broadcast) · names the chosen server 4 DHCPACK "Confirmed: 192.168.10.11 is yours"

src 192.168.10.1:67 → dst broadcast or 192.168.10.11:68 · lease begins Client now bound Binding added to table

Figure 25-1 The DORA exchange. Messages to the server go to UDP 67; messages to the client go to UDP 68.

1. DHCPDISCOVER. Broadcast from 0.0.0.0 to 255.255.255.255 (MAC ffff.ffff.ffff). The client MAC rides inside the payload (chaddr), and a random transaction ID ties replies to the request.
2. DHCPOFFER. Each server that hears the Discover reserves an address and offers it with mask, lease time and options. A Cisco IOS server first pings the candidate address (two echoes by default) to make sure it is free. The Offer is broadcast if the client set the broadcast flag, otherwise it may be unicast.
3. DHCPREQUEST. The client accepts one offer by broadcasting a Request that names the chosen server (option 54), so any other server can release its reservation.
4. DHCPACK. The chosen server records the binding and confirms. Many clients then send a gratuitous ARP to detect a duplicate address.

A lease is not permanent. At T1 (50 percent of the lease) the client unicasts a Request straight to its server to renew; at T2 (87.5 percent) it broadcasts a Request to any server (rebinding). If the lease expires, it must stop using the address and start over with a Discover. Table 25-1 lists the other messages you should recognize.

Table 25-1 DHCP message types

Message Sent by Purpose

Discover /

Offer

Client /

Server

Locate servers; offer an address and options.

REQUEST / ACK Client /

Server

Accept an offer (or renew); confirm the lease.

DHCPNAK Server Refuse a Request, for example for an address from the wrong subnet after the client moved.

DHCPDECLINE Client Report that the offered address is already in use.

DHCPRELEASE Client Return the address early ( ipconfig /release ).

DHCPINFORM Client Ask for options only; the client already has a static address.

Exam alert

Remember the ports by direction: anything sent to the server uses UDP 67; anything sent to the client uses UDP 68. During initial leasing the client broadcasts both Discover and Request.

25.2 Configuring a Cisco IOS DHCP Server

Large networks usually run DHCP on dedicated servers or the wireless controller, but any IOS router or Layer 3 switch can serve DHCP, which suits branch offices. Figure 25-2 shows the topology used throughout this chapter.

Isp

Figure 25-2 Chapter topology. R1 serves both LANs, R2 relays for LAN20, and R1 is itself a DHCP client of the ISP.

Configuration takes three steps: exclude addresses that must never be leased (gateways, servers, printers), create a pool per subnet, and give each pool its network and options.

R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.10 ! global, not in the pool
R1(config)# ip dhcp excluded-address 192.168.20.1 192.168.20.10
R1(config)# ip dhcp pool LAN10
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1 ! option 3
R1(dhcp-config)# dns-server 192.168.1.53 8.8.8.8 ! option 6
R1(dhcp-config)# domain-name example.com ! option 15
R1(dhcp-config)# lease 2 12 ! days hours [minutes]; default 1 day
R1(config)# ip dhcp pool LAN20
R1(dhcp-config)# network 192.168.20.0 /24
R1(dhcp-config)# default-router 192.168.20.1
R1(dhcp-config)# dns-server 192.168.1.53
R1(dhcp-config)# option 150 ip 192.168.1.20 ! TFTP server for IP phones

The DHCP service is on by default ( no service dhcp disables both server and relay). For a directly connected client, R1 chooses the pool whose network matches the receiving interface's subnet; for a relayed request it uses the pool containing the relay's giaddr (Section 25.3). Three commands verify the server. show ip dhcp pool shows size and utilization; show ip dhcp binding lists each lease, where the client ID is 01 (Ethernet) plus the MAC address and Automatic means the address came from the pool.

R1 — console

R1# show ip dhcp pool LAN10

R1# show ip dhcp binding

Bindings from all pools not associated with VRF:
IP address Client-ID/ Lease expiration Type
Hardware address/
User name

192.168.10.11 0100.5079.6668.01 Oct 06 2026 09:14 PM Automatic 192.168.10.12 0150.5079.6668.02 Oct 06 2026 09:20 PM Automatic 192.168.10.13 01a4.4c11.27b0.5e Oct 06 2026 10:02 PM Automatic 192.168.20.11 0100.1b54.c2a1.10 Oct 06 2026 09:31 PM Automatic

Figure 25-3 Pool utilization and the binding table. The LAN20 lease arrived through R2's relay.

If the pre-offer ping or a client's DHCPDECLINE reveals an address already in use, the server records a conflict and withholds that address until you clear it (Figure 25-4). Fix the cause, typically a statically addressed device inside the pool range, add an exclusion, then run clear ip dhcp conflict * .

R1# show ip dhcp conflict

IP address Detection method Detection time VRF
192.168.10.14 Ping Oct 04 2026 08:02 AM
192.168.20.15 Gratuitous ARP Oct 04 2026 08:41 AM

Figure 25-4 Two addresses removed from service because another device already uses them.

25.3 DHCP Relay with ip helper-address

Routers do not forward broadcasts, so a Discover from LAN20 stops at R2. Rather than put a server on every subnet, you enable R2 as a DHCP relay agent with ip helper-address on the interface that receives the client broadcasts, the LAN-facing interface:

R2(config)# interface GigabitEthernet0/1
R2(config-if)# ip address 192.168.20.1 255.255.255.0
R2(config-if)# ip helper-address 10.0.12.1 ! the DHCP server's address

R2 turns the broadcast into a unicast addressed to the helper and writes the address of the receiving interface, 192.168.20.1, into the giaddr field. The server uses giaddr to choose the pool and as the destination of its replies, which R2 then delivers onto LAN20 (Figure 25-5). R1 therefore needs a route back to 192.168.20.0/24; a missing return route is the most common relay failure.

Udp 68 → 67

giaddr 0.0.0.0
Relayed DISCOVER on the WAN
Unicast, routed like any packet
Src IP 10.0.12.2 Dst IP 10.0.12.1

Udp 67 → 67

giaddr 192.168.20.1 → selects pool LAN20

R2 delivers Offer/Ack onto LAN20 Offer/Ack unicast back to giaddr

Figure 25-5 The relay converts the client broadcast into a unicast and stamps giaddr with the receiving interface address.

Verify with show ip interface g0/1 | include Helper , which prints Helper address is 10.0.12.1 . You may configure several helpers for redundancy; each receives a copy. Note that a helper forwards eight UDP broadcast services by default, not only DHCP: TFTP (69), DNS (53), Time (37), NetBIOS (137, 138), TACACS (49) and BOOTP/DHCP (67, 68). The global ip forward-protocol udp command changes the list.

Watch for a helper address on the wrong interface. It belongs on the interface where the clients are, and it points to the server. That interface's address becomes giaddr, which selects the pool.

25.4 A Router as a DHCP Client

Branch routers often get their Internet-facing address from the ISP by DHCP. One interface command does it: ip address dhcp . Besides the address the router learns the gateway (option

3) and installs a default route with administrative distance 254, so any manually configured default route wins. Figure 25-6 verifies it; note the method DHCP and the [254/0] route.

R1 — console

R1(config)# interface GigabitEthernet0/2
R1(config-if)# ip address dhcp
R1(config-if)# no shutdown

%DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet0/2 assigned DHCP address 203.0.113.45, mask 255.255.255.0, hostname R1

R1# show ip interface brief | include 0/2

GigabitEthernet0/2 203.0.113.45 YES DHCP up up

R1# show dhcp lease

Temp IP addr: 203.0.113.45 for peer on Interface: GigabitEthernet0/2 Temp sub net mask: 255.255.255.0

DHCP Lease server: 203.0.113.1, state: 5 Bound
Lease: 86400 secs, Renewal: 43200 secs, Rebind: 75600 secs
Temp default-gateway addr: 203.0.113.1

R1# show ip route | include 0.0.0.0/0

S* 0.0.0.0/0 [254/0] via 203.0.113.1

Figure 25-6 R1 as a DHCP client: leased address, renewal (T1) and rebind (T2) timers, and the learned default route.

On end hosts, the exam expects you to know the Windows commands: ipconfig /all shows the lease, ipconfig /release sends a DHCPRELEASE and ipconfig /renew starts a new exchange (Figure 25-7). On Linux use ip addr and dhclient -r / dhclient ; on macOS ipconfig getpacket en0 . A 169.254.x.x (APIPA) address means the client sent Discovers and heard no Offer.

Command Prompt — PC1

C:\> ipconfig /release
C:\> ipconfig /renew
C:\> ipconfig /all

Ethernet adapter Ethernet0:
Connection-specific DNS Suffix . : example.com
Physical Address. . . . . . . . . : 00-50-79-66-68-01
DHCP Enabled. . . . . . . . . . . : Yes
IPv4 Address. . . . . . . . . . . : 192.168.10.11(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0

Lease Obtained. . . . . . . . . . : Sunday, October 4, 2026 9:14:02 AM Lease Expires . . . . . . . . . . : Tuesday, October 6, 2026 9:14:02 PM Default Gateway . . . . . . . . . : 192.168.10.1

DHCP Server . . . . . . . . . . . : 192.168.10.1
DNS Servers . . . . . . . . . . . : 192.168.1.53
8.8.8.8

Figure 25-7 Releasing, renewing and inspecting a lease on Windows. The 2.5-day lease matches lease 2 12 .

25.5 The Domain Name System

DNS is the distributed, hierarchical database that maps names to addresses. Almost every user connection begins with a DNS query, so a slow or broken DNS server makes the whole network feel broken even when routing is perfect. DNS uses UDP port 53 for ordinary queries and TCP port 53 for zone transfers and large responses.

The namespace is a tree: the root (.), then top-level domains such as .com and .ca, then registered domains such as example.com, each served by its own authoritative servers. A client sends one recursive query to the resolver it learned from DHCP option 6. The resolver walks the tree with iterative queries and caches each answer for its time-to-live (TTL), as

Figure 25-8 shows.

cached answer immediately.

Figure 25-8 Resolving www.example.com: one recursive query from the client, iterative queries from the resolver.

Hosts also cache answers ( ipconfig /displaydns , ipconfig /flushdns ) and check a local hosts file first. nslookup name tests resolution and reports which server answered and whether the answer was authoritative.

Table 25-2 Common DNS resource records

Record Maps Example

A / AAAA Name to IPv4 / IPv6 address www.example.com → 198.51.100.80 / 2001:db8::80

CNAME Alias to canonical name ftp.example.com → www.example.com MX Domain to mail server, with preference example.com → 10 mail.example.com NS Zone to its authoritative servers example.com → ns1.example.com PTR Address to name (reverse lookup) 80.100.51.198.in-addr.arpa → www.example.com

Soa /

Txt

Zone serial and timers / free text (SPF,
verification)
One SOA per zone
25.5.1 DNS settings on Cisco IOS

A router uses DNS for names typed at the CLI, such as ping www.example.com . ip domain-lookup enables resolution and is on by default. Without an ip name-server the router broadcasts queries, which is why a mistyped exec command makes it hang "Translating..." the typo as a host name; lab routers therefore often use no ip domain-lookup . The domain name is appended to unqualified names and is also needed for SSH keys (Chapter 26), and ip host builds a static local table.

R1(config)# ip domain-lookup ! default
R1(config)# ip name-server 192.168.1.53 8.8.8.8 ! up to six servers
R1(config)# ip domain name example.com ! older IOS: ip domain-name
R1(config)# ip host R2 10.0.12.2 ! static entry, no DNS needed

R1 — console

R1# ping www.example.com

Translating "www.example.com"...domain server (192.168.1.53) [OK] Sending 5, 100-byte ICMP Echos to 198.51.100.80, timeout is 2 seconds:

!!!!!

R1# show hosts

Default domain is example.com
Name/address lookup uses domain service
Name servers are 192.168.1.53, 8.8.8.8
Host Port Flags Age Type Address(es)
R2 None (perm, OK) 0 IP 10.0.12.2
www.example.com None (temp, OK) 0 IP 198.51.100.80

Figure 25-9 The ip host entry is permanent; the DNS answer is cached as temporary.

ip name-server points to DNS servers, ip domain-lookup turns resolution on or off, ip domain name sets the suffix, ip host adds static entries. Inside a DHCP pool the command is dns-server .

25.6 Network Time Protocol

Accurate time matters because so much depends on time stamps. Syslog messages from twenty devices are useless if their clocks disagree; certificates used by HTTPS, VPNs and 802.1X have validity periods; Kerberos and time-based ACLs need correct clocks. Device clocks drift, and many reset at boot. NTP (version 4, RFC 5905, compatible with v3) keeps clocks within milliseconds of each other using UDP port 123, and always carries UTC.

25.6.1 Strata

NTP sources are ranked by stratum. A reference clock such as GPS or an atomic clock is stratum 0; a server attached to it is stratum 1; each synchronization hop adds one (Figure 25- 10). Lower is better, and stratum 16 means unsynchronized: no device will synchronize to it.

GPS / atomic clock
time server A time server B
pool.ntp.org server core router
peer

Each device is one stratum higher than the source it synchronizes to Stratum 0

Figure 25-10 The NTP stratum hierarchy.

25.6.2 Client, server, master and peer modes

Client mode: ntp server ip [prefer] makes the device poll that server and synchronize to it. List several servers; NTP picks the best.

Server mode: once synchronized, a Cisco device automatically answers NTP requests, so a client of an upstream server is at the same time a server to downstream devices. Master: ntp master [stratum] serves the device's own clock as authoritative with no upstream source; default stratum 8. Use it in labs and isolated networks.

Symmetric active (peer): ntp peer ip lets two devices synchronize each other, so either can supply time if the other loses its source.

In our topology R1 is the lab time source, R2 is a client of R1, and SW2 (managed at 192.168.20.5) is a client of R2. NTP converts UTC to local time with the time zone commands, which do not affect synchronization. clock set (exec mode) sets time by hand, but NTP overrides it.

R1(config)# ntp master 3 ! production: ntp server <public or internal
source>
R2(config)# clock timezone EST -5 0
R2(config)# clock summer-time EDT recurring ! US rules: 2nd Sun Mar to 1st Sun Nov
R2(config)# ntp server 10.0.12.1 prefer ! client of R1, server to others
R2(config)# ntp source GigabitEthernet0/0 ! optional fixed source address
SW2(config)# ntp server 192.168.20.1
SW2(config)# ntp update-calendar ! keep the hardware clock in step

25.6.3 Verifying NTP

In show ntp associations the * marks the system peer the device is synchronized to ( ~ means configured), and a reach of 377 (octal) means the last eight polls all succeeded. show ntp status confirms Clock is synchronized and the device's own stratum, one more than its source. show clock detail names the time source; a leading * on the time means it is not authoritative.

R2 — console

R2# show ntp associations

address ref clock st when poll reach delay offset disp

*~10.0.12.1 127.127.1.1 3 27 64 377 1.012 -0.215 0.950

* sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured

R2# show ntp status

Clock is synchronized, stratum 4, reference is 10.0.12.1

nominal freq is 250.0000 Hz, actual freq is 250.0002 Hz, precision is 2**10 reference time is EAA0C1E3.1A2B3C4D (13:14:27.102 UTC Sun Oct 4 2026)

clock offset is -0.2150 msec, root delay is 2.04 msec

root dispersion is 7.71 msec, peer dispersion is 0.95 msec

system poll interval is 64, last update was 27 sec ago.

R2# show clock detail

09:15:02.517 EDT Sun Oct 4 2026
Time source is NTP
Summer time starts 02:00:00 EST Sun Mar 8 2026
Summer time ends 02:00:00 EDT Sun Nov 1 2026

Figure 25-11 R2 synchronized to R1. The reference clock 127.127.1.1 is the signature of ntp master ; R2 is stratum 4 and displays local EDT time.

NTP authentication stops an attacker feeding false time. Configure the same key on server and client; the client trusts the key and ties it to the server:

(config)# ntp authenticate ! on R1 and R2
(config)# ntp authentication-key 1 md5 Ntp$ecret
(config)# ntp trusted-key 1
R2(config)# ntp server 10.0.12.1 key 1 ! client only

Exam alert

ntp server = client mode, and a synchronized client also serves time. Its stratum is the server's plus one. ntp master defaults to stratum 8. In show ntp associations , * marks the source in use. If reach stays at 0, check UDP 123 reachability and ACLs.

LAB DHCP Server, Relay and NTP Across Two Routers

Goal: R1 serves addresses to its own LAN and, through a relay on R2, to LAN20. R1 is the time source; R2 synchronizes to R1 and serves SW2.

Figure 25-12 Lab topology.

Steps:

1. Address the interfaces as shown. Add static routes: on R1 ip route 192.168.20.0 255.255.255.0 10.0.12.2 ; on R2 ip route 192.168.10.0 255.255.255.0 10.0.12.1 .
2. On R1, exclude .1–.10 in both LANs and create pools LAN10 and LAN20 as in Section 25.2.
3. On R2 G0/1, enter ip helper-address 10.0.12.1 . Set both PCs to DHCP and run ipconfig /renew .
4. On R1 enter ntp master 3 ; on R2 ntp server 10.0.12.1 . Give SW2 interface vlan 1 address 192.168.20.5/24, ip default-gateway 192.168.20.1 and ntp server 192.168.20.1 .

Lab verification

R1# show ip dhcp binding | include 192.168

192.168.10.11 0100.5079.6668.01 Oct 06 2026 09:14 PM Automatic 192.168.20.11 0100.5079.6668.02 Oct 06 2026 09:16 PM Automatic

SW2# show ntp status | include Clock

Clock is synchronized, stratum 5, reference is 192.168.20.1

Figure 25-13 Expected results: one binding per LAN; SW2 synchronized at stratum 5.

Expected results: each PC receives .11 in its LAN with the correct gateway; R2 reaches stratum 4 and SW2 stratum 5 within a few minutes. If PC2 gets 169.254.x.x, check the helper and R1's route to 192.168.20.0/24. Remove the helper and renew to see the failure.

Chapter review

Key terms

Dhcp

Dora

Dhcpdiscover

Dhcpoffer

Dhcprequest

Dhcpack

Apipa

resolver
recursive query
authoritative server
A / AAAA record

Ntp

stratum
ntp master
system peer
Review questions

1. Which destination UDP port does a DHCPDISCOVER use?

A. 53
B. 67
C. 68
D. 123

2. Which two DHCP messages does a client broadcast during initial address assignment? (Choose two.)

A. DHCPDISCOVER
B. DHCPOFFER
C. DHCPREQUEST
D. DHCPACK
E. DHCPRELEASE

3. PCs on 192.168.30.0/24 (gateway R2 G0/1) cannot reach the DHCP server 10.5.5.5. Where should ip helper-address 10.5.5.5 be configured?

A. On the server's switch port
B. On R2 G0/1
C. On R2's interface facing the server
D. In R2 global configuration

4. How does a DHCP server choose the pool for a relayed request?

A. Client MAC address
B. Source IP of the relayed packet
C. The giaddr field
D. Option 54

5. What is the effect of ip dhcp excluded-address 10.1.1.1 10.1.1.20 ?

A. Only those addresses are leased
B. Those addresses are never leased
C. They are reserved for manual bindings
D. Hosts using them are blocked

6. What administrative distance does a default route learned with ip address dhcp have?

A. 1
B. 5
C. 120
D. 254

7. Which command shows addresses a Cisco DHCP server found already in use?

A. show ip dhcp binding
B. show ip dhcp conflict
C. show ip dhcp pool
D. show dhcp lease

8. Which two statements about DNS are true? (Choose two.)

A. Normal queries use UDP 53
B. AAAA maps a name to an IPv4 address
C. PTR records support reverse lookups
D. Clients send iterative queries to root servers
E. Zone transfers use TCP 67

9. A router hangs "Translating..." after every mistyped command. Which command stops this?

A. no ip name-server
B. no ip domain-lookup
C. no ip host
D. no service dhcp

10. R3 has ntp server 10.1.1.1 , and 10.1.1.1 is stratum 2. What is R3's stratum once synchronized?

A. 1
B. 2
C. 3
D. 16

11. Which two statements about NTP on Cisco IOS are true? (Choose two.)

A. ntp master with no value uses stratum 8
B. An NTP client cannot serve time to others
C. NTP uses UDP 123
D. NTP carries local time with the time zone
E. ntp peer configures client mode

12. What does "Time source is NTP" in show clock detail confirm?

A. The clock was set with clock set
B. The device is NTP master
C. The clock is synchronized by NTP
D. The hardware calendar is set

13. Which pool command gives DHCP clients their default gateway?

A. ip default-gateway
B. default-router
C. gateway
D. ip route 0.0.0.0 0.0.0.0

Answers

1. B. Messages to the server go to UDP 67; clients listen on 68. 53 is DNS, 123 is NTP.
2. A, C. The client has no address, so it broadcasts Discover and Request. Release is unicast.
3. B. The helper goes on the interface that receives client broadcasts.
4. C. giaddr holds the relay's receiving interface address; the pool containing it is used.
5. B. Exclusions are global and apply to every pool.
6. D. AD 254 lets a manually configured static default route take priority.
7. B. Ping and gratuitous-ARP conflicts appear in show ip dhcp conflict .
8. A, C. AAAA is IPv6; clients send a recursive query to their resolver; transfers use TCP 53.
9. B. Disabling lookup stops typos being resolved as host names.
10. C. Each hop adds one: 2 + 1 = 3.
11. A, C. Synchronized clients do serve time, NTP carries UTC, and ntp peer is symmetric mode.
12. C. clock set would show "user configuration".
13. B. default-router supplies option 3; ip default-gateway is for a switch's own management traffic.