DHCP Reservations Explained: Scopes, Options and Relay for Network+

A DHCP reservation ties a specific IP address to a specific MAC address, so that client always receives the same address from the DHCP server. It is the middle ground between dynamic assignment and manual static configuration, and the exam tests why you would choose it.

Reservation, static, exclusion

Three related things that are easy to confuse.

Reservation — configured on the DHCP server. The client still uses DHCP and receives the same address every time, along with all the other scope options.

Static assignment — configured on the client itself. The client does not use DHCP at all.

Exclusion — a range within the scope the server will never hand out, usually set aside for statically configured devices.

The argument for reservations over static configuration is centralised management. Change the DNS servers or the gateway and every reserved client picks it up at renewal; statically configured devices have to be visited individually. That is the answer an exam question is usually after.

Use reservations for printers, access points, cameras, servers that must be reachable at a known address, and anything referenced by IP in firewall rules.

The classic misconfiguration: creating a reservation for an address inside the dynamic pool without excluding it, so the server may lease it to another client before the reserved device asks. Reserve from outside the dynamic range, or add an exclusion.

DORA

The four-step process, always examined.

Discover — the client broadcasts, having no address.
Offer — a server offers an address and parameters.
Request — the client broadcasts acceptance of one offer, which also tells other servers their offers were declined.
Acknowledge — the server confirms and records the lease.

DHCP uses UDP 67 on the server and UDP 68 on the client. Note that the client's Request is broadcast, not unicast — that is how a second DHCP server learns its offer was not taken.

Scope options

An address alone is not enough. Options carry the rest of the configuration, and these numbers occasionally appear directly.

Option 1 subnet mask, option 3 default gateway, option 6 DNS servers, option 15 domain name, option 42 NTP servers, option 43 vendor-specific (used for wireless controller discovery), option 51 lease time, option 66 TFTP server name and option 150 TFTP server address (used by IP phones for provisioning).

Options 66 and 150 are worth remembering because they are how VoIP phones find their configuration server, and a phone that gets an address but never registers is usually missing one of them.

Leases

A lease has a duration, and the client attempts renewal at 50% of it (T1) directly with the issuing server, then at 87.5% (T2) by broadcasting to any server.

Lease length is a real design decision. Short leases suit environments with high turnover such as guest Wi-Fi, at the cost of more DHCP traffic. Long leases suit stable offices and can exhaust a pool when many transient devices hold addresses they are no longer using.

DHCP relay

DHCP Discover is a broadcast, and routers do not forward broadcasts. So a client on a subnet with no local DHCP server gets nothing — unless a relay agent is configured.

A DHCP relay (IP helper) on the router receives the broadcast and forwards it as a unicast to the DHCP server, inserting the subnet information so the server knows which scope to use. This is why one central DHCP server can serve dozens of VLANs.

If a scenario says clients on one VLAN get addresses and clients on another do not, a missing helper address is the most likely cause.

The security side

DHCP has no authentication, which creates two attacks the exam covers.

A rogue DHCP server, malicious or simply a home router plugged in by an employee, hands out addresses with its own gateway, putting itself in the traffic path. DHCP starvation floods requests with spoofed MAC addresses to exhaust the pool, often as a prelude to standing up a rogue server.

DHCP snooping is the defence. The switch classifies ports as trusted or untrusted and drops server-originated messages arriving on untrusted ports, so only the real server can offer addresses. It also builds a binding table of IP-to-MAC-to-port, which dynamic ARP inspection and IP source guard then use to block ARP spoofing and address spoofing.

That chain — snooping builds the table, DAI and IP source guard consume it — is worth knowing as a set.

Troubleshooting

A client with a 169.254 APIPA address did not reach a DHCP server: check physical connectivity, the VLAN, the helper address, and whether the scope is exhausted. Duplicate address conflicts usually mean a static address inside the dynamic pool with no exclusion. A reserved device getting the wrong address usually means the MAC in the reservation is wrong, or it is presenting a randomised MAC — which modern phones do by default and which quietly breaks reservations.

What to remember

A reservation is server-side and keeps the client on DHCP, so scope options stay centrally managed; a static address is client-side and does not. Reserve outside the dynamic pool or add an exclusion. DORA over UDP 67 and 68, with renewal at 50% of the lease. Relay agents carry DHCP across routed boundaries. DHCP snooping stops rogue servers and feeds dynamic ARP inspection.

Related reading: DHCP and how it works · APIPA · RFC 1918 private ranges