Forwarding a DHCP Request using Cisco ip helper-address command

DHCP, as we all know, is a broadcast protocol (shame on you if you don’t know that already :) !!) which normally works only on the same Layer 2 broadcast domain. Does this mean that you need to have your DHCP Server connected to the same network subnet as the DHCP clients? If this was the case it would not be flexible or economical at all. What if you have segmented your internal network into many different subnets and you have DHCP clients in all those subnets. Would this mean that you must have a DHCP server for every subnet? Fortunately, you don’t need to have this situation. With the Cisco “ip helper-address” command configured on the Layer3 interface which receives the client’s DHCP broadcast, you can transform the broadcast request into a unicast and send it to a centralized DHCP server which can be located to a different subnet in your network. The unicast DHCP request will be routed normally to the destination DHCP Server within the network, even if the server is far away from the DHCP client.

The DHCP server must have an appropriate IP Pool scope configured for the specific subnet from where the DHCP request came. Using this IP scope, the server will assign an appropriate IP address to the requesting client. For example, if the DHCP client subnet is, then the remote DHCP server must have an IP Pool configured to assign addresses within the range The source DHCP client subnet is determined by the IP address assigned to the Layer3 interface which has the ip helper-address configured.

Let’s see an example scenario below with a configuration snapshot.

From the network diagram above, two DHCP client PCs are located behind Router A. Interface Fe0/0 of the router has IP address The DHCP clients will start broadcasting DHCP requests in order to get their IP address information assigned from a server. By default, these DHCP broadcast requests will be confined within Switch A and will never reach any other subnet beyond Router A. By configuring an “ip helper-address” under interface Fe0/0 of Router A, we tell the router to turn the DHCP broadcast into a DHCP unicast and send it to destination DHCP server The server will see that the DHCP request came from source subnet and will therefore assign an appropriate IP address from a configured IP pool scope within the range

Configuration on Router A

RouterA# conf t
RouterA(config)# interface fastethernet0/0
RouterA(config-if)# ip address
RouterA(config-if)# ip helper-address

Some other important considerations for ip helper-address

By default, the ip helper-address command forwards also some other broadcast protocols in addition to the DHCP (BOOTP) protocol. It forwards by default the following eight UDP broadcast protocols:

  • UDP 37 (Time protocol)
  • UDP 49 (TACACS)
  • UDP 53 (DNS)
  • UDP 67 (DHCP Server)
  • UDP 68 (DHCP Client)
  • UDP 69 (TFTP)
  • UDP 137 (NetBios)
  • UDP 138 (NetBios Datagram service)

If you want to add more broadcast protocols to be forwarded, or even remove some of the default forwarded protocols, you can use the “ip forward-protocol” command under global config mode.

Example: Remove the NetBios protocols (137,138) from being forwarded by default, and add NTP protocol 123 to be forwarded by ip helper-address.

RouterA(config)# no ip forward-protocol udp 137
RouterA(config)# no ip forward-protocol udp 138
RouterA(config)# ip forward-protocol udp 123


  1. AHP says

    That was really cool.
    Can give us some nice network Diagram in GNS3
    that will DEFINETLY turn your blog into a one in kind one.
    By the way i can help you if you want.


  2. closetfan says

    great post man!
    very very informative…
    I like your approach in teaching this concept ’cause it really adjust to the level of knowledge towards your readers…

    Thanks… :)

  3. Marcus Heath says

    Great Post! I’m studying for the CCNA and have been unable to find information so detailed in books, I love this it really cleared up a gray area frome, thanks!

  4. Blog Admin says

    Hi Marcus,

    Thanks for stopping by and commenting on my blog. I’m happy you liked my tutorial.

    Best Regards


  5. Sean Smith says

    Hi :)

    So I have configured my 871W and it is not forwarding the DHCP requests to the server, or if it is the debugs are not showing it. I get connected to the wireless no problem, but it is not wanting to get an IP. I have put the IP HELPER address under the BVI and the VLAN, but without success. Under the ethernet connection though it doesnt have that commend.

    Can you give me an idea where I am going wrong?

    Thanks and have a great day!


  6. Blog Admin says

    Hi Sean,

    So, as I understand you want to get IP addresses dynamically via external DHCP on the wireless interface? Hmmm, I have never tried that before but I assume that you need to put the ip helper address command on the wireless interface (put it both on BVI and on the physical dot11radio interface). Also, you must have a static IP address configured on the BVI interface. If you configured a static IP on BVI as, then you must create a DHCP scope on the DHCP server to assign addresses within the range / 24

  7. Felix says

    Hi There,

    i have major problems with my VLAN installation at work, hence, i googled and i must say i m very lucky to have come across your blog as it is very informative.

    my situation is inter-vlan routing, whereby i have a router and 8×2960 catalysts and 1xDHCP server. the server is configured with three DHCP scopes,,,
    The router ‘s fa0/0 is configured with subinterfaces and ip helper-address, interface FastEthernet0/0.1
    encapsulation dot1Q 1 native
    ip address
    no snmp trap link-status
    no cdp enable
    interface FastEthernet0/0.2
    encapsulation dot1Q 2
    ip address
    ip helper-address
    ip helper-address
    no snmp trap link-status
    no cdp enable
    interface FastEthernet0/0.3
    encapsulation dot1Q 3
    ip address
    ip helper-address
    ip helper-address
    no snmp trap link-status

    the switches are per floor, three floors are in vlan 2 and while vlan 3 is occupied by three floors also, while the native vlan is for the server farm only.
    the problem is only the switch directly connected to the router on vlan 2 is working, the rest would not work on vlan 2 or 3 but they would work on the native vlan. please help, i wish i could draw you the logocal diagram

  8. Blog Admin says


    You must have trunk ports between switches. The best topology is “Star”. You need to have one central switch and then all the rest switches should be connected with “trunk” ports on the central switch. Then you must connect the router again on a trunk port on the central switch. Also, you must remember to create all layer2 vlans (2 and 3) on each of the switches.

  9. Felix says

    ok, thanks. that wa prompt. the star topologu makes quiet a lot of sense with a central switch. but it is somewhat to implement it as i now have to pull a cable all the way from ground flr to 3rd flr (data center where router and central switch will be). right now what i have is switches interconnected, like, the second flr switch have two trunk ports, one to the 1st flr and one to the 3rd flr. please shed more light on creating all layer2 vlans (2 and 3) on each of the switches?

    i was thining maybe i need to tag the trunk ports but the command is not being taken.

  10. Blog Admin says

    The way you describe it will still work. You just need to have all ports connecting the switches to be trunk ports:

    ciscoswitch(config-if)# switchport mode trunk
    ciscoswitch(config-if)# switchport trunk encapsulation dot1q

    Also, to create the vlans on the switches, the commands are:

    switch(config)# vlan 2
    switch(config)# vlan 3

  11. Felix says

    all the ports are trunk ports and i guess why it is not working is because i have left out the tagging command on the trunk ports,ciscoswitch(config-if)# switchport trunk encapsulation dot1q; i am now trying to add it to all trunk ports but its not being taken. my switch is a ws-2960-24tt-l with a lanbase IOS.

    all access ports are already in their defined vlans and i created it by using
    interface range FastEthernet0/1 – 24
    description Link to PC
    switchport access vlan 2
    switchport mode access
    switchport voice vlan 101
    spanning-tree portfast


    interface range FastEthernet0/1 – 24
    description Link to PC
    switchport access vlan 3
    switchport mode access
    switchport voice vlan 101
    spanning-tree portfast

    interface range FastEthernet0/1 – 24
    description Link to PC
    switchport access vlan 1
    switchport mode access
    switchport voice vlan 101
    spanning-tree portfast

  12. Felix says

    as it stands now start config on the trunk is !
    interface GigabitEthernet0/1
    description Link to RA-SERVERFARM-S01
    switchport mode trunk
    speed 1000
    duplex full

    now, when i try to add the tagging config, this is what i get.

    !RA-HQ4FLR-S01(config-if)#switchport trunk encapsulation dot1q
    % Invalid input detected at ‘^’ marker.


  13. Blog Admin says

    For the 2960 the default trunk protocol is dot1q, so you do not need to put the “switchport trunk encapsulation dot1q” command.
    So the way you have it is correct now.

  14. Felix says

    but there is no traffic on the trunk link between the two switches (one switch configured with vlan 1 and the other with vlan 2) but there is traffic when both switches are in vlan 1

  15. Felix says

    Ok, thanks a lot, i d just thought the config below was enough:i will create the vlans now. thanks once again

    interface range FastEthernet0/1 – 24
    description Link to PC
    switchport access vlan 2
    switchport mode access
    switchport voice vlan 101
    spanning-tree portfast

  16. Aedu says

    Great article

    I guess the DHCP-Server does not recognize the relay agent and answers with a broadcast?
    What makes the relay agent forward the answer of the DHCP server (DHCPOFFER, DHCPACK) to its subnet ( Must the src-ip address in the ip header or the in option 54 (DHCP server identifier) match? or both?


    P.s. Please excuse my english. I’m not a native speaker… 😉

  17. Aedu says

    > I guess the DHCP-Server does not recognize the relay agent and answers with a broadcast?
    Makes no sense. The DHCP-Server must reply by unicast. BUT STILL What makes the Relay Agent forward packages back to the source network?


  18. sashikanth says

    Hi Admin,
    Excellent Blog for biggners. my question is i don’t have ASA. i have Forefront firewall and cisco 3560 L3 switch. i am able to communicate between the vlans but not to internet through ASA firewall.
    how do i communicate to internet through Forefront TMG

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>