All About the “ip helper-address” Command on Cisco – Configuration and Explanation

In the world of networking, managing and configuring devices to work efficiently across complex networks is crucial for administrators. One useful and important feature in Cisco networking devices (primarily Layer 3 devices) is the IP Helper Address.

The “ip helper-address” Cisco command provides a solution to forward broadcast traffic between Layer 3 network subnets, particularly for DHCP and BOOTP requests from clients.

When a client sends a DHCP request in order to obtain a dynamic IP address from a DHCP server, it is typically done through a broadcast message, which by default stays within the same Layer 3 subnet. Remember that Layer 3 devices (routers, firewalls etc) block broadcast message from passing from one network subnet to another.

The IP Helper Address feature serves as a way to relay these broadcast messages to a designated DHCP server that may reside in a different subnet.

This is done by transforming the Broadcast traffic into Unicast traffic and passing it over to the destination server.

By doing so, network administrators can centralize their DHCP services and facilitate dynamic IP address assignment even when the clients and the DHCP server are not in the same network segment.

To fully understand the IP Helper Address in Cisco devices, it is essential to comprehend the principles of its operation, configuration, and troubleshooting.

This knowledge will not only help network administrators manage their networks more efficiently but also contribute to better performance and added security in their network systems.

What Is IP Helper Address in TCP/IP Networking

In the realm of TCP/IP networking, the IP Helper Address plays an important role in networks with many Layer 3 subnets.

It is a feature implemented mainly on Layer 3 devices such as routers, Layer 3 switches, firewalls etc, to assist in the forwarding of specific network broadcasts for services such as DHCP and BOOTP, which are typically limited to their respective subnets.

This feature effectively expands the reach of these services and allows the administrator to centralize these servers in only one subnet in the network, so clients located in different subnets can still reach them.

The IP Helper Address functions as an intermediary, transferring packets within a network.

When a router receives a broadcast request from a host on one subnet, the IP Helper Address steps in to transform the request into unicast traffic and forward (or “relay”) that request to the desired destination server, allowing the host to access essential services.

This feature is particularly beneficial for networks with multiple VLANs or subnets.

DHCP clients residing on separate subnets can acquire IP addresses from a central DHCP server, enabling seamless network management and efficiency.

Additionally, IP Helper Address contributes to network security by having only one centralized DHCP server located in a well-protected network segment with strict traffic control and restrictions.

Configuration Example on Cisco Router

To enable IP Helper Address on a Cisco router device, the following configuration commands are used:

interface <interface-type> <interface-slot/port>
ip helper-address <IP-address-of-the-DHCP-server>

Let’s use the following simple network diagram for our example configuration:

Router1(config)#interface G0/1
Router1(config-if)#ip helper-address 192.168.1.5
Router1(config-if)#end

The DHCP client at IP subnet 10.1.1.0 sends a DHCP broadcast message to its local subnet.

Router1 receives the broadcast at its interface G0/1 which is configured with the “ip helper-address” command and the destination DHCP server 192.168.1.5

The router will forward the DHCP request by transforming it into a Unicast message which can be routed to the destination server 192.168.1.5

One important point to note here is that Router1 sending the DHCP request on behalf of the client will unicast the request with a source address from the address space the client is in (the interface the helper-address is configured on), which is the subnet 10.1.1.0 in our example above.

Doing the above, the DHCP server will see that the request comes from a source IP subnet of 10.1.1.0 and will therefore assign an IP address in that specific range (DHCP scope). The IP address assigned in our example above is 10.1.1.100 for example.

Verifying IP Helper Address Configuration on Cisco Router

Continuing our example above, let’s verify the configuration on Router1:

Router1#show ip interface G0/1

GigabitEthernet0/1 is up, line protocol is up

Internet address is 10.1.1.1/24

Broadcast address is 255.255.255.255

Address determined by setup command

MTU is 1500 bytes

Helper address is 192.168.1.5

How to Configure IP Helper Address on Cisco ASA Firewall

Configuring an IP helper address on a Cisco ASA firewall enables the device to forward broadcast traffic, such as DHCP requests, to a specific destination.

However, the configuration on ASA firewall is different from a Cisco Router. It uses the “dhcprelay” command instead of “ip helper-address” command.

Here is an example configuration from my article here:

!First identify the DHCP server and the interface it is connected to
ciscoasa# conf t
ciscoasa(config)# dhcprelay server 10.1.1.100 DMZ
ciscoasa(config)# dhcprelay timeout 90

!Now enable the DHCP relay on the inside interface
ciscoasa(config)# dhcprelay enable inside

!Assign the ASA inside interface IP as default gateway for the clients
ciscoasa(config)# dhcprelay setroute inside

Other UDP Services that can be forwarded

Above we emphasized that ip helper-address usually works to forward DHCP messages to a distant DHCP server.

However, there are other UDP broadcast messages that can be forwarded by ip helper address command as shown below (default UDP services are shown):

To enable the forwarding of other UDP services from the “ip helper-address” command, use the following:

Router(config)#ip forward-protocol udp 517

The above will forward UDP 517 port to the destination server indicated by the “ip helper-address” command.

To remove some protocols from being forwarded, use the following:

Router(config)#no ip forward-protocol udp 37

Router(config)#no ip forward-protocol udp 137

Router(config)#no ip forward-protocol udp 138

How IP Helper Address Works

As explained above, IP helper address is a feature in Cisco routers that allows the forwarding of User Datagram Protocol (UDP) broadcasts to specific unicast addresses.

This is particularly useful in networks that use Dynamic Host Configuration Protocol (DHCP), Trivial File Transfer Protocol (TFTP), or Network Time Protocol (NTP), among other services.

When a broadcast packet is received, the router identifies the destination port and compares it to a predefined list of ports associated with UDP services.

If the destination port is eligible for helper address forwarding, the router modifies the packet and forwards it to the IP helper address specified in the configuration.

The main steps in the IP helper address process include:

1. Upon receiving a broadcast packet, the router checks if it has an IP helper address configured on the incoming interface.

2. The router examines the destination port of the packet and verifies if it belongs to a supported UDP service.

3. If the packet satisfies both conditions, it is forwarded to the configured IP helper address.