In which configuration mode is ip dhcp excluded-address [start] [end] used?

The ip dhcp excluded-address [start] [end] command is entered in Global Config mode on Cisco IOS devices.

DHCPGlobal Config

ip dhcp excluded-address [start] [end]

Excludes one or more IP addresses from the DHCP pool so they are not automatically assigned to clients, typically used for static assignments like servers or routers.

Definition: ip dhcp excluded-address [start] [end] is a Cisco IOS global config command. Excludes one or more IP addresses from the DHCP pool so they are not automatically assigned to clients, typically used for static assignments like servers or routers.

Overview

The `ip dhcp excluded-address` command is a fundamental tool in Cisco IOS for managing Dynamic Host Configuration Protocol (DHCP) address allocation. Its primary purpose is to prevent the DHCP server from automatically assigning specific IP addresses to clients. This is critical in networks where certain devices—such as servers, routers, printers, or network appliances—require static IP addresses for consistent accessibility and management.

Without this exclusion, the DHCP server could inadvertently assign an address that is already in use by a statically configured device, leading to IP conflicts that disrupt connectivity. The command operates at the global configuration level and directly modifies the DHCP server's address pool logic. It does not remove addresses from the pool but rather marks them as unavailable for dynamic assignment.

This is distinct from using a DHCP pool's `reserved` or `manual-bind` commands, which assign specific addresses to specific clients based on MAC addresses. The `excluded-address` command is broader—it blocks a range of addresses from being offered to any client, regardless of MAC. Network engineers typically use this command during initial DHCP server setup or when adding new statically addressed devices to a network.

It is also common in migration scenarios where a network is transitioning from static to dynamic addressing. The command's impact is immediate; once applied, the DHCP server will not offer those addresses to new clients, but existing leases are not affected until they expire. The command is stored in the running configuration and can be saved to startup-config.

There is no special privilege level beyond global config mode, but it does require the `ip dhcp server` feature to be enabled. A common oversight is forgetting to exclude the network's default gateway or other critical infrastructure addresses, which can cause intermittent connectivity issues. The command supports both single address and range exclusion, making it flexible for various network sizes.

In terms of IOS behavior, the command is processed immediately and does not require a reload. It is also reversible with the `no` form. Understanding this command is essential for CCNA and CCNP candidates as it directly impacts network reliability and is frequently tested in exam scenarios involving DHCP configuration and troubleshooting.

Syntax·Global Config

ip dhcp excluded-address [start] [end]

When to Use This Command

Reserving a range of IPs for static devices such as printers or servers within a DHCP scope.
Excluding the default gateway address (e.g., router interface) from being leased to clients.
Preventing DHCP from assigning addresses already used by network infrastructure devices.
Creating a small exclusion range for future static assignments without modifying the pool size.

Parameters

Parameter	Syntax	Required	Description
start	A.B.C.D	Required	The first IP address in the exclusion range. This must be a valid unicast IPv4 address. Common mistakes include using a broadcast or network address, or entering an address that is already excluded. The address should be within the subnet of the DHCP pool.
end	A.B.C.D	Optional	The last IP address in the exclusion range. If omitted, only the single address specified by 'start' is excluded. The end address must be numerically greater than or equal to the start address. A common mistake is reversing the order or specifying an address outside the DHCP pool's subnet.

Command Examples

Exclude a single address

ip dhcp excluded-address 192.168.1.1

No output is generated upon successful configuration. The command simply excludes 192.168.1.1 from being leased.

Exclude a range of addresses

ip dhcp excluded-address 192.168.1.1 192.168.1.10

No output is generated. The range 192.168.1.1 through 192.168.1.10 is excluded from DHCP assignment.

Understanding the Output

This command does not produce any output on successful execution. To verify excluded addresses, use 'show ip dhcp pool [pool-name]' or 'show ip dhcp binding'. The excluded addresses are listed under the pool's configuration.

If an excluded address appears in the binding table, it indicates a misconfiguration or that the address was manually assigned via static binding.

Configuration Scenarios

Excluding a single server IP from a DHCP pool

A small office network uses a DHCP server on a Cisco router (192.168.1.0/24). The file server at 192.168.1.10 must have a static IP to ensure consistent access. Without exclusion, the DHCP server might assign .10 to a client, causing a conflict.

Topology

Router(DHCP Server)---192.168.1.0/24---Clients & File Server (192.168.1.10)

Steps

1.Step 1: Enter global configuration mode: Router# configure terminal
2.Step 2: Exclude the server's IP address: Router(config)# ip dhcp excluded-address 192.168.1.10
3.Step 3: Create the DHCP pool: Router(config)# ip dhcp pool OFFICE
4.Step 4: Define the network: Router(dhcp-config)# network 192.168.1.0 255.255.255.0
5.Step 5: Set default gateway: Router(dhcp-config)# default-router 192.168.1.1
6.Step 6: Exit and verify: Router(dhcp-config)# end

Configuration

!
ip dhcp excluded-address 192.168.1.10
!
ip dhcp pool OFFICE
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
!

Verify: Use 'show ip dhcp pool' to see the pool statistics. The excluded address will not appear in the 'Allocated' count. Use 'show ip dhcp binding' to confirm no client has been assigned 192.168.1.10.

Watch out: If the server is already using 192.168.1.10 via a static configuration, but the DHCP server has already leased that address to a client, the exclusion will not revoke the lease. You must manually clear the lease with 'clear ip dhcp binding *' or wait for it to expire.

Excluding a range of addresses for network infrastructure

A medium-sized enterprise uses a DHCP server on a Cisco router for the 10.10.10.0/24 subnet. The first 20 addresses (10.10.10.1-20) are reserved for routers, switches, and servers that require static IPs. The DHCP pool should only assign addresses from .21 onward.

Topology

Router(DHCP Server)---10.10.10.0/24---Infrastructure (.1-.20) & Clients (.21-.254)

Steps

1.Step 1: Enter global configuration mode: Router# configure terminal
2.Step 2: Exclude the range: Router(config)# ip dhcp excluded-address 10.10.10.1 10.10.10.20
3.Step 3: Create the DHCP pool: Router(config)# ip dhcp pool ENTERPRISE
4.Step 4: Define the network: Router(dhcp-config)# network 10.10.10.0 255.255.255.0
5.Step 5: Set default gateway: Router(dhcp-config)# default-router 10.10.10.1
6.Step 6: Exit: Router(dhcp-config)# end

Configuration

!
ip dhcp excluded-address 10.10.10.1 10.10.10.20
!
ip dhcp pool ENTERPRISE
 network 10.10.10.0 255.255.255.0
 default-router 10.10.10.1
!

Verify: Use 'show ip dhcp pool' to see the pool utilization. The excluded range will reduce the total number of available addresses. Use 'show ip dhcp conflict' to check for any conflicts that may arise if static addresses are misconfigured.

Watch out: If the excluded range overlaps with the DHCP pool's network statement, the exclusion works correctly. However, if you later change the pool's network to a different subnet, the exclusion remains in the config but becomes irrelevant. Always review exclusions when modifying pool networks.

Troubleshooting with This Command

When troubleshooting DHCP issues, the `ip dhcp excluded-address` command is often a key suspect. A healthy DHCP server should have exclusions that match the network's static assignments. Problem indicators include clients receiving IP addresses that conflict with statically configured devices, or clients failing to obtain an address because the pool is exhausted due to an overly broad exclusion.

To diagnose, start by checking the DHCP pool statistics with `show ip dhcp pool`. Look at the 'Total addresses' and 'Excluded addresses' counts. If the excluded count is unexpectedly high, verify the exclusion list with `show running-config | include ip dhcp excluded-address`.

Compare the excluded ranges against the network's static IP assignments. A common symptom is a client getting an APIPA address (169.254.x.x) or a 'No DHCPOFFER' message. This could indicate that the pool is full because too many addresses are excluded.

Use `show ip dhcp binding` to see active leases and `show ip dhcp conflict` to detect IP conflicts. If a conflict is detected, the DHCP server logs it and may mark the address as unavailable. The conflict log can be viewed with `show ip dhcp conflict`.

To resolve, ensure that excluded addresses are not also being used by clients via static configuration. If a static device is using an address that falls within the DHCP pool's range but is not excluded, either exclude that address or change the device's IP. Another useful command is `debug ip dhcp server events`, which shows real-time DHCP transactions.

Look for 'DHCPD: no address available' messages, which indicate pool exhaustion. Correlate this with the exclusion list. If the pool is exhausted, consider expanding the subnet or reducing exclusions.

Also, check for any rogue DHCP servers on the network using `show ip dhcp server statistics`. In summary, the `ip dhcp excluded-address` command is a simple but powerful tool; misconfiguration can lead to address exhaustion or conflicts. A systematic approach—checking pool stats, binding, conflicts, and exclusions—will quickly isolate the issue.

CCNA Exam Tips

Remember that excluded addresses must be configured before creating the DHCP pool; otherwise, the pool may already have assigned those addresses.

The 'ip dhcp excluded-address' command is applied globally, not under the DHCP pool configuration mode.

You can exclude a single address by omitting the end parameter, or a range by specifying both start and end.

CCNA exam may test that excluded addresses are not shown in 'show ip dhcp binding' output.

Common Mistakes

Forgetting to exclude the router's interface IP address, causing duplicate IP conflicts.

Excluding addresses after the DHCP pool has already leased them, requiring manual release or renewal.

Using the command under DHCP pool configuration mode instead of global configuration mode.

ip dhcp excluded-address [start] [end] vs ip dhcp pool [name]

Both commands are essential for DHCP configuration on Cisco IOS, but they serve distinct roles: 'ip dhcp excluded-address' reserves specific IPs from automatic assignment, while 'ip dhcp pool' defines the address range and parameters for dynamic allocation. They are commonly confused because they are often used together to fine-tune DHCP behavior.

Aspect	ip dhcp excluded-address [start] [end]	ip dhcp pool [name]
Scope	Excludes specific IP addresses from all DHCP pools	Defines a single DHCP pool with subnet, options
Configuration mode	Global configuration mode	Global config then DHCP pool sub-mode
Persistence	Saved in running-config; survives reload	Saved in running-config; pool config requires 'network' command
Precedence	Overrides any conflicting pool address range	Range defined by 'network' command is subject to exclusions
Typical use	Reserve IPs for static devices (servers, routers)	Create DHCP scope for dynamic client assignment
Parameter behavior	Accepts start IP and optional end IP; exits config	Enters sub-mode for 'network', 'default-router', etc.

Use ip dhcp excluded-address [start] [end] when you need to prevent the DHCP server from automatically assigning specific IP addresses that are statically configured on servers, routers, or other critical devices.

Use ip dhcp pool [name] when you need to create a new DHCP address pool and configure its subnet, default gateway, DNS servers, and other options for automatic client configuration.

Platform Notes

On Cisco IOS-XE (e.g., Catalyst 9000 switches, ISR 4000 series), the `ip dhcp excluded-address` command syntax is identical to classic IOS. However, IOS-XE uses a different DHCP server implementation (based on the Linux kernel), but the CLI remains consistent. The output of `show ip dhcp pool` may include additional fields like 'Lease time' and 'Automatic bindings'.

On NX-OS (e.g., Nexus switches), the equivalent command is `ip dhcp excluded-address` as well, but it is configured under the `ip dhcp` sub-mode after entering `ip dhcp` in global config. For example: `switch(config)# ip dhcp` then `switch(config-dhcp)# excluded-address 10.0.0.1 10.0.0.10`. NX-OS also supports a `vrf` parameter for VRF-aware DHCP.

On ASA firewalls, DHCP server functionality is limited and the command is `dhcpd address <start>-<end> <interface>` under interface configuration mode, but exclusion is not directly supported; instead, you define the address range to exclude by not including those addresses in the pool. On IOS-XR (e.g., ASR 9000), the DHCP server is not typically used; instead, external DHCP servers are recommended. There is no direct equivalent command.

For IOS versions, the command has been available since at least IOS 12.0 and remains unchanged in 15.x and 16.x. There are no major behavioral differences across versions, but in newer IOS versions, the DHCP server can be configured with a 'database' agent to store bindings, which does not affect the exclusion command. Always verify the exact syntax for your platform using the built-in help (?).

Related Commands

ip dhcp pool [name]

Creates a DHCP pool and enters DHCP pool configuration mode, where you define the subnet, default gateway, DNS servers, and other DHCP options for assigning IP addresses to clients.

show ip dhcp binding

Displays the current DHCP binding table, showing which IP addresses have been leased to clients, along with their MAC addresses, lease expiration, and type of binding.

show ip dhcp pool

Displays the configuration and utilization statistics of a DHCP pool, used to verify pool settings and address allocation status.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions