DHCP Relay Agent Configuration

A DHCP Relay Agent is a network device (typically a router or a Layer 3 switch) that forwards DHCP broadcast messages between clients and servers on different IP subnets. The fundamental problem it solves is that DHCP client messages (Discover, Request) are broadcast at Layer 2 and Layer 3. By default, routers do not forward broadcasts across subnets. Without a relay agent, a DHCP client on one subnet cannot obtain an IP address from a DHCP server located on a different subnet. This forces organizations to either place a DHCP server on every subnet (costly and inefficient) or use a relay agent to forward the messages as unicast.

The DHCP relay process is defined in RFC 1542 (and updated by RFC 2131). The relay agent intercepts DHCP broadcast packets and modifies them before forwarding as unicast. Here is the detailed mechanism:

3. Relay Agent Modification: The relay agent performs the following modifications to the DHCP packet: - Sets the GIADDR (Gateway IP Address) field: This is the IP address of the interface on which the broadcast was received. This field tells the DHCP server which subnet the client is on, so the server can assign an appropriate IP address from the correct scope. - Changes the destination IP address: From 255.255.255.255 to the unicast IP address of the DHCP server (specified in the ip helper-address command). - Changes the destination MAC address: To the MAC address of the next-hop router toward the DHCP server. - Sets the source IP address: To the relay agent's outgoing interface IP address (the one used to reach the server). - Sets the source MAC address: To the MAC of that outgoing interface. - Sets the TTL (Time to Live): To a value that allows the packet to reach the server.

Cisco IOS Configuration Example:

interface GigabitEthernet0/0
 ip address 192.168.1.1 255.255.255.0
 ip helper-address 10.10.10.5

This configures interface Gi0/0 (on subnet 192.168.1.0/24) to relay DHCP broadcasts to the server at 10.10.10.5.

Verification Commands:

Linux/Unix Configuration Example (using dhcrelay):

dhcrelay -i eth0 -i eth1 10.10.10.5

This runs the relay agent on interfaces eth0 and eth1, forwarding to server 10.10.10.5.

- DHCP Snooping: A security feature that filters untrusted DHCP messages. Relay agents can work with DHCP snooping by adding Option 82. The snooping switch uses Option 82 to validate the source port and prevent rogue DHCP servers. - VLANs: In a switched environment with VLANs, each VLAN is a separate broadcast domain. A relay agent must be configured on the SVI (Switch Virtual Interface) for each VLAN that needs DHCP services. For example:

interface Vlan10
   ip address 192.168.10.1 255.255.255.0
   ip helper-address 10.10.10.5

In enterprise networks, DHCP relay agents are ubiquitous. Consider a large university with multiple buildings, each with its own subnet (e.g., 10.1.1.0/24 for dorm A, 10.1.2.0/24 for dorm B). Instead of deploying a DHCP server in each building, a centralized DHCP server in the data center handles all leases. Each building's access switch or router is configured with ip helper-address on the VLAN interface. This simplifies management and reduces costs. However, if the relay agent is misconfigured (e.g., wrong GIADDR due to incorrect interface IP), clients may receive IP addresses from the wrong subnet, causing connectivity issues.

Another common scenario is in cloud environments. For example, in AWS, a VPC with multiple subnets uses a DHCP options set, but on-premises networks that extend to the cloud via VPN often require relay agents to forward DHCP requests from on-premises subnets to a central server. Network engineers must ensure that the relay agent's interface IP (GIADDR) matches the subnet from which the request originates. If not, the server may assign an IP from a different scope, leading to IP conflicts.

Performance considerations: A single relay agent can handle thousands of clients, but it must be robust. In high-density environments (e.g., large conference venues), multiple relay agents may be used for redundancy. The relay agent adds minimal latency (microseconds) because it only modifies packet headers. However, if the relay agent is overloaded, DHCP timeouts can occur. Monitoring with show ip dhcp relay statistics helps identify dropped packets.

Common misconfigurations: Forgetting to configure ip helper-address on all VLAN interfaces that need DHCP; setting the helper address to a non-existent server; or having ACLs that block UDP port 67/68 between relay and server. Also, if the relay agent's interface IP changes (e.g., after renumbering), the GIADDR field becomes stale, and clients on that subnet will receive wrong IPs until the configuration is updated.