# IP Services: DHCP, NAT, and DNS

> Chapter 14 of the Courseiva ENCOR curriculum — https://courseiva.com/learn/encor/ip-services-dhcp-nat-and-dns

**Official objective:** 6.1 — Configure and verify DHCP, NAT, and DNS services

## Introduction

DHCP, NAT, and DNS are the three foundational IP services that automate network addressing, enable internet access for private networks, and translate human-friendly names into machine-routable addresses. Without them, every device would need manual IP configuration, entire office blocks would fail to reach the web, and you would have to memorise long strings like 142.250.185.46 instead of typing www.google.com. For your 350-401 ENCOR exam, understanding how to configure and verify these services on Cisco devices is essential because they underpin every enterprise network you will ever encounter.

## The Luxury Hotel Concierge, Front Desk, and Switchboard Analogy

The hotel’s front desk, concierge, and switchboard system work together to make every guest’s stay seamless, transparently connecting them to the outside world without revealing the internal room layout. When a guest arrives without a reservation, the front desk consults its ledger and assigns a vacant room number, hands over a key card pre-programmed with check-out time, and jots down the hotel’s direct phone number for outside calls. The guest never needs to know which wing the room is in until they are told; the assignment is dynamic and reclaims the room at the end of the stay. That is DHCP – an automatic room assignment service.

Later, the guest wants to visit a famous restaurant called “The Cedar Tree” but has no address. The concierge pulls out a thick, constantly updated directory and translates the name into a street address and postcode. The guest uses that address to reach the destination. The concierge is DNS, resolving memorable names into routable identifiers.

When the guest dials the restaurant from their room, the hotel’s switchboard intercepts the call. Instead of revealing the guest’s internal room extension (which means nothing to the outside world), the switchboard replaces it with the hotel’s main public number. The restaurant sees the hotel’s number, not the guest’s internal line. Replies come back to the hotel, and the switchboard reverses the translation, connecting the call back to the correct room. This is NAT, masking private internal addresses behind a shared public identity. Together, the front desk, concierge, and switchboard remove all manual effort and complexity, allowing guests to move in and out effortlessly while keeping the hotel’s internal layout completely hidden.

## Core explanation

At its heart, an IP network needs three things to be usable: every device must get a unique address, internal devices must be able to reach the internet even though the ISP gives you only one or a handful of public addresses, and people must be able to refer to servers and websites by name rather than by number. That is exactly what DHCP, NAT, and DNS provide.

DHCP (Dynamic Host Configuration Protocol) is a client‑server protocol that assigns IP addresses and other network settings automatically. When a device (the DHCP client) connects to a network, it broadcasts a “Discover” message looking for a DHCP server. A DHCP server – which could be a router, a switch, or a Windows/Linux server – responds with an “Offer” containing an available IP address, subnet mask, default gateway, DNS server addresses, and a lease time. The client then sends a “Request” formally asking to use that address, and the server finalises the transaction with an “Ack”. This four-way handshake is commonly remembered as DORA (Discover, Offer, Request, Ack). The lease time ensures addresses are reclaimed when devices leave the network. On a Cisco router, you create a DHCP pool with the commands: ip dhcp pool POOL-NAME, network 192.168.1.0 255.255.255.0, default-router 192.168.1.1, dns-server 8.8.8.8, and lease 7 (for days). If the DHCP server is on a different VLAN or subnet, the router must relay the broadcasts using ip helper-address <server-IP> on the client-facing interface. This keeps broadcasts from flooding the whole network while still providing dynamic addressing.

NAT (Network Address Translation) solves the problem of IPv4 address exhaustion by allowing many devices with private IP addresses (like 192.168.x.x, 10.x.x.x, 172.16-31.x.x) to share one or a few public IP addresses when communicating on the internet. Without NAT, every device would need its own globally unique public IP, which simply are not available. NAT works by rewriting the source IP address in outbound packets and the destination IP in inbound replies. There are several flavours:

- Static NAT: a single permanent one-to-one mapping between a private and a public address. This is typically used for internal servers that need to be reachable from the internet, like a web server. The command is ip nat inside source static 10.1.1.100 203.0.113.5.

- Dynamic NAT: a pool of public addresses is shared among a larger group of private hosts on a first-come, first-served basis. Each connection uses one public address until the pool is exhausted.

- PAT (Port Address Translation) or NAT overload: the most common form. Multiple private IPs are mapped to a single public IP (or a small pool) by also translating the source port number. The NAT device tracks this in a translation table, so return traffic can be correctly delivered. The configuration typically combines an access list defining the private traffic to translate, a NAT pool (or an interface for overload), and ip nat inside source list <acl> interface GigabitEthernet0/0 overload.

Important address terminology: inside local (the private IP of an internal host), inside global (the public IP the host appears as to the internet), outside local (the IP of an external host as seen from the internal network – often the same as outside global unless another NAT occurs), and outside global (the real public IP of an external host).

DNS (Domain Name System) is the internet’s phonebook. It maps fully qualified domain names (FQDNs) like server1.corp.local to IP addresses. When you type a URL, your device queries a DNS resolver (usually learned by DHCP), which recursively queries root name servers, top-level domain (TLD) servers, and authoritative name servers until it gets the answer. DNS caches results to speed up future queries. A Cisco router can act as a DNS server or a DNS forwarder. With ip dns server, you enable the DNS server function, and then you can add static name-to-IP mappings with ip host corp-web 192.168.1.50. To point the router to an external DNS resolver for unknown names, use ip name-server 8.8.8.8. Verification commands include show hosts for the local host table and show ip dns view. The /etc/hosts file on a Unix-like system is a local, text-based predecessor to DNS; DNS scales that to the entire world. DNS is not just for web browsing – it is critical for domain-joined Windows machines to locate domain controllers via SRV records, for email delivery (MX records), and for VoIP.

Together, these three services eliminate manual configuration, conserve public address space, and make the network user-friendly. In a typical enterprise branch, a Cisco router provides all three: it acts as a DHCP server for the LAN, uses PAT to give every PC internet access through a single WAN IP, and resolves internal server names via its DNS proxy, forwarding other queries to the ISP’s DNS servers.

## Real-world context

An IT professional deploying a new branch office walks into a worksite where sixteen PCs, two printers, and a file server need to be online by lunchtime. The ISP has delivered a single public IP address on the router’s WAN interface (GigabitEthernet0/0), and the LAN switch connects everything on VLAN 10. Manually configuring every device is out of the question. Here is a realistic sequence of actions:

- Access the branch router via SSH or console, then enter global configuration mode.

- Configure a DHCP pool for VLAN 10. Issue ip dhcp pool BRANCH-LAN, define the network 192.168.10.0 255.255.255.0, set default-router 192.168.10.1 (the router’s VLAN 10 SVI), specify dns-server 192.168.10.5 (the internal DNS server if present, or 8.8.8.8), and set lease 2. Exclude the static addresses of the server and printers with ip dhcp excluded-address 192.168.10.1 192.168.10.20.

- Enable NAT overload. Define interface GigabitEthernet0/1 (the WAN port) as ip nat outside, and the VLAN 10 interface (or subinterface) as ip nat inside. Create a standard access list to match the private subnet: access-list 10 permit 192.168.10.0 0.0.0.255. Apply PAT with ip nat inside source list 10 interface GigabitEthernet0/1 overload.

- For the internal file server that remote employees must reach, set up a static NAT entry: ip nat inside source static tcp 192.168.10.5 445 interface GigabitEthernet0/1 445 (to expose SMB shares). Verify with show ip nat translations.

- Configure DNS services. Enable the router’s DNS server with ip dns server. Add an A record for the file server: ip host fileserver 192.168.10.5. Point to the ISP’s resolver for external names with ip name-server 8.8.8.8. Test resolution with a ping to fileserver from a PC that has received the DHCP offer.

- Validate end-to-end connectivity: check that a PC obtains an address with ipconfig /all (Windows) or ip addr show (Linux). Confirm it can resolve fileserver and browse the internet. Use show ip dhcp bindings to see leases, show ip nat statistics for translation statistics, and show hosts on the router to list cached DNS entries.

This exact workflow appears in countless small and medium business deployments. Every step maps directly to the configuration and verification objectives of the ENCOR exam.

## Exam focus

The 350-401 ENCOR exam will not ask you to wax poetic about why these services exist. It will test specific configuration syntax, expected output of show commands, and precise sequencing. Be ready for these areas:

- DHCP: the DORA process and the purpose of each message. You must recognise which message is a broadcast and which is unicast. The exam loves ip helper-address and the consequences of forgetting it – DHCP requests stay local to the subnet and clients get no IP. Also know how to configure a DHCP pool on a Cisco IOS device and how to set lease time, default router, and DNS server. Expect to interpret a show ip dhcp binding output and identify the client MAC address mapped to an IP.

- NAT: the order of operation matters. Cisco’s internal packet processing does NAT before routing for inside-to-outside traffic, and after routing for outside-to-inside traffic. You will be shown a scenario and asked what the source IP address looks like at each stage. Memorise the definitions of inside local, inside global, outside local, and outside global. Static NAT and PAT (overload) are the most common configuration tasks. Exam traps often present a PAT configuration but omit the overload keyword – without it, you get one-to-one dynamic NAT that will exhaust a single IP after one translation. Also be ready to verify translations with show ip nat translations and to clear them with clear ip nat translation *.

- DNS: while less heavy on configuration, exam questions test the concepts of delegation, recursion, and the local host table. A classic trick: a router configured with ip dns server and an ip host entry will resolve that name locally, even if no external DNS is reachable. The command show hosts displays the static entries as well as cached dynamic entries. Expect a drag-and-drop question that asks you to order the DNS resolution steps (client resolver, root server, TLD, authoritative). Also understand that /etc/hosts is looked up before DNS on most systems, a holdover from the pre-DNS era that can cause confusion when a name resolves to an unexpected IP.

- Common exam trap patterns:

- Offering an access list that permits any source but forgetting to apply it to NAT, or applying it on the wrong interface.

- Confusing inside and outside NAT interfaces; reversing them breaks translation entirely.

- Believing that a DHCP server can serve a subnet without a pool for that subnet – it cannot, unless an external server is reached via relay.

- Thinking that DNS and DHCP are the same thing because both appear in the IP configuration dialogue box.

Key definitions to memorise:

- Lease time: how long a DHCP client can use the address before renewal.

- Overload: the keyword enabling PAT, which uses port numbers to multiplex many private addresses to one public address.

- Recursion: the process by which a DNS server chases a query on behalf of a client.

- FQDN: a complete name ending with a dot, such as server.sales.corp.com.

- Inside global: the public IP address an internal host is mapped to.

## Step by step

1. **Plan the address scheme and requirements** — Determine the private subnet (e.g., 192.168.10.0/24), which public IP is available for NAT, and whether any servers need static mappings. This ensures the DHCP pool and NAT access list will match the actual topology.
2. **Configure the DHCP pool on the Cisco router** — Enter ip dhcp pool, specify the network, default router, DNS server, and lease time. Exclude any static addresses with ip dhcp excluded-address so the DHCP server does not hand those out.
3. **Define NAT inside and outside interfaces** — Mark the LAN interface with ip nat inside and the WAN interface with ip nat outside. This tells the router where to look for traffic to translate and in which direction the translation should occur.
4. **Create an access list and apply NAT overload** — Craft a standard or extended access list that permits the private subnet. Apply it with ip nat inside source list <ACL> interface <WAN> overload. The overload keyword activates port address translation, allowing many-to-one mapping.
5. **Set up DNS services on the router** — Issue ip dns server and add static A records for internal servers with ip host. Point to external resolvers using ip name-server. This turns the router into a caching DNS forwarder, reducing external queries and speeding local name resolution.
6. **Verify all three services** — On a client, check the assigned address with ipconfig /all; verify DNS resolution by pinging an internal hostname. On the router, use show ip dhcp binding, show ip nat translations, and show hosts to confirm DHCP leases, active translations, and cached DNS entries are as expected.

## Comparisons

### DHCP vs Static IP Addressing

**DHCP:**
- Addresses assigned automatically from a pool
- Reduces configuration errors and administrative overhead
- Lease must be renewed; devices can change address

**Static IP Addressing:**
- Address manually typed on each device
- Ensures an address never changes for critical servers
- Mistyping causes outages; no automatic recovery

### Static NAT vs Dynamic NAT

**Static NAT:**
- Permanent one-to-one mapping between private and public IP
- Used for servers that must be reachable from the internet
- The public IP cannot be shared with other hosts

**Dynamic NAT:**
- Temporary mapping from a pool of public addresses on demand
- First-come, first-served; mapping released after a timeout
- Pool can serve more internal hosts than the size of the pool, but only up to pool capacity at any moment

### PAT (NAT Overload) vs Dynamic NAT

**PAT (NAT Overload):**
- Many-to-one mapping using port numbers
- Single public IP can support thousands of internal hosts
- Tracks layer 4 source ports in translation table

**Dynamic NAT:**
- One-to-one mapping of private to public IP, limited by pool size
- Cannot exceed the number of available public addresses at once
- Tracks only IP addresses, not ports

### DNS A Record vs DNS CNAME Record

**DNS A Record:**
- Maps a FQDN directly to an IPv4 address
- Client receives the IP in the answer; no further lookup needed
- A single name cannot point to another name

**DNS CNAME Record:**
- Maps an alias to the canonical (real) FQDN
- Client must perform a second lookup for the A record of the canonical name
- Allows multiple aliases to point to one hostname, simplifying maintenance

### DHCP Relay (ip helper-address) vs DHCP Proxy

**DHCP Relay (ip helper-address):**
- Converts a broadcast to a unicast and forwards it to a known DHCP server
- Router does not allocate addresses, merely forwards
- Configured on the interface facing the client subnet

**DHCP Proxy:**
- The router itself acts as a DHCP server, allocating addresses locally
- Eliminates the need for an external server but requires per-router pool management
- Configurable on a Cisco device using a DHCP pool without an external server

### Inside Local vs Inside Global

**Inside Local:**
- The real private IP of an internal host
- Used on the inside network, invisible to the internet
- Example: 10.1.1.5

**Inside Global:**
- The public IP that the internal host is translated to
- Appears in the source field of packets leaving the outside interface
- Example: 203.0.113.5

## Diagram

_End-to-end flow showing DHCP address acquisition, DNS name resolution, and NAT translation as a client accesses a web server._

```mermaid
flowchart TD
    A[Client Boots] -->|1. DHCP Discover (broadcast)| B[DHCP Server]
    B -->|2. DHCP Offer (unicast)| A
    A -->|3. DHCP Request (broadcast)| B
    B -->|4. DHCP Ack (unicast)| A
    A -->|5. DNS Query for www.example.com| C[DNS Forwarder/Router]
    C -->|6. Recursive Query| D[Root/TLD/Authoritative DNS]
    D -->|7. Resolved IP| C
    C -->|8. IP Address| A
    A -->|9. Packet to 93.184.216.34 Source=192.168.1.5| E[NAT Router]
    E -->|10. Translate Source to 203.0.113.5:45678| F[Internet]
    F -->|11. Reply to 203.0.113.5:45678| E
    E -->|12. Translate Dest to 192.168.1.5:56789| A
```

## Common misconceptions

- **Misconception:** NAT acts as a firewall that protects my network from attacks. **Reality:** NAT provides address translation, not security filtering. A stateful firewall inspects traffic and makes allow/block decisions; NAT simply rewrites addresses. (Because NAT hides internal IP addresses, beginners assume it actively blocks malicious traffic, but it will happily translate an inbound packet that matches an existing translation entry.)
- **Misconception:** DHCP only gives out an IP address and nothing else. **Reality:** DHCP supplies a complete network configuration: subnet mask, default gateway, DNS server addresses, domain name, and dozens of optional parameters (options). (The most visible value is the IP address, so people overlook that without the default gateway the device cannot communicate beyond its own subnet.)
- **Misconception:** DNS is only needed when you browse the web. **Reality:** DNS resolves any name to an IP address, including internal server names, domain controller SRV records, email MX records, and VoIP SIP server records. It is critical for almost all network services. (Users only consciously notice DNS when a web page fails to load, so they incorrectly limit its role to browser activity.)
- **Misconception:** Dynamic NAT and PAT are the same thing. **Reality:** Dynamic NAT maps private IPs to a pool of public IPs one-to-one, while PAT (NAT overload) maps many private IPs to a single public IP by also translating port numbers. (Both perform address translation, and the word ‘dynamic’ suggests many-to-many flexibility. The crucial difference is port translation, which allows hundreds of clients behind one IP.)
- **Misconception:** NAT is mandatory for any internet access. **Reality:** NAT is only necessary when using private IPv4 addresses. Devices with a public IPv4 address or global unicast IPv6 address can communicate directly without any translation. (Nearly every home and small business uses private IPv4 and PAT, making it seem like a universal internet requirement, but IPv6 was designed to eliminate such address scarcity.)

## Key takeaways

- DHCP uses the four-message DORA process (Discover, Offer, Request, Ack) to dynamically assign IP addresses, subnet masks, and other network parameters to clients.
- The ip helper-address command on a router interface relays DHCP broadcast requests to a server on a different subnet, enabling centralised address management.
- NAT overload, also called PAT, translates multiple private IP addresses to a single public IP by differentiating return traffic using unique source port numbers.
- Cisco defines four NAT address terms: inside local (private host IP), inside global (public-faced IP), outside local (remote host IP as seen internally), and outside global (real remote host IP).
- Static NAT creates a permanent one-to-one mapping, commonly used to allow external access to an internal server; the configuration requires ip nat inside source static.
- A Cisco router enabled with ip dns server and static ip host entries can resolve internal names locally, while forwarding unknown queries to an external resolver via ip name-server.
- The show ip nat translations command is the primary verification tool for NAT, displaying every active translation and whether it is static or dynamic.
- DNS resolution follows a hierarchy: client resolver contacts a recursive server, which queries root servers, then top-level domain servers, and finally the authoritative name server for the zone.

## FAQ

**What is the DORA process in DHCP?**

DORA stands for Discover, Offer, Request, and Ack. A client broadcasts a Discover to find a server. The server replies with an Offer containing an IP address. The client broadcasts a Request to formally accept the offer. The server sends an Ack to finalise the lease.

**How do I configure NAT overload on a Cisco router?**

First, identify inside and outside interfaces (ip nat inside and ip nat outside). Then create an access list that permits the private subnet. Finally, apply ip nat inside source list <ACL-number> interface <outside-interface> overload.

**Why do we need DHCP relay and how do I set it up?**

DHCP clients send to the local subnet only. If the DHCP server is on a different subnet, broadcasts are not forwarded. The ip helper-address <server-IP> command on the client-facing router interface converts the broadcast to a unicast and forwards it to the DHCP server.

**What is the difference between inside local and inside global in NAT?**

Inside local is the private IP address assigned to a host on the internal network. Inside global is the public IP address that replaces the inside local when packets exit to the internet. The router maintains a translation table mapping between them.

**Can a Cisco router be a DNS server?**

Yes, with ip dns server the router can hold static A records (ip host) and forward queries it cannot answer itself. It can also cache responses. It is not a full-featured authoritative DNS server but works well for small branch name resolution.

**How do I verify NAT translations on a Cisco device?**

Use the command show ip nat translations. It displays each active translation, including the private inside local address and port, the mapped inside global address and port, the outside address, and the protocol.

## Check your understanding

1. **Which Cisco command displays all currently active NAT translations?**

   Answer: show ip nat translations

2. **What DHCP message type does a client send to accept an IP address offer?**

   Answer: A DHCP Request message.

3. **Which NAT variant allows many internal hosts to share a single public IP address by translating port numbers?**

   Answer: PAT (Port Address Translation), also known as NAT overload.

4. **What IOS command forwards DHCP broadcast requests from one subnet to a DHCP server on another subnet?**

   Answer: ip helper-address <server-IP>, applied to the client-facing interface.

5. **What DNS record type maps a hostname to an IPv4 address?**

   Answer: An A record.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/encor/ip-services-dhcp-nat-and-dns