DHCP Lease Failures Across Multiple VLANs — Relay Agent, Trunk, or Server Misconfiguration
DHCP failures spanning switches, WAPs, and VLANs occur when clients cannot obtain IP addresses due to misconfigured DHCP relay agents (ip helper-address), VLAN trunking errors, or an unreachable/exhausted DHCP server. DHCP Discover broadcasts cannot traverse Layer 3 boundaries without a properly configured relay, causing network-wide failures. Resolution requires validating DHCP server health, relay agent configuration on each Layer 3 interface, VLAN tagging consistency, and scope availability.
Indicators
- Clients receive APIPA addresses (169.254.x.x) or '0.0.0.0' — indicating DHCP Discover sent but no Offer received
- Wireless clients on WAPs fail to obtain leases while wired clients on the same VLAN may also fail, ruling out a purely wireless issue
- DHCP server shows no inbound requests in logs, suggesting relay agents are not forwarding Discover packets
- Multiple VLANs simultaneously unable to assign addresses, pointing to a shared relay agent or DHCP server failure rather than a single-scope issue
- Event ID 1014 (DNS client) or Event ID 1001 (DHCP client — DHCPNACK received) visible in Windows client System event log
- Switch or router logs show DHCP relay drops or 'no binding' errors on Layer 3 SVI interfaces
Likely causes
- Missing or incorrect 'ip helper-address' (Cisco) / 'dhcp-relay' configuration on Layer 3 VLAN interfaces (SVIs), preventing DHCP Discover from being unicast-forwarded to the server
- VLAN trunk misconfiguration between access switches and distribution/core — VLAN not allowed on trunk, causing DHCP traffic to be dropped before reaching the relay
- DHCP server service stopped, crashed, or the server is unreachable due to a routing failure between the relay and the server subnet
- DHCP scope exhaustion — all available leases assigned, server sending DHCPNAK to new requests
- DHCP server authorisation failure in Active Directory (Windows Server DHCP) — server not authorised and silently dropping requests
- WAP VLAN misconfiguration — access point management VLAN or client SSID VLAN not matching the switch port configuration, causing frames to be untagged or double-tagged incorrectly
- ACL or firewall rule blocking UDP port 67 (DHCP server) and/or UDP port 68 (DHCP client) between the relay source IP and the DHCP server
- Duplicate or conflicting DHCP servers on the same VLAN causing NAK storms
Diagnostic steps
-
On an affected client, release and renew the IP address: 'ipconfig /release && ipconfig /renew'Distinguish between 'no response at all' (relay/server unreachable) and 'DHCPNAK' (scope exhaustion, wrong subnet, or rogue server conflict)
-
On the DHCP server, check service status and scope health: 'Get-DhcpServerv4Scope | Select-Object ScopeId, Name, State, StartRange, EndRange, LeaseDuration; Get-DhcpServerv4Statistics'Confirm the DHCP service is running and authorised in AD, and identify any scope-level errors (exhaustion, conflicts)
-
On each affected Layer 3 SVI, verify the DHCP relay is configured: 'show running-config | section interface Vlan'Confirm that DHCP Discover broadcasts will be unicast-relayed to the DHCP server — a missing or wrong helper address is the most common cause of multi-VLAN DHCP failure
-
Verify VLAN trunk configuration between access switches and distribution layer: 'show interfaces trunk'A VLAN pruned from a trunk will silently drop all traffic including DHCP, causing failures only on affected VLANs
-
Run a packet capture on the DHCP server's NIC filtered for UDP 67/68: 'tcpdump -i eth0 udp port 67 or port 68 -n'Determines whether the problem is upstream (relay not forwarding) or at the server itself (service not responding)
-
Check the DHCP server's audit log for NAKs or exhaustion: "Get-Content 'C:\Windows\System32\dhcp\DhcpSrvLog-Mon.log' | Select-String -Pattern 'NACK|No free|exhausted'"Identifies scope exhaustion, lease conflicts, or missing scopes for the affected VLANs
-
Inspect WAP-to-switch port configuration: 'show running-config interface <wap-uplink-port>'VLAN mismatch on the WAP uplink causes wireless client DHCP frames to be dropped or placed into the wrong broadcast domain
Resolution path
- 1. If relay agent (ip helper-address) is missing, add it to each affected Layer 3 SVI: 'interface Vlan <id>' → 'ip helper-address <DHCP-server-IP>'. Repeat for all affected VLANs. Save config: 'write memory'.
- 2. If VLANs are missing from trunk ports, add them: 'interface <trunk-port>' → 'switchport trunk allowed vlan add <vlan-id>'. Verify with 'show interfaces trunk'.
- 3. If the DHCP server service is stopped on Windows Server, restart it: 'Restart-Service DHCPServer' or via the DHCP MMC console. Re-authorise the server in AD if required: 'Add-DhcpServerInDC -DnsName <server-FQDN> -IPAddress <server-IP>'.
- 4. If scope exhaustion is confirmed, either reduce lease duration ('Set-DhcpServerv4Scope -ScopeId <x.x.x.0> -LeaseDuration 00:04:00'), expand the scope range, or reclaim stale leases.
- 5. If a rogue DHCP server is detected (identified via packet capture showing conflicting OFFERs), isolate it using DHCP Snooping: enable 'ip dhcp snooping' globally and 'ip dhcp snooping vlan <id>' on affected VLANs, then set only uplinks to DHCP server as trusted ports ('ip dhcp snooping trust').
- 6. Correct any WAP/controller SSID VLAN mismatch by aligning the SSID VLAN tag in the wireless controller with the switch access port VLAN assignment. Bounce the WAP or SSID after changes.
- 7. Verify ACLs/firewall rules permit UDP 67/68 between relay agent source IPs and the DHCP server IP. Add permit rules if blocked.
Prevention
- Enable DHCP Snooping on all access switches with only uplinks to authorised DHCP relay/server marked as trusted — prevents rogue DHCP servers from issuing leases
- Implement DHCP scope utilisation alerting (Windows DHCP server threshold alerts or SNMP traps) to notify operations when any scope exceeds 80% utilisation before exhaustion occurs
- Standardise and document ip helper-address configuration in switch/router templates and enforce via configuration compliance checks (e.g., Cisco NSO, RANCID, or Netmiko-based audits) — any SVI missing a helper-address should trigger an alert
- Enforce VLAN tagging consistency between WAP/wireless controller SSID profiles and switch port configurations using automated provisioning or network management platform templates to prevent trunk/access VLAN drift
- Set appropriate DHCP lease durations for each VLAN (shorter for guest/IoT VLANs with high churn, longer for stable server VLANs) to reduce scope exhaustion risk
- Periodically audit and reclaim stale DHCP leases, and maintain at least 20% free addresses in every active scope as a buffer
Tools
- ipconfig /release /renew (Windows client DHCP lease renewal)
- Get-DhcpServerv4Scope / Get-DhcpServerv4Statistics (Windows Server DHCP PowerShell module)
- DHCP MMC Console (Windows Server DHCP management GUI)
- show ip dhcp binding / show ip dhcp pool (Cisco IOS/IOS-XE DHCP diagnostics)
- show interfaces trunk / show running-config (Cisco switch VLAN and trunk verification)
- tcpdump / Wireshark (packet capture to confirm DHCP traffic flow on UDP 67/68)
- ip dhcp snooping (Cisco feature to block rogue DHCP servers)
- Add-DhcpServerInDC (PowerShell — authorise DHCP server in Active Directory)