Guided buildstarter6 steps~15 min4 devices

Let the router hand out the addresses

Build a four-device office LAN, address one PC by hand, then put a DHCP pool on the router so the next machine configures itself.

What you'll be able to do: A second PC that you never configure plugs in, asks once, and ends up with the same address, gateway and DNS list you typed by hand into the first one — and the router can tell you exactly what it handed out.

Start this build in the lab

Topics: DHCP · Default gateway · Address planning

What you'll build

Edge — a router, the office router, and the DHCP server
SW-Desk — a switch, the desk switch every machine plugs into
PC-Ann — a pc, the PC you address by hand
PC-Ben — a pc, the PC that addresses itself

Step by step

1. Place the router and the switch
Every office LAN starts the same way: one router to be the way out, one switch to fan the wall ports out. Drag both onto the canvas, run a copper cable from the router's Gi0/0 to the switch's Gi0/1, then name each device so the prompt always tells you where you are typing.
- Cable Edge Gi0/0 ↔ SW-Desk Gi0/1
On Edge — Name the router
```
enable
configure terminal
hostname Edge
end
```
On SW-Desk — Name the switch
```
enable
configure terminal
hostname SW-Desk
end
```
Why: Router and switch work at different layers: the switch fans one Ethernet segment out to many wall ports, and the router is where that segment ends and every other network begins. Everything cabled into SW-Desk shares one broadcast domain with Edge's Gi0/0, which matters later, because a client with no address can only ask for one by broadcasting.
2. Give the router the address the whole LAN will point at
Gi0/0 is the router's leg on the office subnet, so whatever address you put there becomes the default gateway for every host on it. Take 192.168.10.1, the first usable address — the convention costs nothing and means anyone who inherits this network can guess where the gateway lives. Router interfaces start administratively down, so no shutdown is part of the job rather than an afterthought.
On Edge — Address the LAN leg and bring it up
```
enable
configure terminal
interface Gi0/0
ip address 192.168.10.1 255.255.255.0
no shutdown
end
```
Check: run show ip interface brief on Edge and look for 192.168.10.1.
Why: A host can only hand traffic to a gateway it can reach directly, so a gateway is always an address inside the host's own subnet — in practice, the router's interface on that LAN. The same address appears twice more in this build: typed by hand into PC-Ann, and written into the DHCP pool so every later client receives it automatically.
3. Plug in the first PC and leave it blank
Drag a PC onto the canvas, cable its Eth0 to a switch port, and name it. Do not address it yet. A host on a live cable with no address of its own is the exact situation the rest of this build is about, and it is worth seeing once.
- Cable PC-Ann Eth0 ↔ SW-Desk Fa0/1
On PC-Ann — Name the first PC
```
hostname PC-Ann
```
Why: A network card with no IP address is not deaf: it still has a MAC address and can send and receive Ethernet frames. DHCP is built on exactly that — a client with no address broadcasts its request from source 0.0.0.0 to 255.255.255.255, and everything in the broadcast domain hears it.
4. Address that PC by hand, so you can feel the work
A host needs three facts before it can talk beyond its own cable: an address, a mask that says how much of the subnet is local, and a gateway to hand everything else to. Type all three into PC-Ann at 192.168.10.5, then ping the router. That is one machine done, and every one of those three facts had to be decided by a person and typed by a person.
On PC-Ann — Address, mask and gateway, typed out in full
```
ipconfig Eth0 192.168.10.5 255.255.255.0 192.168.10.1
```
Check: run ipconfig on PC-Ann and look for 192.168.10.5.
Why: A statically addressed host never talks to the DHCP server, so the server's binding table holds no record of it. Every hand-typed address on a subnet that a pool also serves should be fenced off from that pool deliberately, which is exactly what the next step does.
5. Reserve the addresses that are already spoken for, then build the pool
Exclude 192.168.10.1 to .10 before anything else. Two of those are taken by hand already — the router at .1 and PC-Ann at .5 — and the rest is headroom for the printer, the access point and the next switch, all of which want addresses that never move. A pool allowed to lease .5 would eventually hand PC-Ann's address to a stranger and take both machines off the network. Then define the pool itself: network says which subnet it owns and therefore which addresses it may give out, default-router is the gateway it writes into every client's configuration, and dns-server is the resolver list those clients will use to turn names into addresses.
On Edge — Fence off the fixed addresses, then define the office pool
```
enable
configure terminal
ip dhcp excluded-address 192.168.10.1 192.168.10.10
ip dhcp pool OFFICE
network 192.168.10.0 255.255.255.0
default-router 192.168.10.1
dns-server 8.8.8.8 1.1.1.1
exit
end
```
Check: run show ip dhcp pool on Edge and look for Default router: 192.168.10.1.
Why: DHCP delivers the gateway and the resolver list as options — option 3 and option 6 — in the same reply as the address, which is why one exchange can configure a host completely. Exclusions apply to addresses rather than devices, so .5 stays protected even on a day PC-Ann is switched off and nothing on the wire answers for it.
6. Let the second PC address itself, then read the register
Drag on PC-Ben, cable it to another switch port, name it, and ask for a lease with one line. It broadcasts a request, the router offers the lowest address the pool has left — 192.168.10.11, because .1 to .10 are fenced off — and the PC accepts the address, the gateway and the DNS list together. Run ipconfig on it and compare with the three facts you typed into PC-Ann by hand. On the router, show ip dhcp binding is the register of who holds what: the address leased, the hardware address that claimed it, and whether it was handed out automatically or reserved for that client.
- Cable PC-Ben Eth0 ↔ SW-Desk Fa0/2
On PC-Ben — Name the PC, then ask the network for everything else
```
hostname PC-Ben
ipconfig /renew
```
Check: run show ip dhcp binding on Edge and look for Client-ID/Hardware address.
Why: DHCP is four messages — Discover, Offer, Request, Acknowledge. The Request is broadcast as well, so that every server that made an offer learns which one was accepted, and what the client ends up holding is a lease: an address tied to its hardware address, the pairing `show ip dhcp binding` lists.

The theory behind it

One DHCP server for every floor — Serve a user floor from a central DHCP server on another subnet — watch the first request die at the router, then relay it with ip helper-address.
Let the core switch hand out the addresses — Run two department VLANs, their gateways and their DHCP pools on a single switch — and find out why a perfect pool can still hand out nothing.
NAT to the internet — Hide two private office LANs behind the single public address your provider gave you.
Give the whole network one clock — Build an NTP hierarchy from HQ to a branch switch, read the strata hop by hop, then find the security ACL that silently broke time while ping kept working.
Lock management down to SSH — Make a switch manageable from the admin subnet, then harden it: RSA keys, SSH version 2, a local account, and VTY lines that refuse everything but SSH.

Build it for real

The lab walks you through these steps and ticks each one off as your network starts working.

Open in the lab

What you'll build

Step by step

1. Place the router and the switch

2. Give the router the address the whole LAN will point at

3. Plug in the first PC and leave it blank

4. Address that PC by hand, so you can feel the work

5. Reserve the addresses that are already spoken for, then build the pool

6. Let the second PC address itself, then read the register

The theory behind it

More in Network services

Build it for real