An administrator wants to configure a Firewall Threat Defense (FTD) device as a DHCP server for a workstation and set up a DHCP address reservation for an endpoint device.
The configuration involves configuring DHCP server for the FTD natively in the Firewall Management Center (FMC) and using FlexConfig to add the DHCP IP reservation.
Firewall Threat Defense (FTD) version 10.x. Other software versions are also affected.
Firewall Management Center (FMC) 10.x. Other software versions are also affected.
Topology

The specific DHCP environment includes:
DHCP server interface is NET200.
DHCP server pool is 192.0.2.10 - 50.
Endpoint device with MAC address 0000.5E00.5301. The goal is to reserve IP address 192.0.2.45 for this endpoint.
The pool 192.0.2.10 - 50 is configured on FTD interface NET200:

For the DHCP IP address reservation use FlexConfig:
Deployment Type: Set to "Once".
Configuration Type: Set to "Append" (this is the default). "Prepend" can be also used.

The deployed configuration:
device# show run dhcpd
dhcpd address 192.0.2.10-192.0.2.50 NET200
dhcpd enable NET200
dhcpd reserve-address 192.0.2.45 0000.5E00.5301 NET200
To capture the DHCP packets use these commands:
device# capture CAPI interface NET200 match udp any any eq bootpc
device# capture CAPI interface NET200 match udp any any eq bootps
The DHCP client listens on UDP port 68.
The DHCP server listens on UDP port 67.
DHCP debugs:
device# debug dhcpd event 255
debug dhcpd event enabled at level 255
device# debug dhcpd packet 255
debug dhcpd packet enabled at level 255
Note: Use debugs with caution!
Debug output during the IP address assignment:
DHCPD/RA: Server msg received, fip=ANY, fport=0 on NET200 interface
DHCPD: DHCPDISCOVER received from client 0100.5056.885f.d1 on interface NET200.
DHCPD:IP 248.57.222.26 ARP entry removed from the cache
DHCPD: send ping pkt to 192.0.2.45
DHCPD: ping got no response for ip: 192.0.2.45
DHCPD: MAC 0000.5E00.5301 is reserved for IP 192.0.2.45, allocating it
DHCPD: Add binding 192.0.2.45 to radix tree
DHCPD/RA: Binding successfully added to hash table
dhcpd_create_automatic_binding() adding NP rule for client 192.0.2.45
DHCPD: assigned IP address 192.0.2.45 to client 0100.5056.885f.d1.
DHCPD: Sending DHCPOFFER to client 0100.5056.885f.d1 (192.0.2.45).
DHCPD: Total # of raw options copied to outgoing DHCP message is 0.
DHCPD/RA: creating ARP entry (192.0.2.45, 0000.5E00.5301).
DHCPD: unicasting BOOTREPLY to client 0000.5E00.5301(192.0.2.45).
DHCPD/RA: Server msg received, fip=ANY, fport=0 on NET200 interface
DHCPD: DHCPDISCOVER received from client 0100.5056.885f.d1 on interface NET200.
DHCPD: Sending DHCPOFFER to client 0100.5056.885f.d1 (192.0.2.45).
DHCPD: Total # of raw options copied to outgoing DHCP message is 0.
DHCPD/RA: creating ARP entry (192.0.2.45, 0000.5E00.5301).
DHCPD: unicasting BOOTREPLY to client 0000.5E00.5301(192.0.2.45).
DHCPD/RA: Server msg received, fip=ANY, fport=0 on NET200 interface
DHCPD: DHCPDISCOVER received from client 0100.5056.885f.d1 on interface NET200.
DHCPD: Sending DHCPOFFER to client 0100.5056.885f.d1 (192.0.2.45).
DHCPD: Total # of raw options copied to outgoing DHCP message is 0.
DHCPD/RA: creating ARP entry (192.0.2.45, 0000.5E00.5301).
DHCPD: unicasting BOOTREPLY to client 0000.5E00.5301(192.0.2.45).
DHCPD/RA: Server msg received, fip=ANY, fport=0 on NET200 interface
DHCPD: DHCPREQUEST received from client 0100.5056.885f.d1.
DHCPD: Extracting client address from the message
DHCPD: State = DHCPS_REBOOTING
DHCPD: State = DHCPS_REQUESTING
DHCPD: Client 0100.5056.885f.d1 specified it's address 192.0.2.45
DHCPD: Client is on the correct network
DHCPD: Client accepted our offer
DHCPD: Client and server agree on address 192.0.2.45
DHCPD: Renewing client 0100.5056.885f.d1 lease
DHCPD: Client lease can be renewed
DHCPD: Sending DHCPACK to client 0100.5056.885f.d1 (192.0.2.45).
DHCPD: Including FQDN option name 'DESKTOP-VQ7968K' rcode1=0, rcode2=0 flags=0x0
DHCPD: Total # of raw options copied to outgoing DHCP message is 0.
DHCPD/RA: creating ARP entry (192.0.2.45, 0000.5E00.5301).
DHCPD: unicasting BOOTREPLY to client 0000.5E00.5301(192.0.2.45).
Verification of the DHCP binding:
device# show dhcpd binding
IP address Client Identifier Lease expiration Type
192.0.2.45 0100.005e.0053.01 3589 seconds Automatic
FMC does not natively support the configuration of DHCP IP address reservation. Thus, FlexConfig has to be used to configure the IP address reservation.
Related enhancement defect: Cisco bug ID CSCwn24229.
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
14-May-2026
|
Initial Release |