Global ConfigDomain 7.0

ip dhcp excluded-address

Instructs the router's internal DHCP server to permanently withhold specific IP addresses—or entire contiguous blocks of addresses—from being leased to dynamic clients. This protects static infrastructure like routers, switches, and printers from IP conflicts.

Quick Reference

Execution ModeRouter(config)#

ScopeGlobal (Applies to all pools)

Syntax FlexibilitySingle IP or Low-to-High Range

Negation Commandno ip dhcp excluded-address [ip]

Syntax Breakdown

ip dhcp excluded-address [low-ip] [high-ip]

Unlike network statements that require subnet masks, the exclusion command relies purely on explicit IP address boundaries. You can execute this command multiple times to carve out different reserved chunks of your subnet.

Single IP Mode: Provide only one IP address (e.g., ip dhcp excluded-address 192.168.1.1). This is typically used to protect the default gateway.
Range Mode: Provide a starting IP and an ending IP (e.g., ip dhcp excluded-address 192.168.1.1 192.168.1.50). The router will block the low IP, the high IP, and every single address numerically between them.

CLI Deployment Scenarios

Scenario 1: Securing the First 20 Addresses

You are rolling out a /24 network for users. Company policy dictates that .1 is the gateway, and .2 through .20 are reserved for future network switches and local print servers.

Router(config)# ip dhcp excluded-address 10.1.1.1 10.1.1.20

! When the pool is created, the very first address handed to a client will be 10.1.1.21.

Scenario 2: Fragmented Exclusions

You need to exclude the router gateway (.254) at the top of the subnet, and a block of static servers (.10 to .15) at the bottom.

Router(config)# ip dhcp excluded-address 192.168.100.254

Router(config)# ip dhcp excluded-address 192.168.100.10 192.168.100.15

! You can stack as many excluded-address commands as your topology requires.

CCNA Exam Gotchas

[!]

The Configuration Mode Trap

This is a classic CCNA drag-and-drop or multiple-choice trap.

Students frequently try to enter the DHCP pool submode (Router(config-dhcp)#) and then type the exclusion command. It will fail. The ip dhcp excluded-address command is a global variable. It must be executed in standard Global Configuration mode (Router(config)#).

[!]

Excluding Active Leases

If you configure the ip dhcp pool first, the router begins handing out addresses immediately. If you realize your mistake and try to type an exclusion command for an IP address that the router has already leased out, the IOS will reject the exclusion and throw an error. You will have to use clear ip dhcp binding * to wipe the active leases before the exclusion command will take effect. Always exclude first!