DHCP (Dynamic Host Configuration Protocol) allows clients to automatically obtain network configuration, such as IP address, subnet mask, default gateway, and DNS configuration, from a DHCP server.

You can create DHCP servers to handle DHCP requests and create DHCP relay services to relay DHCP traffic to external DHCP servers. However, you should not configure a DHCP server on a logical switch and also configure a DHCP relay service on a router port that the same logical switch is connected to. In such a scenario, DHCP requests will only go to the DHCP relay service.

If you configure DHCP servers, to improve security, configure a DFW rule to allow traffic on UDP ports 67 and 68 only for valid DHCP server IP addresses.

To block DHCP packets for ports 67 and 68 configure a DFW rule with the following:
Source Destination Service Rule
ANY ANY ANY BLOCK
To allow DHCP packets configure a DFW rule with the following:
Source Destination Service Rule
ANY ANY ports 67 and 68, TCP ALLOW
Note:

In this release, the DHCP server does not support guest VLAN tagging.