Note: This topic includes information about enabling DHCP snooping when using Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Understanding DHCP Snooping for Port Security. For ELS details, see Getting Started with Enhanced Layer 2 Software.

DHCP snooping enables the switch to monitor and control DHCP messages received from untrusted devices connected to the switch. When DHCP snooping is enabled on a VLAN, the system snoops the DHCP messages to view DHCP lease information and build and maintain a database of valid IP address to MAC address (IP-MAC) bindings called the DHCP snooping database. Only clients with valid bindings are allowed access to the network.

DHCP Snooping Basics

Dynamic Host Configuration Protocol (DHCP) allocates IP addresses dynamically, leasing addresses to devices so that the addresses can be reused when no longer needed. Hosts and end devices that require IP addresses obtained through DHCP must communicate with a DHCP server across the LAN.

DHCP snooping acts as a guardian of network security by keeping track of valid IP addresses assigned to downstream network devices by a trusted DHCP server (the server is connected to a trusted network port).

By default, all trunk ports on the switch are trusted and all access ports are untrusted for DHCP snooping.

When DHCP snooping is enabled, the lease information from the server is used to create the DHCP snooping table, also known as the binding table. The table shows current IP-MAC bindings, as well as lease time, type of binding, names of associated VLANs, and associated interface.

• When a DHCP client releases an IP address (sends a DHCPRELEASE message). In this event, the associated mapping entry is deleted from the database.
• If you move a network device from one VLAN to another. In this event, typically the device needs to acquire a new IP address. Therefore, its entry in the database, including the VLAN ID, is updated.
• When the lease time (timeout value) assigned by the DHCP server expires. In this event, the associated entry is deleted from the database.

Tip: By default, the IP-MAC bindings are lost when the switch is rebooted and DHCP clients (the network devices, or hosts) must reacquire bindings. However, you can configure the bindings to persist by setting the dhcp-snooping-file statement to store the database file either locally or remotely.

You can configure the switch to snoop DHCP server responses only from specific VLANs. Doing this prevents spoofing of DHCP server messages.

Enabling DHCP Snooping

DHCP snooping is not enabled in the default switch configuration. DHCP snooping is enabled automatically by Junos OS software when you configure any port security features at the [edit vlans vlan-name forwarding-options dhcp-security] hierarchy level. You enable DHCP snooping per VLAN, not per interface (port). For additional information about enabling DHCP snooping, see Configuring Port Security (CLI Procedure).

DHCP Snooping Process

The basic process of DHCP snooping consists of the following steps:

Note: When DHCP snooping is enabled for a VLAN, all DHCP packets sent from that network devices in that VLAN are subjected to DHCP snooping. The final IP-MAC binding occurs when the DHCP server sends a DHCPACK packet to the DHCP client.

1. The network device sends a DHCPDISCOVER packet to request an IP address.
2. The switch forwards the packet to the DHCP server.
3. The server sends a DHCPOFFER packet to offer an address. If the DHCPOFFER packet is from a trusted interface, the switch forwards the packet to the DHCP client.
4. The network device sends a DHCPREQUEST packet to accept the IP address. The switch adds an IP-MAC placeholder binding to the database. The entry is considered a placeholder until a DHCPACK packet is received from the server. Until then, the IP address could still be assigned to some other host.
5. The server sends a DHCPACK packet to assign the IP address or a DHCPNAK packet to deny the address request.
6. The switch updates the DHCP database in accordance with the type of packet received:
   • Upon receipt of a DHCPACK packet, the switch updates lease information for the IP-MAC binding in its database.
   • Upon receipt of a DHCPNACK packet, the switch deletes the placeholder.

Note: The DHCP database is updated only after the DHCPREQUEST packet has been sent.

For general information about the messages that the DHCP client and DHCP server exchange during the assignment of an IP address for the client, see the Junos OS System Basics Configuration Guide.

DHCPv6 Snooping

DHCP snooping is also supported for IPv6 packets. The process for DHCPv6 snooping is similar to that for DHCP snooping, but uses different names for the messages exchanged between the client and server to assign IPv6 addresses. Table 1 shows DHCPv6 messages and their DHCPv4 equivalents.

Rapid Commit for DHCPv6

DHCPv6 provides for a Rapid Commit option, which, when supported by the server and set by the client, shortens the exchange from a four-way relay to a two-message handshake. For more information about enabling Rapid Commit, see Enabling DHCPv6 Rapid Commit Support.

1. The DHCPv6 client sends out a SOLICIT message that contains a Rapid Commit option, requesting that rapid assignment of address/prefix and other configuration parameters are preferred.
2. If the DHCPv6 server supports rapid assignment, it responds with a REPLY message containing the assigned IPv6 address and prefix and other configuration parameters.

DHCP Server Access

A switch’s access to the DHCP server can be configured in three ways:

• Switch, DHCP Clients, and DHCP Server Are All on the Same VLAN
• Switch Acts as DHCP Server
• Switch Acts as Relay Agent

Switch, DHCP Clients, and DHCP Server Are All on the Same VLAN

When the switch, DHCP clients, and DHCP server are all members of the same VLAN, the DHCP server can be connected to the switch in one of two ways:

Note: To enable DHCP snooping on the VLAN, set [edit vlans vlan-name forwarding-options] dhcp-security.

• (See Figure 1.) The server is directly connected to the same switch as the one connected to the DHCP clients (the hosts, or network devices, that are requesting IP addresses from the server). The VLAN is enabled for DHCP snooping to protect the untrusted access ports. The trunk port is configured by default as a trusted port.
• (See Figure 2.) The server is connected to an intermediary switch (Switch 2) that is connected through a trunk port to the switch (Switch 1) that the DHCP clients are connected to. Switch 2 is being used as a transit switch. The VLAN is enabled for DHCP snooping to protect the untrusted access ports of Switch 1. The trunk port is configured by default as a trusted port. In Figure 2—, ge-0/0/11 is a trusted trunk port.

Figure 1: DHCP Server Connected Directly to Switch

Figure 2: DHCP Server Connected Directly to Switch 2, with Switch 2 Connected to Switch 1 Through a Trusted Trunk Port

Switch Acts as DHCP Server

You can configure DHCP local server options on the switch, which enables the switch to function as an extended DHCP local server. In Figure 3, the DHCP clients are connected to the extended DHCP local server through untrusted access ports..

Figure 3: Switch Is the DHCP Server

Switch Acts as Relay Agent

The switch functions as a relay agent when the DHCP clients or the DHCP server is connected to the switch through a Layer 3 interface. The Layer 3 interfaces on the switch are configured as routed VLAN interfaces (RVIs)—also called integrated routing and bridging (IRB) interfaces. The trunk interfaces are trusted by default.

• The DHCP server and clients are in different VLANs.
• The switch is connected to a router that is in turn connected to the DHCP server. See Figure 4.

Figure 4: Switch Acting as Relay Agent Through Router to DHCP Server

Static IP Address Additions to the DHCP Snooping Database

You can add specific static IP addresses to the database as well as have the addresses dynamically assigned through DHCP snooping. To add static IP addresses, you provide the IP address, the MAC address of the device, the interface on which the device is connected, and the VLAN with which the interface is associated. You do not assign a lease time to the entry. The statically configured entry never expires.