DHCP Snooping

Dynamic Host Configuration Protocol (DHCP) is a network management protocol used in TCP/IP networks to dynamically assign IP addresses and other related configuration information to network devices.

• How DHCP Snooping Works
• Benefits of DHCP Snooping

How DHCP Snooping Works

Dynamic Host Configuration Protocol (DHCP) dynamically allocates IP addresses to devices, leasing addresses that can be reused when no longer needed. Hosts or end devices that require IP addresses through DHCP must communicate with a DHCP server across the LAN.

The following illustration shows the DHCP snooping process.

Figure 1: DHCP Snooping

In the topology, an end user device connects to a Junos OS device (router, switch, or firewall). The Junos OS device connects to both the DHCP client and the DHCP server. The Junos OS device configured as a DHCP relay agent operates as the interface between DHCP clients and the DHCP server. This Junos OS device inspects DHCP packets. The DHCP server assigns IP addresses to clients.

The DHCP snooping feature on a Junos OS device performs the following actions:

• Validates DHCP messages received from untrusted sources and filters out invalid messages.
• Extracts the IP address leased to each client and builds a database. The DHCP snooping database (or binding table) includes information about the IP address, MAC address, and VLAN of each DHCP client.
• Uses the DHCP snooping binding table to validate subsequent requests from untrusted hosts. By verifying that DHCP requests are coming from trusted sources, the Juniper device can ensure that only valid DHCP requests are processed.

In this way, DHCP snooping acts as a guardian of network security by keeping track of valid IP addresses that a trusted DHCP server (a server connected to a trusted network port) assigns to downstream network devices.

DHCPv6 Relay Agent Snooping

The DHCPv6 relay agent enhances the DHCP relay agent by providing support in an IPv6 network. The DHCPv6 relay agent passes messages between the DHCPv6 client and the DHCPv6 server, similar to the way DHCP relay agent supports an IPv4 network. In a multi-relay topology that has multiple DHCPv6 relay agents between the client and the server, snooping enables the intervening relay agents to correctly process unicast traffic from the client and forward it to the server. Snooping in this topology involves these actions:

• The DHCPv6 relay agent snoops incoming unicast DHCPv6 packets using a filter with UDP port 547, which is the DHCPv6 UDP server port, on a per-forwarding table basis.
• The DHCPv6 relay agent then processes the packets intercepted by the filter and forwards the packets to the DHCPv6 server.

This example shows how to configure DHCP snooping support for DHCP relay agent.

On a Junos OS device, the DHCP snooping feature is automatically enabled when you configure DHCP security, DHCP relay, DHCP server settings for a specific VLAN, or routing instance.

Note that on a Junos OS device, you cannot configure DHCP snooping as an independent feature.

Junos OS enables DHCP snooping on a switch, router, or firewall when you configure any one or all of the following features:

• DHCP relay or DHCP local server options at the following hierarchy levels:
  • The dhcp-relay statement at the [edit forwarding-options] or [edit routing-instances routing-instance-name forwarding-options] hierarchy level.
  • The dhcp-local-server statement at the [edit system services] or [edit routing-instances routing-instance-name system services] hierarchy level.
    Note:

    When you configure DHCP relay, use the forward-only statement unless you need subscriber management or class-of-service (CoS). The forward-only configuration forwards specified DHCP client packets, without creating a subscriber session.

• DHCP security on a specific VLAN activates DHCP snooping for that VLAN:

  The dhcp-security statement at the [edit vlans vlan-name forwarding-options] hierarchy level for switches.

• The dhcp-security statement at the [edit bridge-domains bridge-domain-name forwarding-options dhcp-security] hierarchy level for routers.

• You can configure the DHCP local server to forward or drop snooped packets for all interfaces, only configured interfaces, or only non-configured interfaces. See Configuring DHCP Snooped Packets Forwarding Support for DHCP Local Server for more details.

You can further refine the control over DHCP snooping behavior using the forward-snooped-clients statement.

You can use the forward-snooped-clients statement to decide whether the monitored traffic should be forwarded or dropped based on the interface configuration.

1. To assess the snooped traffic and later decide whether to forward or drop the traffic, configure the forward-snooped-clients statement at the [edit forwarding-options dhcp-relay] hierarchy level.

   You can set the forward-snooped-clients option for the following scenarios:

   • All interfaces: Applies the action to all interfaces.
   • Configured interfaces: Applies the action only to the interfaces configured as part of an interface group.
   • Non-configured interfaces: Applies the action only to the interfaces that are not a part of an interface group.
2. To forward or drop the snooped packets, configure allow-snooped-clients or no-allow-snooped-clients, respectively, with the forward-snooped-clients option.
   • When you configure allow-snooped-clients, snooped packets are forwarded if a valid subscriber is associated with them.
   • When you configure no-allow-snooped-clients, snooped packets are dropped even if a valid subscriber is associated with them.

To learn more about the action that the device takes on DHCP snooped packets based on the combination of allow-snooped-clients or no-allow-snooped-clients with forward-snooped-clients, see Table 1 and Table 2.

Table 1 shows the action that the device takes on the packets snooped by the DHCP relay agent when you configure allow-snooped-clients with forward-snooped-clients option.

Table 2 shows the action that the device takes on the packets snooped by the DHCP relay agent when you configure no-allow-snooped-clients with forward-snooped-clients.

During DHCP relay agent snooping, the device relies on its global configuration to decide whether to forward or discard BOOTREPLY packets. Additionally, during a lease renewal, a BOOTPREQUEST packet might be unicast directly to the DHCP server, and this packet is also subject to snooping.

Table 3 shows the action the device takes on the snooped BOOTREPLY packets.

In both the default configuration and in configurations using the forward-snooped-clients statement, the device forwards all DHCP traffic on the hardware control plane to the routing plane of the routing instance for interception of DHCP packets.

You can use the no-snoop option to disable the snooping filter for DHCP traffic.

When you configure the no-snoop option, DHCP traffic goes to the hardware control plane but bypasses the routing plane, avoiding interception there.