Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

DHCP Relay Agent Information Option (Option 82)

 

The DHCP relay agent information option (option 82) enables you to include additional useful information in the client-originated DHCP packets that the DHCP relay forwards to a DHCP server. You can configure the option 82 support globally or for a named group of interfaces. For more information, read this topic.

Using DHCP Relay Agent Option 82 Information

Subscriber management enables you to configure the DHCP relay agent to include additional option 82 information in the DHCP packets that the relay agent receives from clients and forwards to a DHCP server. The DHCP server uses the additional information to determine the IP address to assign to the client. The server might also use the information for other purposes—for example, to determine which services to grant the client, or to provide additional security against threats such as address spoofing. The DHCP server sends its reply back to the DHCP relay agent, and the agent removes the option 82 information from the message and forwards the packet to the client.

To configure support for the DHCP relay agent information option 82, you use the relay-option-82 statement. You can configure the DHCP relay agent to include the following suboptions in the packet the relay agent sends to the DHCP server:

  • Agent Circuit ID (suboption 1)—An ASCII string that identifies the interface on which the client DHCP packet is received.

    Note

    If relay-option-82 is configured, but none of the attributes under relay-option-82 (that is, circuit-id | remote-id | server-id-override) are explicitly configured, then the default behavior is for the circuit-id (that is, suboption 1) to always be included in the option-82 value. This is true whether or not the vendor-specific attribute under relay-option-82 is configured.

  • Agent Remote ID (suboption 2)—An ASCII string assigned by the DHCP relay agent that securely identifies the client.

You can configure the option 82 support globally or for a named group of interfaces.

To restore the default behavior, in which option 82 information is not inserted into DHCP packets, you use the delete relay-option-82 statement.

Note

The DHCPv6 relay agent provides similar Agent Circuit ID and Agent Remote ID support for DHCPv6 clients. For DHCPv6, subscriber management uses DHCPv6 option 18 to include the circuit ID in the packets that the relay agent sends to a DHCPv6 server, and option 37 to include the remote ID in the packets. See DHCPv6 Relay Agent Options.

The following sections describe the option 82 operations you can configure:

Configuring Option 82 Information

You use the relay-option-82 statement to configure the DHCP relay agent to insert option 82 information in DHCP packets that the relay agent receives from clients and forwards to a DHCP server. When you configure option 82, you can include one of the suboption statements to specify the type of information you want to include in the DHCP packets. If you configure option 82 without including one of the suboption statements, the Agent Circuit ID option is included by default. Use the circuit-id statement to include the Agent Circuit ID (suboption 1) in the packets, or the remote-id statement to include the Agent Remote ID (suboption 2).

You can optionally configure DHCP relay agent to include a prefix or the interface description as part of the suboption information. If you specify the circuit-id or remote-id statement without including any of the optional prefix, use-interface-description, use-vlan-id, include-irb-and-l2, or no-vlan-interface-name statements, the format of the Agent Circuit ID or Agent Remote ID information for Fast Ethernet (fe), Gigabit Ethernet (ge), and integrated routing and bridging (irb) interfaces is one of the following, depending on your network configuration:

  • For Fast Ethernet or Gigabit Ethernet interfaces that do not use VLANs, stacked VLANs (S-VLANs), or bridge domains:

    Note

    For remote systems, the subunit is required and is used to differentiate an interface.

  • For Fast Ethernet or Gigabit Ethernet interfaces that use VLANs:

  • For Fast Ethernet or Gigabit Ethernet interfaces that use S-VLANs:

Note

Integrated routing and bridging (IRB) provides simultaneous support for Layer 2 bridging and Layer 3 IP routing on the same interface. IRB enables you to route local packets to another routed interface or to another bridging domain that has a Layer 3 protocol configured.

The interface to bridge domain relationship might be implicit (the interface is mapped to the bridge domain by the system based on the VLAN tag) or explicit (the interface is mapped to the bridge domain by configuring it in the bridge domain definition). For the explicit case, tagging might not be relevant for the mapping.

In the case of an IRB interface, the format displays the Layer 2 interface instead of the IRB interface along with the bridge domain name. For IRB interfaces (or other pseudo devices) the default format is as follows:

  • IRB interfaces that use bridge domains but do not use VLANs or S-VLANs:

  • IRB interfaces that use VLANs:

To include the IRB interface name with the Layer 2 interface name, configure the include-irb-and-l2 statement. The format is as follows:

  • IRB interfaces that use bridge domains but do not use VLANs or S-VLANs:

  • IRB interfaces that use VLANs:

To include only the IRB interface name without the Layer 2 interface and bridge domain or VLAN, configure the no-vlan-interface-name statement. The format is as follows:

To enable insertion of option 82 information:

  1. Specify that you want to configure option 82 support.
  2. Configure the DHCP relay agent to insert the Agent Circuit ID suboption, the Agent Remote ID suboption, or both.
    • To insert the Agent Circuit ID:

    • To insert the Agent Remote ID:

    • To insert both, configure both set commands.

  3. (Optional) Configure a prefix that is used in the option 82 information in the DHCP packets.

    See Including a Prefix in DHCP Options.

  4. (Optional) Configure the DHCP relay agent to include the interface’s textual description instead of the interface identifier in the option 82 information.

    See Including a Textual Description in DHCP Options.

Overriding Option 82 Information

You can configure the DHCP relay agent to add or remove the DHCP relay agent information option (option 82) in DHCP packets.

This feature causes the DHCP relay agent to perform one of the following actions, depending on the configuration:

  • If the DHCP relay agent is configured to add option 82 information to DHCP packets, it clears the existing option 82 values from the DHCP packets and inserts the new values before forwarding the packets to the DHCP server.

  • If the DHCP relay agent is not configured to add option 82 information to DHCP packets, it clears the existing option 82 values from the packets, but does not add any new values before forwarding the packets to the DHCP server.

To override the default option 82 information in DHCP packets destined for a DHCP server:

  1. Specify that you want to configure override options.
  2. Specify that the option 82 information in DHCP packets is overwritten.

Including a Prefix in DHCP Options

When you configure the DHCP relay agent to include DHCP options in the packets that the relay agent sends to a DHCP server, you can specify that the relay agent add a prefix to the DHCP option. You can add a prefix to the following DHCP options:

  • DHCPv4 option 82 Agent Circuit ID (suboption 1)

  • DHCPv4 option 82 Agent Remote ID (suboption 2)

  • DHCPv6 option 18 Relay Agent Interface-ID

  • DHCPv6 option 37 Relay Agent Remote-ID

The prefix is separated from the DHCP option information by a colon (:), and it can include any combination of the host-name, logical-system-name, and routing-instance-name options. The DHCP relay agent obtains the values for the host-name, logical-system-name, and routing-instance-name as follows:

  • If you include the host-name option, the DHCP relay agent uses the hostname of the device configured with the host-name statement at the [edit system] hierarchy level.

  • If you include the logical-system-name option, the DHCP relay agent uses the logical system name configured with the logical-system statement at the [edit logical-system] hierarchy level.

  • If you include the routing-instance-name option, the DHCP relay agent uses the routing instance name configured with the routing-instance statement at the [edit routing-instances] hierarchy level or at the [edit logical-system logical-system-name routing-instances] hierarchy level.

If you include the hostname and either or both of the logical system name and the routing instance name in the prefix, the hostname is followed by a forward slash (/). If you include both the logical system name and the routing instance name in the prefix, these values are separated by a semicolon (;).

The following examples show several possible formats for the DHCP option information when you specify the prefix statement for Fast Ethernet (fe) or Gigabit Ethernet (ge) interfaces with S-VLANs.

  • If you include only the hostname in the prefix for Fast Ethernet or Gigabit Ethernet interfaces with S-VLANs:

  • If you include only the logical system name in the prefix for Fast Ethernet or Gigabit Ethernet interfaces with S-VLANs:

  • If you include only the routing instance name in the prefix for Fast Ethernet or Gigabit Ethernet interfaces with S-VLANs:

  • If you include both the hostname and the logical system name in the prefix for Fast Ethernet or Gigabit Ethernet interfaces with S-VLANs:

  • If you include both the logical system name and the routing instance name in the prefix for Fast Ethernet or Gigabit Ethernet interfaces with S-VLANs:

  • If you include the hostname, logical system name, and routing instance name in the prefix for Fast Ethernet or Gigabit Ethernet interfaces with S-VLANs:

For Fast Ethernet or Gigabit Ethernet interfaces that use VLANs but not S-VLANs, only the vlan-id value appears in the DHCP option format.

(DHCPv4) To configure a prefix with the option 82 information:

  1. Specify that you want to configure option 82 support.
  2. Configure DHCP relay agent to insert the Agent Circuit ID, the Agent Remote ID, or both.
    • To configure the Agent Circuit ID:

    • To configure the Agent Remote ID:

  3. Specify that the prefix be included in the option 82 information. In this example, the prefix includes the hostname and logical system name.
    • To include the prefix with the Agent Circuit ID:

    • To include the prefix with the Agent Remote ID:

(DHCPv6) To use a prefix with the DHCPv6 option 18 or option 37 information:

  1. Specify that you want to configure DHCPv6 relay agent support.
  2. Configure DHCPv6 relay agent to insert option 18 (Relay Agent Interface-ID), option 37 (Relay Agent Remote-ID), or both.
    • To configure option 18:

    • To configure option 37:

  3. Specify that the prefix is included in the option information. In this example, the prefix includes the hostname and logical system name
    • To include the prefix with option 18:

    • To include the prefix with option 37:

Including a Textual Description in DHCP Options

By default, when DHCP relay agent inserts option information in the packets sent to a DHCP server, the options include the interface identifier. However, you can configure the DHCP relay agent to include the textual description that is configured for the interface instead of the interface identifier. You can use the textual description for either the logical interface or the device interface.

You can include the textual interface description in the following DHCP options:

  • DHCPv4 option 82 Agent Circuit ID (suboption 1)

  • DHCPv4 option 82 Agent Remote ID (suboption 2)

  • DHCPv6 option 18 Relay Agent Interface-ID

  • DHCPv6 option 37 Relay Agent Remote-ID

The textual description is configured separately, using the description statement at the [edit interfaces interface-name] hierarchy level. If you specify that the textual description is used and no description is configured for the interface, DHCP relay defaults to using the Layer 2 interface name.

In the case of integrated routing and bridging (IRB) interfaces, the textual description of the Layer 2 interface is used instead of the textual description of the IRB interface. If there is no description configured, the Layer 2 logical interface name is used.

Note

For IRB interfaces, the option 82 field must be able to uniquely identify the incoming interface based on either the Agent Circuit ID or Agent Remote ID . You can modify the information in the textual interface description to match the raw IFD (physical interface without a subunit) name and configure the option 82 field to use the interface description.

You can use the textual description with the following DHCP options:

  • DHCPv4 Option 82 Agent Circuit ID (suboption 1)

  • DHCPv4 Option 82 Agent Remote ID (suboption 2)

  • DHCPv6 Relay Agent Interface-ID (option 18)

  • DHCPv6 Relay Agent Remote-ID (option 37)

(DHCPv4) To configure the DHCP relay option 82 suboption to include the textual interface description:

  1. Specify that you want to configure option 82 support.
  2. Configure DHCP relay agent to insert the Agent Circuit ID, Agent Remote ID, or both.
  3. Specify that the textual description is included in the option 82 information. In this example, the option 82 information includes the description used for the device interface.

(DHCPv6) To configure the DHCPv6 option 18 or option 37 to include the textual interface description:

  1. Specify that you want to configure DHCPv6 relay agent support.
  2. Configure DHCPv6 relay agent to insert option 18 (Relay Agent Interface-ID), option 37 (Relay Agent Remote-ID), or both.
    • To configure option 18:

    • To configure option 37:

  3. Specify that the textual description is included in the option information. In the following example, the option information includes the description used for the device interface.
    • To include the textual description in option 18:

    • To include the textual description in option 37:

How DHCP Relay Agent Uses Option 82 for Auto Logout

Table 1 indicates how the DHCP relay agent determines the option 82 value used for the client auto logout feature. Depending on the configuration settings, DHCP relay agent takes the action indicated in the Action Taken column.

Table 1: DHCP Relay Agent Option 82 Value for Auto Logout

DHCP Relay Agent Configuration Settings

  

DHCP Relay Configured with Option 82

Discover Packet Contains Option 82

Override “trust-option- 82”

Override “always-write- option-82”

giaddr in non-snooped packet

Action Taken

No

No

No secondary search performed

No

Yes

Yes

Use option 82 from packet

No

Yes

No

Zero

Drop packet

No

Yes

No

Non-zero

Use option 82 from packet

Yes

No

Use configured option 82

Yes

Yes

No

Zero

Drop packet

Yes

Yes

No

No

Non-zero

Use option 82 from packet

Yes

Yes

No

Yes

Non-zero

Overwrite the configured option 82

Yes

Yes

Yes

No

Use option 82 from packet

Yes

Yes

Yes

Yes

Overwrite the configured option 82

Enable Processing of Untrusted Packets So Option 82 Information Can Be Used

By default, the DHCP relay agent treats client packets with a giaddr of 0 (zero) and option 82 information as if the packets originated at an untrusted source, and drops them without further processing. You can override this behavior and specify that the DHCP relay agent process DHCP client packets that have a giaddr of 0 (zero) and contain option 82 information.

To configure DHCP relay agent to trust option 82 information:

  1. Specify that you want to configure override options.
  2. Specify that the DHCP relay agent process DHCP client packets with a giaddr of 0 and that contain option 82 information.

Check if Your Device Support DHCP Option-82

To configure a switch with DHCP relay in forward-only mode, check whether your device supports DHCP Option 82.

Use the procedures in Table 2 to confirm the support of Option-82 or required workaround.

Table 2: Verify support of Option-82 in DHCP Server

Problem

How to Verify ?

Solution

Verify if your switching device supports DHCP Option 82.

Use the dhcp traceoptions on the DHCP Relay. A message states the drop due to missing Option 82.

If the DHCP Offer packet dropped because of Option-82 not included, you will receive the message like:

Feb 25 15:41:13.577519 [MSTR][NOTE] 
[default:default][RLY][INET][irb.6] 
jdhcpd_packet_handle: BOOTPREPLY could not find
client table entry

To fix the issue:

  • Solution 1: Upgrade the DHCP Server to Junos OS version that fully supports Option 82.

  • Solution 2: Change the DHCP Relay to a “stateful” mode (that is, DHCP Relay “binding” mode).

  • Solution 3: Move the DHCP Relay to a MX or to a non-ELS EX/QFX switch, so to enable the Legacy ‘helper bootp’ mode.

Managing Your DHCP PXE/BOOTP Servers That Do Not Support Option-82

Some PXE or BOOTP servers do not support Option-82, that is, their DHCP Offer messages do not include the Option-82 value added by the DHCP Relay. As a result, the DHCP Relay will drop the DHCP Offer and the PXE/BOOTP client will not be able to complete its boot sequence.

Following are the possible solution to resolve this issue:

Solution 1: Upgrade to a PXE Server that supports Option-82

Solution 2: Host the PXE server with a DHCP Server

  • Ensure that the DHCP Server (that supports Option-82) run together with the PXE server.

  • Configure an Option-60 on the DHCP Server.

    • Use the following CLI to configure Option-60 an a Microsoft WS DHCP Server:

      netsh dhcp server dhcp-server-address add optiondef 60 ClientIdentifier STRING 0 PXEClient
    • Activate the option in the user interface of the DHCP server.

This way, the PXE/BOOTP clients will receive proper DHCP Offer with Option-60 “PXEClient” and will reach the PXE server at the same IP address of the DHCP Server.

Solution 3: Include Option-60 and Option-43 DHCP Server Message

If the PXE Server is not hosted together with the DHCP Server, you need the DHCP Server to send an Option-43 also in its DHCP Offer. The Option-43 provides the IP address of the PXE server. Note that, the older PXE or BOOTP clients might ignore Option-43 and will therefore try to get the software from the DHCP Server. Enter the Option-43 in the DHCP Server configuration in a hexadecimal mode.

For is a sample option-43 message:

The above message indicates the following information to the PXE client:

  • Disable broadcast and multicast discovery

  • Accept only the PXE Server provided in this text

  • PXE Server IP is 10.11.12.13 (see the bytes '0A 0B 0C 0D' in the above text)

  • Boot menu on the PXE client (to present to the end user):

    • just one line, “ServerPXE”

    • Autoselect the first Boot option, prompt “S”, no timeout (that is, immediately boot unless you press F8)

DHCP packets on non-configured interfaces are dropped

Once you enable DHCP-Relay on the QFX or EX Switches, the DHCP Snooping feature gets enabled and all DHCP packets incoming through any interface (both configured and unconfigured interface) of the device are analyzed. The interfaces that are not listed under the DHCP configuration are considered ‘unconfigured’.

Depending on the configuration, DHCP packets received on unconfigured interfaces are dropped.

If the DHCP packets are dropped on ‘unconfigured’ interface, you will receive the message like:

Example: Configure DHCP Relay in Forward Only Mode

The example shows how to configure a “stateless” (“forward-only”) DHCP Relay on Enhanced Layer 2 Software (ELS) EX Series and QFX Series switches. If your switch runs software that does not support ELS, see Configuring Interface Ranges. For ELS details, see Using the Enhanced Layer 2 Software CLI.

Requirements

This example uses the following hardware and software components:

  • QFX or EX Series Switches (ELS mode).

  • Junos OS Release 18.4R3.

Before you configure forward-only DHCP relay on EX Series and QFX Series switches, lets understand about Option 82 support on DHCP.

To verify whether your device supports DHCP Option-82, see Check if Your Device Support DHCP Option-82.

The following messages from the DHCP server include a copy of the Option 82 information on sent by the DHCP Relay in the Discover and Request messages:

  • Offer

  • Acknowledgement (ACK)

  • Negative acknowledgment (NACK)

The DHCP relay discards any OFFER, ACK, and NACK messages that do not include a valid Option 82 information.

On how to avoid dropping of DHCP offer message when PXE or BOOTP servers do not support Option-82, see Managing Your DHCP PXE/BOOTP Servers That Do Not Support Option-82.

Overview

In this example, we are configuring a switching device to act as DHCP relay agent by completing the following steps:

  1. Add a set of DHCP server IP addresses configured as active server groups.

  2. Configure the option 82 support for a named group of interfaces.

After you configure the example, the DHCP relay agent includes option 82 information in the DHCP packets that it receives from the clients and forwards to the DHCP server.

Configuration

To configure a forward-only DHCP relay agent on a ELS supported EX or QFX switches, perform these tasks:

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them in a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the command into the CLI at the [edit] hierarchy level.

Configure forward-only' DHCP Relay Agent

Step-by-Step Procedure

To configure forward-only DHCP relay:

  1. Specify the name of the server group, SV1 and SV2.
  2. Add the IP addresses of the DHCP servers belonging to the group.
  3. (Optional) In enterprise scenario, you can use the Preboot Execution Environment (PXE) or BOOTP for a PC (or other devices) to get its Junos OS from a server.
    • If you want to enable BOOTP support when the switch is configured to be a DHCP relay agent, enter the following statement:

    • Add a DHCP or PXE Servers to the DHCP Servers group

  4. Apply the server group as an active server group.
  5. Define DHCP-FO as interface group on your switching device acting as DHCP relay. Configure:
  6. Add a list of interfaces to the interface group.
  7. Set relay option 82 to interfaces and specify Agent circuit ID. Agent Circuit ID identifies the interface on which the client DHCP packet is received. When you configure circuit ID, the include the textual interface description in the message.

Results

From configuration mode, confirm the results of your configuration by issuing the show statement at the [edit forwarding-options] hierarchy level. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit forwarding-options]
user@host> show

If you are done configuring the device, enter commit from configuration mode.

Verification

Verify if the messages from the DHCP server includes a copy of the Option 82 information sent by the DHCP relay.

Verifying the Offer message with Option-82

Purpose

Verify the “forward-only” DHCP Relay by enabling the dhcp traceoptions on the DHCP Relay.

Action

  • Receive the output of the tracing operation in the specified file.

    user@host# set system processes dhcp-service traceoptions file dhcp_logfile size 10m
    user@host# set system processes dhcp-service traceoptions level all
    user@host# set system processes dhcp-service traceoptions flag all
  • You can use the following commands to search for problems in the DHCP traceoptions log file (in this example, ‘dhcp_logfile’).

    • To get an overview of most common problems, use:

      user@host> show log dhcp_logfile | match "dropp|fail|unconf" | except "packet_dropped No"
    • To investigate a specific problem, use:

      user@host> show log dhcp_logfile | find " arrived on unconfigured interface"

      The find command is similar to Linux less command. It will reach the first entry in the log and allow you to scroll up/down the message.

  • (Optional) To query the traceoptions logs on a Linux sever (or from the Junos shell), you can use both the following commands:

    user@host> egrep -i "dropp|fail|unconf" dhcp_logfile | egrep -v "packet_dropped No" | more
    user@host> egrep -i -b 5 " arrived on unconfigured interface" dhcp_logfile | more

Meaning

The above sample confirms that the messages from the DHCP server includes a copy of the Option 82 information sent by the DHCP relay and the sample also displays the textual description of the interface.