Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

Example: Setting Up DHCP Option 82 (No Relay)

 

You can use DHCP option 82, also known as the DHCP relay agent information option, to help protect the switch against attacks such as spoofing (forging) of IP addresses and MAC addresses, and DHCP IP address starvation. Option 82 provides information about the network location of a DHCP client, and the DHCP server uses this information to implement IP addresses or other parameters for the client.

Note

DHCP option 82 is not supported on the QFX10000 switches.

You can configure the DHCP option 82 feature in several topologies:

  • The switch, DHCP clients, and DHCP server are all on the same VLAN. The switch forwards the clients' requests to the server and forwards the server's replies to the clients. This topic describes this configuration.

  • The switch functions as a relay agent when the DHCP clients or the DHCP server is connected to the switch through a Layer 3 interface. This means that the relay agent and server can be on different networks–that is, the relay agent can be external. On the switch, these interfaces are configured as routed VLAN interfaces (RVIs) or, the interfaces are configured as integrated routing and bridging (IRB) interfaces. In either case, the switch relays the clients' requests to the server and then forwards the server's replies to the clients. These configurations are described in Example: Setting Up DHCP Option 82.

Before you configure DHCP option 82 on the switch, perform these tasks:

  • Connect and configure the DHCP server.

    Note

    Your DHCP server must be configured to accept DHCP option 82. If the server is not configured for DHCP option 82, the server does not use the DHCP option 82 information in the requests sent to it when it formulates its reply messages.

  • Configure a VLAN on the switch and associate the interfaces on which the clients and the server connect to the switch with that VLAN. See Configuring VLANs for EX Series Switches with ELS Support (CLI Procedure)

Setting Up DHCP Option 82 on the Switch with No Relay (ELS)

Note

This task uses Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does not support ELS, see Setting Up DHCP Option 82 on the Switch with No Relay (non-ELS). For ELS details, see Using the Enhanced Layer 2 Software CLI.

To configure DHCP option 82:

  1. Specify DHCP option 82 for the VLAN that you configured.
    [edit vlans vlan-name forwarding-options dhcp-security]

    user@switch# set option-82
    Note

    If you want to enable DHCP option 82 on all VLANs, you must configure it separately for each specific VLAN.

    The remaining steps are optional.

  2. Configure the prefix for the circuit ID suboption to include the switch’s hostname or the routing instance name for the VLAN:
    [edit vlans vlan-name forwarding-options dhcp-security option-82]

    user@switch# set circuit-id prefix (host-name | routing-instance-name)


  3. Specify that the circuit ID suboption value contains the interface description rather than the interface name (the default):
    [edit vlans vlan-name forwarding-options dhcp-security option-82]

    user@switch# set circuit-id use-interface-description
    Note

    Starting in Junos OS Release 14.1X53-D25, when you use the interface description rather than the interface name, the interface description has to be specified under interface unit.When you use the interface description rather than the interface name, the interface description has to be specified under interface unit ("set interfaces ge-0/0/0 unit 0 description "client"). If you do not do this, then the interface name is used.



  4. Specify that the circuit ID suboption value contains the VLAN ID rather than the VLAN name (the default):
    [edit vlans vlan-name forwarding-options dhcp-security option-82]

    user@switch# set circuit-id use-vlan-id


  5. Specify that the remote ID suboption is included in the DHCP option 82 information:
    [edit vlans vlan-name forwarding-options dhcp-security option-82]

    user@switch# set remote-id


    Note

    If you do not specify a keyword after remote-id, the default value for the remote-id suboption is the interface name.

  6. Specify that the remote ID suboption is the hostname of the switch:
    [edit vlans vlan-name forwarding-options dhcp-security option-82]

    user@switch# set remote-id host-name


  7. Specify that the remote ID suboption value contains the interface description:
    [edit vlans vlan-name forwarding-options dhcp-security option-82]

    user@switch# set remote-id use-interface-description


  8. Specify that the remote ID suboption value contains a character string:
    [edit vlans vlan-name forwarding-options dhcp-security option-82]

    user@switch# set remote-id use-string mystring


  9. Configure a vendor ID suboption:
    • To use the default value (the default value is Juniper), do not type a character string after the vendor-id option keyword:

      [edit vlans vlan-name forwarding-options dhcp-security option-82]

      user@switch# set vendor-id


    • To configure that the vendor ID suboption value contains a character string value that you specify rather than Juniper (the default):

      [edit vlans vlan-name forwarding-options dhcp-security option-82]

      user@switch# set vendor-id use-string mystring


See also

Setting Up DHCP Option 82 on the Switch with No Relay (non-ELS)

Note

This task uses Junos OS for EX Series switches that do not include support for the Enhanced Layer 2 Software (ELS) configuration style. If your switch runs software that does support ELS, see Setting Up DHCP Option 82 on the Switch with No Relay (ELS). For ELS details, see Using the Enhanced Layer 2 Software CLI.

To configure DHCP option 82:

Note

Replace values displayed in italics with values for your configuration.

  1. Specify DHCP option 82 for all VLANs associated with the switch or for a specified VLAN. (You can also configure the feature for a VLAN range.)

    • On a specific VLAN:

      [edit ethernet-switching-options secure-access-port]

      user@switch# set vlan employee dhcp-option82
    • On all VLANs:

      [edit ethernet-switching-options secure-access-port]

      user@switch# set vlan all dhcp-option82


      The remaining steps are optional.

  2. To configure a prefix for the circuit ID suboption (the prefix is always the hostname of the switch):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 circuit-id prefix hostname


  3. To specify that the circuit ID suboption value should contain the interface description rather than the interface name (the default):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 circuit-id use-interface-description


    Note

    When you use the interface description rather than the interface name, the interface description has to be specified under interface unit ("set interfaces ge-0/0/0 unit 0 description "client"). If you do not do this, then the interface name is used.



  4. To specify that the circuit ID suboption value should contain the VLAN ID rather than the VLAN name (the default):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 circuit-id use-vlan-id


  5. To specify that the remote ID suboption be included in the DHCP option 82 information:
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 remote-id


  6. To configure a prefix for the remote ID suboption (here, the prefix is the MAC address of the switch):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 remote-id prefix mac


  7. To specify that the prefix for the remote ID suboption be the hostname of the switch rather than the MAC address of the switch (the default):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 remote-id prefix hostname


  8. To specify that the remote ID suboption value should contain the interface description:
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 remote-id use-interface-description


  9. To specify that the remote ID suboption value should contain a character string:
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 remote-id use-string mystring


  10. To configure a vendor ID suboption and use the default value (the default value is Juniper), do not type a character string after the vendor-id option keyword:
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 vendor-id


  11. To specify that the vendor ID suboption value should contain a character string value that you specify rather than Juniper (the default):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 vendor-id mystring


To view results of the configuration steps before committing the configuration, type the show command at the user prompt.

To commit these changes to the active configuration, type the commit command at the user prompt.

See also

Example: Setting Up DHCP Option 82 Using the Same VLAN

This example describes how to configure DHCP option 82 on a switch with DHCP clients, DHCP server, and switch all on the same VLAN:

Requirements

This example uses the following hardware and software components:

  • One EX Series or QFX Series switch

  • Junos OS Release 9.3 or later for EX Series switches or Junos OS Release 12.1 or later for the QFX Series

  • A DHCP server to provide IP addresses to network devices on the switch

Overview and Topology

If DHCP option 82 is enabled on the switch, then when a network device—a DHCP client—that is connected to the switch on an untrusted interface sends a DHCP request, the switch inserts information about the client's network location into the packet header of that request. The switch then sends the request to the DHCP server. The DHCP server reads the option 82 information in the packet header and uses it to implement the IP address or other parameter for the client.

DHCP option 82 is enabled on an individual VLAN or on all VLANs on the switch.

When option 82 is enabled on the switch, then this sequence of events occurs when a DHCP client sends a DHCP request:

  1. The switch receives the request and inserts the option 82 information in the packet header.
  2. The switch forwards the request to the DHCP server.
  3. The server uses the DHCP option 82 information to formulate its reply and sends a response back to the switch. It does not alter the option 82 information.
  4. The switch strips the option 82 information from the response packet.
  5. The switch forwards the response packet to the client.

Figure 1 illustrates the topology for this example.

Figure 1: Network Topology for Configuring DHCP Option 82 on a Switch That Is on the Same VLAN as the DHCP Clients and the DHCP Server
Network Topology for Configuring DHCP
Option 82 on a Switch That Is on the Same VLAN as the DHCP Clients and the DHCP Server

In this example, you configure DHCP option 82 on the switch. The switch connects to the DHCP server on interface ge-0/0/8. The DHCP clients connect to the switch on interfaces ge-0/0/1, ge-0/0/2, and ge-0/0/3.

The switch, server, and clients are all members of the employee VLAN – be sure to configure the employee VLAN on the switch and associated the interfaces on which the clients and the server connect to the switch with the employee VLAN.

Configuration

CLI Quick Configuration

To quickly configure DHCP option 82, copy the following commands and paste them into the switch terminal window:

set ethernet-switching-options secure-access-port vlan employee dhcp-option82

set ethernet-switching-options secure-access-port vlan employee dhcp-option82 circuit-id prefix hostname

set ethernet-switching-options secure-access-port vlan employee dhcp-option82 circuit-id use-vlan-id

set ethernet-switching-options secure-access-port vlan employee dhcp-option82 remote-id

set ethernet-switching-options secure-access-port vlan employee dhcp-option82 remote-id prefix mac

set ethernet-switching-options secure-access-port vlan employee dhcp-option82 remote-id use-string employee-switch1

set ethernet-switching-options secure-access-port vlan employee dhcp-option82 vendor-id

Step-by-Step Procedure

To configure DHCP option 82:

  1. Specify DHCP option 82 for the employee VLAN:
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82
  2. Configure a prefix for the circuit ID suboption (the prefix is always the hostname of the switch):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 circuit-id prefix hostname


  3. Specify that the circuit ID suboption value contains the VLAN ID rather than the VLAN name (the default):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 circuit-id use-vlan-id


  4. Specify that the remote ID suboption be included in the DHCP option 82 information:
    [edit ethernet-switching-options secure-accesswitch# set vlan employee dhcp-option82 remote-id


  5. Configure a prefix for the remote ID suboption (here, the prefix is the MAC address of the switch):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 remote-id prefix mac


  6. Specify that the remote ID suboption value contain a character string (here, the string is employee-switch1):
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 remote-id use-string employee-switch1


  7. Configure a vendor ID suboption value, and use the default value. To use the default value, do not type a character string after the vendor-id option keyword:
    [edit ethernet-switching-options secure-access-port]

    user@switch# set vlan employee dhcp-option82 vendor-id


Results

Check the results of the configuration:

Release History Table
Release
Description
Starting in Junos OS Release 14.1X53-D25, when you use the interface description rather than the interface name, the interface description has to be specified under interface unit.