[an error occurred while processing this directive] [an error occurred while processing this directive]

Example: Setting Up DHCP Option 82 with an EX Series Switch as Relay Agent Between Clients and a DHCP Server

You can use DHCP option 82, also known as the DHCP relay agent information option, to help protect the EX Series switch against attacks such as spoofing (forging) of IP addresses and MAC addresses, and DHCP IP address starvation. Option 82 provides information about the network location of a DHCP client, and the DHCP server uses this information to implement IP addresses or other parameters for the client.

This example describes how to configure DHCP option 82 on a switch that is on the same VLAN with the DHCP clients but on a different VLAN from the DHCP server; the switch acts as a relay agent:

Requirements

This example uses the following hardware and software components:

  • One EX4200-24P switch
  • JUNOS Release 9.3 or later for EX Series switches
  • A DHCP server to provide IP addresses to network devices on the switch

Before you configure DHCP option 82 on the switch, be sure you have:

  • Connected and configured the DHCP server.

    Note: Your DHCP server must be configured to accept DHCP option 82. If it is not configured for DHCP option 82, it does not use the DHCP option 82 information in the requests sent to it when it formulates its reply messages.

  • Configured the employee VLAN on the switch and associated the interfaces on which the clients connect to the switch with that VLAN. See Configuring VLANs for EX Series Switches (CLI Procedure).
  • Configured the corporate VLAN for the DHCP server.
  • Configured the switch as a BOOTP relay agent. See DHCP/BOOTP Relay for EX Series Switches Overview.
  • Configured the routed VLAN interface (RVI) to allow the switch to relay packets to the server and receive packets from the server. See Configuring Routed VLAN Interfaces (CLI Procedure).

Overview and Topology

If DHCP option 82 is enabled on the switch, then when a network device—a DHCP client—that is connected to the switch on an untrusted interface sends a DHCP request, the switch inserts information about the client's network location into the packet header of that request. The switch then sends the request (in this setting, it relays the request) to the DHCP server. The DHCP server reads the option 82 information in the packet header and uses it to implement the IP address or other parameter for the client.

When option 82 is enabled on the switch, then this sequence of events occurs when a DHCP client sends a DHCP request:

  1. The switch receives the request and inserts the option 82 information in the packet header.
  2. The switch relays the request to the DHCP server.
  3. The server uses the DHCP option 82 information to formulate its reply and sends a response back to the switch. It does not alter the option 82 information.
  4. The switch strips the option 82 information from the response packet.
  5. The switch forwards the response packet to the client.

In this example, you configure option 82 on the EX Series switch. The switch is configured as a BOOTP relay agent. The switch connects to the DHCP server through the routed VLAN interface (RVI) that you configured. The switch and clients are members of the employee VLAN. The DHCP server is a member of the corporate VLAN.

Configuration

To configure DHCP option 82:

CLI Quick Configuration

To quickly configure DHCP option 82, copy the following commands and paste them into the switch terminal window:


set forwarding-options helpers bootp dhcp-option82
set forwarding-options helpers bootp dhcp-option82 circuit-id prefix hostname
set forwarding-options helpers bootp dhcp-option82 circuit-id use-vlan-id
set forwarding-options helpers bootp dhcp-option82 remote-id
set forwarding-options helpers bootp dhcp-option82 remote-id prefix mac
set forwarding-options helpers bootp dhcp-option82 remote-id use-string employee-switch1
set forwarding-options helpers bootp dhcp-option82 vendor-id

Step-by-Step Procedure

To configure DHCP option 82:

  1. Specify DHCP option 82 for the employee VLAN:

    [edit forwarding-options helpers bootp]
    user@switch# set dhcp-option82
  2. Configure a prefix for the circuit ID suboption (the prefix is always the hostname of the switch):

    [edit forwarding-options helpers bootp]
    user@switch# set dhcp-option82 circuit-id prefix hostname

  3. Specify that the circuit ID suboption value contains the VLAN ID rather than the VLAN name (the default):

    [edit forwarding-options helpers bootp]
    user@switch# set dhcp-option82 circuit-id use-vlan-id

  4. Specify that the remote ID suboption be included in the DHCP option 82 information:

    [edit forwarding-options helpers bootp]
    user@switch# set dhcp-option82 remote-id

  5. Configure a prefix for the remote ID suboption (here, the prefix is the MAC address of the switch):

    [edit forwarding-options helpers bootp]
    user@switch# set dhcp-option82 remote-id prefix mac

  6. Specify that the remote ID suboption value contains a character string (here, the string is employee-switch1):

    [edit forwarding-options helpers bootp]
    user@switch# set dhcp-option82 remote-id use-string employee-switch1

  7. Configure a vendor ID suboption value, and use the default value. To use the default value, do not type a character string after the vendor-id option keyword:

    [edit forwarding-options helpers bootp]
    user@switch# set dhcp-option82 vendor-id

Results

Check the results of the configuration:

[edit forwarding-options helpers bootp]
user@switch# show
dhcp-option82 {
circuit-id {
prefix hostname;
use-vlan-id;
}
remote-id {
prefix mac;
use-string employee-switch1;
}
vendor-id;
}

Published: 2009-10-08

[an error occurred while processing this directive]