Technical Documentation

Overriding the Default DHCP Relay Configuration Settings

Subscriber management enables you to override certain default DHCP relay agent configuration settings. You can override the settings at the global level, for a named group of interfaces, or for a specific interface within a named group.

  • To override global default DHCP relay agent configuration options, include the overrides statement and its subordinate statements at the [edit forwarding-options dhcp-relay] hierarchy level.
  • To override DHCP relay configuration options for a named group of interfaces, include the statements at the [edit forwarding-options dhcp-relay group group-name] hierarchy level.
  • To override DHCP relay configuration options for a specific interface within a named group of interfaces, include the statements at the [edit forwarding-options dhcp-relay group group-name interface] hierarchy level.

To override default DHCP relay agent configuration settings:

  1. Specify that you want to configure override options.

    Global override:

    [edit forwarding-options dhcp-relay]user@host# edit overrides

    Group level override:

    [edit forwarding-options dhcp-relay]user@host# edit group boston overrides

    Per-interface override:

    [edit forwarding-options dhcp-relay]user@host# edit group boston overrides interface fe-1/0/1.2
  2. (Optional) Enable DHCP relay proxy mode.

    See Enabling DHCP Relay Proxy Mode.

  3. (Optional) Overwrite the giaddr in DHCP packets the DHCP relay agent forwards.

    See Overwriting giaddr Information.

  4. (Optional) Replace the IP source address in DHCP relay request and release packets with the gateway IP address (giaddr).

    See Replacing the DHCP Relay Request and Release Packet Source Address.

  5. (Optional) Override the DHCP relay agent information option (option 82) in DHCP packets.

    See Overriding Option 82 Information.

  6. (Optional) Override the setting of the broadcast bit in DHCP request packets and use the Layer 2 unicast transmission method.

    See Using Layer 2 Unicast Transmission for DHCP Packets.

  7. (Optional) Trust DHCP client packets that have a giaddr of 0 and that contain option 82 information.

    See Trusting Option 82 Information.

  8. (Optional) Override ARP table population in distrusted environments.

    See Disabling ARP Table Population.

  9. (Optional) Override the maximum number of DHCP clients allowed per interface.

    See Specifying the Maximum Number of DHCP Clients Per Interface.

  10. (Optional) Configure client auto logout.

    See DHCP Auto Logout Overview.

  11. Enable or disable support for DHCP snooped clients on interfaces.

    See Allowing DHCP Snooped Clients on Interfaces.

  12. (Optional) Disable DHCP relay agent on specific interfaces.

    See Disabling DHCP Relay.

  13. (Optional) Send release messages to the DHCP server when clients are deleted.

    See Sending Release Messages When Clients Are Deleted.

This topic contains the following sections:

Overwriting giaddr Information

You can configure the DHCP relay agent to change the gateway IP address (giaddr) field in packets that it forwards between a DHCP client and a DHCP server.

To overwrite the giaddr of every DHCP packet with the giaddr of the DHCP relay agent before forwarding the packet to the DHCP server:

  1. Specify that you want to configure override options.
    [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Specify that the giaddr of DHCP packets is overwritten.
    [edit forwarding-options dhcp-relay overrides]user@host# set always-write-giaddr

Replacing the DHCP Relay Request and Release Packet Source Address

You can configure the DHCP relay agent to replace request and release packets with the gateway IP address (giaddr) before forwarding the packet to the DHCP server.

To replace the source address with giaddr:

  1. Specify that you want to configure override options.
    [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Specify that you want to replace the IP source address in DHCP relay request and release packets with the gateway IP address (giaddr).
    [edit forwarding-options dhcp-relay overrides]user@host# set replace-ip-source-with giaddr

Overriding Option 82 Information

You can configure the DHCP relay agent to add or remove the DHCP relay agent information option (option 82) in DHCP packets.

This feature causes the DHCP relay agent to perform one of the following actions, depending on the configuration:

  • If the DHCP relay agent is configured to add option 82 information to DHCP packets, it clears the existing option 82 values from the DHCP packets and inserts the new values before forwarding the packets to the DHCP server.
  • If the DHCP relay agent is not configured to add option 82 information to DHCP packets, it clears the existing option 82 values from the packets, but does not add any new values before forwarding the packets to the DHCP server.

To override the default option 82 information in DHCP packets destined for a DHCP server:

  1. Specify that you want to configure override options.
    [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Specify that the option 82 information in DHCP packets is overwritten.
    [edit forwarding-options dhcp-relay overrides]user@host# set always-write-option-82

Using Layer 2 Unicast Transmission for DHCP Packets

You can configure the DHCP relay agent to override the setting of the broadcast bit in DHCP request packets. DHCP relay agent then instead uses the Layer 2 unicast transmission method to send DHCP Offer reply packets and DHCP ACK reply packets from the DHCP server to DHCP clients during the discovery process.

To override the default setting of the broadcast bit in DHCP request packets:

  1. Specify that you want to configure override options.
    [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Specify that the DHCP relay agent uses the Layer 2 unicast transmission method.
    [edit forwarding-options dhcp-relay overrides]user@host# set layer2-unicast-replies

Trusting Option 82 Information

By default, the DHCP relay agent treats client packets with a giaddr of 0 (zero) and option 82 information as if the packets originated at an untrusted source, and drops them without further processing. You can override this behavior and specify that the DHCP relay agent process DHCP client packets that have a giaddr of 0 (zero) and contain option 82 information.

To configure DHCP relay agent to trust option 82 information:

  1. Specify that you want to configure override options.
    [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Specify that the DHCP relay agent process DHCP client packets with a giaddr of 0 and that contain option 82 information.
    [edit forwarding-options dhcp-relay overrides]user@host# set trust-option-82

Disabling ARP Table Population

By default, DHCP populates the ARP table with the MAC address of a client when the client binding is established. However, you may choose to use the DHCP no-arp statement to hide the subscriber MAC address information, as it appears in ARP table entries.

When running in a trusted environment (that is, when not using the no-arp statement), DHCP populates the ARP table with unique MAC addresses contained within the DHCP PDU for each DHCP client:

Table 1: ARP Table in Trusted Environment

IP Address

MAC Address

Client 1 IP Address

MAC A

Client 2 IP Address

MAC B

Client 3 IP Address

MAC C

In distrusted environments, you can specify the no-arp statement to hide the MAC addresses of clients. When you specify the no-arp statement, DHCP does not automatically populate the ARP table with MAC address information from the DHCP PDU for each client. Instead, the system performs an ARP to obtain the MAC address of each client and obtains the MAC address of the immediately-attached device (for example, a DSLAM). DHCP populates the ARP table with the same interface MAC address (for example, MAC X from a DSLAM interface) for each client:

Table 2: ARP Table in Distrusted Environment

IP Address

MAC Address

Client 1 IP Address

MAC X

Client 2 IP Address

MAC X

Client 3 IP Address

MAC X

To disable ARP table population:

  1. Specify that you want to configure override options.
    • For DHCP local server:
      [edit system services dhcp-local-server]user@host# edit overrides
    • For DHCP relay:
      [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Disable ARP table population with client-specific information. (DHCP local server and DHCP relay agent both support the no-arp statement.)
    • For DHCP local server:
      [edit system services dhcp-local-server overrides]user@host# set no-arp
    • For DHCP relay:
      [edit forwarding-options dhcp-relay overrides]user@host# set no-arp

Specifying the Maximum Number of DHCP Clients Per Interface

By default, there is no limit to the number of DHCP local server or DHCP relay clients allowed on an interface. However, you can override the default setting and specify the maximum number of clients allowed per interface, in the range 1 through 500,000. When the number of clients on the interface reaches the specified limit, no additional DHCP Discover PDUs or DHCPv6 Solicit PDUs are accepted. When the number of clients subsequently drops below the limit, new clients are again accepted.

Note: The maximum number of DHCP (and DHCPv6) local server clients or DHCP relay clients can also be specified by Juniper Networks VSA 26-143 during client login. The VSA-specified value always takes precedence if the interface-client-limit number statement specifies a different number.

If the VSA-specified value differs with each client login, DHCP uses the largest limit set by the VSA until there are no clients on the interface.

To configure the maximum number of DHCP clients allowed per interface:

  1. Specify that you want to configure override options.
    • For DHCP local server:
      [edit system services dhcp-local-server]user@host# edit overrides
    • For DHCPv6 local server:
      [edit system services dhcp-local-server dhcpv6]user@host# edit overrides
    • For DHCP relay agent:
      [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Configure the maximum number of clients allowed per interface. (DHCP local server, DHCPv6 local server, and DHCP relay agent all support the interface-client-limit statement.)
    [edit system services dhcp-local-server overrides]user@host# set interface-client-limit number

Allowing DHCP Snooped Clients on Interfaces

You can explicitly enable or disable DHCP snooping support on specific interfaces the router and override the default configuration. If you disable DHCP snooping support, the interface drops snooped DHCP discover and request messages. You can manage DHCP snooping support globally, for a named group of interfaces, or for a specific interface within a named group.

Note: In JUNOS release 10.0 and earlier, DHCP snooping is enabled by default. In releases 10.1 and later, DHCP snooping is disabled by default.

  • To enable DHCP snooping support, include the allow-snooped-clients option to the overrides statement at the global, group, or interface hierarchy level.
  • To disable DHCP snooping support, include the no-allow-snooped-clients option to the overrides statement.

The following two examples show a configuration that enables DHCP snooping support for a group of interfaces and a configuration that disables support on a specific interface.

To enable DHCP snooping support on a group of interfaces:

  1. Specify the named group.
    [edit forwarding-options dhcp-relay]user@host# edit group boston
  2. Specify that you want to configure overrides.
    [edit forwarding-options dhcp-relay group boston]user@host# edit overrides
  3. Enable DHCP snooping support.
    [edit forwarding-options dhcp-relay group boston overrides]user@host# set allow-snooped-clients

To disable DHCP snooping support on a specific interface:

  1. Specify the named group of which the interface is a member.
    [edit forwarding-options dhcp-relay]user@host# edit group boston
  2. Specify the interface on which you want to disable DHCP snooping support.
    [edit forwarding-options dhcp-relay group boston]user@host# edit interface fe-1/0/1.2
  3. Specify that you want to configure overrides.
    [edit forwarding-options dhcp-relay group boston interface fe-1/0/1.2]user@host# edit overrides
  4. Disable DHCP snooping support on the interface.
    [edit forwarding-options dhcp-relay group boston interface fe-1/0/1.2 overrides]user@host# set no-allow-snooped-clients

Sending Release Messages When Clients Are Deleted

By default, when DHCP relay and relay proxy delete a client, they do not send a release message to the DHCP server. You can override the default behavior and configure DHCP relay and relay proxy to send a release message whenever they delete a client. The release message sent by DHCP relay and relay proxy includes option 82 information.

Note: In releases prior to JUNOS Release 10.2, DHCP relay sent a release message to the DHCP server due to the client-discover-match configuration. This is no longer the case. Starting with JUNOS Release 10.2 you must include the send-release-on-delete statement to configure DHCP relay and relay proxy to send the release message for client-discover-match configurations.

To send a release message:

  1. Specify that you want to configure overrides.
    [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Specify that you want DHCP relay and relay proxy to send a release message when clients are deleted.
    [edit forwarding-options dhcp-relay overrides]user@host# set send-release-on-delete

Disabling DHCP Relay

You can disable DHCP relay on all interfaces or a group of interfaces.

To disable DHCP relay agent:

  1. Specify that you want to configure override options.
    [edit forwarding-options dhcp-relay]user@host# edit overrides
  2. Disable the DHCP relay agent.
    [edit forwarding-options dhcp-relay overrides]user@host# set disable-relay

Published: 2010-04-15