Secure DHCP Message Exchange
Junos OS allows you to use the DHCP relay agent to provide secure message exchange between different virtual routing and forwarding instances (VRFs). To enable secure exchange of DHCP messages, you must configure both the server side and the client side of the DHCP relay agent to recognize and forward acceptable traffic based on DHCP option information. For more information, read this topic.
DHCP Message Exchange Between DHCP Clients and DHCP Server in Different VRFs
In some service provider networks, the service network in which the DHCP server resides is isolated from the actual subscriber network. This separation of the service and subscriber networks can sometimes introduce potential security issues, such as route leaking.
Starting in Junos OS Release 14.2, you can use the DHCP relay agent to provide additional security when exchanging DHCP messages between different virtual routing and forwarding instances (VRFs). The DHCP relay agent can ensure that there is no direct routing between the client VRF and the DHCP server VRF, and that only acceptable DHCP packets are relayed across the two VRFs. Subscriber management supports the cross-VRF message exchange for both DHCP and DHCPv6 packets.
To exchange DHCP messages between different VRFs, you must enable both the server-side and the client-side of the DHCP relay agent to recognize and forward acceptable traffic based on DHCP option information in the packets. The message exchange uses the following DHCP options to identify the traffic to be relayed.
Agent Circuit ID (DHCP option 82 suboption 1) for DHCPv4 packets
Relay Agent Interface-ID (DHCPv6 option 18) for DHCPv6 packets
Statistics for DHCP packets using the cross-VRF message exchange are counted in the client VRF.
The following list describe how DHCP relay agent exchanges messages between the DHCP clients and DHCP server in different VRFs:
Packets from DHCP client to DHCP server—DHCP relay agent receives the DHCP packet from the client in the client VRF, and then inserts the appropriate DHCP option 82 suboption 1 or DHCPv6 option 18 attribute into the packet. The relay agent then forwards the packet to the DHCP server in the server’s VRF.
Packets from DHCP server to DHCP client—DHCP relay agent receives the DHCP reply message from the DHCP server in the server VRF. The relay agent derives the client’s interface, including VRF, from the DHCP option 82 suboption 1 or DHCPv6 option 18 attribute in the packet in the DHCP server VRF. The relay agent then forwards the reply message to the DHCP client in the client’s VRF.
Configuring DHCP Message Exchange Between DHCP Server and Clients in Different Virtual Routing Instances
Starting in Junos OS Release 14.2, you can configure DHCP relay agent to provide additional security when exchanging DHCP messages between a DHCP server and DHCP clients that reside in different virtual routing and forwarding instances (VRFs).
You can configure DHCP relay agent to provide additional security when exchanging DHCP messages between a DHCP server and DHCP clients that reside in different virtual routing instances. This type of configuration is for a stateless DHCP relay connection between a DHCP server and a DHCP client, when the DHCP server resides in a network that must be isolated from the client network.
A stateless DHCP relay agent does not maintain dynamic state information about the DHCP clients and does not maintain a static route for the traffic to flow between the client and server routing instances.
To enable the DHCP message exchange between the two VRFs, you configure each side of the DHCP relay to recognize and forward acceptable traffic based on the DHCP option information in the packets. The acceptable traffic is identified by either the Agent Circuit ID (DHCP option 82 suboption 1) for DHCPv4 packets or the Relay Agent Interface-ID (DHCPv6 option 18) for DHCPv6 packets.
The following list provides an overview of the tasks required to create the DHCP message exchange between the different VRFs:
Client-side support—Configure the DHCP relay agent
forward-onlystatement to specify the VRF location of the DHCP server, to which the DHCP relay agent forwards the client packets with the appropriate DHCP option information. Theforward-onlystatement ensures that DHCP relay agent does not create a new session or perform any other subscriber management operations (such as creating dynamic interfaces or maintaining leases).You can optionally configure a specific logical system and routing instance for the server VRF. If you do not specify a logical system or routing instance, then DHCP uses the local logical system and routing instance from which the configuration is added.
Server-side support—Configure the DHCP relay agent
forward-only-repliesstatement so the DHCP relay agent forwards the reply packets that have the appropriate DHCP option information. This statement also ensures that DHCP relay agent does not create a new session or perform any other subscriber management operations.Note:You do not need to configure the
forward-only-repliesstatement if the DHCP client and DHCP server reside in the same logical system/routing instance.DHCP local server support—Configure the DHCP local server to support option 82 information in DHCP NAK and forcerenew messages. By default, the two message types do not support option 82.
Additional support—Ensure that the following required support is configured:
Proxy ARP support must be enabled on the server-facing interface in the DHCP server VRF so that the DHCP relay agent can receive and respond to the ARP requests for clients and the client-facing interface in the DHCP server VRF.
Routes must be available to receive the DHCP packets from the DHCP server in the server VRF for the clients reachable in the client VRF.
The following procedures describe the configuration tasks for creating the DHCP message exchange between the DHCP server and clients in different VRFs.
Client-Side Support
To configure support on the client side of the DHCP relay agent:
For local DHCPv4 clients, the DHCP relay agent adds the Agent Circuit ID option. However, if the Agent Circuit ID option is already present in the packet, you must ensure that the DHCP server supports the option 82 Vendor-Specific Information suboption (suboption 9).
If the forward-only statement is configured at the [edit forwarding-options dhcp-relay relay-option] hierarchy
level, then that relay-option action takes precedence over the configuration
of the forward-only statement for the DHCP cross-VRF message
exchange.
Server-Side Support
To configure the cross-VRF message exchange support on the server side of the DHCP relay:
You do not need to configure the forward-only-replies statement if the DHCP client and DHCP server reside in the same
logical system/routing instance.
DHCP Local Server Support
To configure the DHCP local server to support option 82 information in NAK and forcerenew messages; the cross-VRF message exchange feature uses the option 82 or DHCPv6 option 18 information to determine the client VRF: