ON THIS PAGE
Example: Configuring a DHCP Firewall Filter to Protect the Routing Engine
This example shows how to configure a firewall filter to ensure that proper DHCP packets can reach the Routing Engine on MX Series routers.
Requirements
This configuration example applies only to routers where DHCP local server and DHCP relay agent services are provided by the jdhcpd process rather than the legacy dhcpd process or fud (UDP forwarding) process. MX Series routers, M120 routers, and M320 routers use jdhcpd. For DHCP relay, that means the configuration is required only at the [edit forwarding-options dhcp-relay] hierarchy level and not at the [edit forwarding-options helpers bootp] hierarchy level.
No special configuration beyond device initialization is required before you can configure this feature.
Overview
Firewall filters that perform some action on DHCP packets at the Routing Engine, such as a filter to protect the Routing Engine by allowing only proper DHCP packets, require that both port 67 (bootps) and port 68 (bootpc) are configured as both source and destination ports.
DHCP packets received on the line cards are encapsulated by jdhcpd with a new UDP header where their source and destination addresses are set to port 68 before being forwarded to the Routing Engine. For DHCP relay and DHCP proxy, packets sent to the DHCP server from the router have both the source and destination UDP ports set to 67. The DHCP server responds using the same ports. However, when the line card receives these DHCP response packets, it changes both port numbers from 67 to 68 before passing the packets to the Routing Engine. Consequently the filter needs to accept port 67 for packets relayed from the client to the server, and port 68 for packets relayed from the server to the client.
In this example, you configure two filter terms, dhcp-client-accept and dhcp-server-accept. The match conditions for dhcp-client-accept specify a source address and destination address for broadcast packets, the UDP protocol used for DHCP packets, and the bootpc (68) source port. Packets that match these conditions are counted and accepted. This term does not need to specify a match condition for the boot ps (67) destination port. As configured below, this term can handle both the actual packet (port 68) passing to the Packet Forwarding Engine and the encapsulated packet (port 67 converted to 68 by jdhcpd) that reaches the DHCP daemon.
The match conditions for dhcp-server-accept specify the UDP protocol used for DHCP packets, and both port 67 and 68 for both source port and destination port. Packets that match these conditions are counted and accepted.
This example does not show all possible configuration choices, nor does it show how the filter is applied in your configuration. This example applies to both static application of the filter as well as dynamic application with a dynamic profile.
Configuration
Procedure
CLI Quick Configuration
To quickly configure the sample Routing Engine DHCP filter, copy the following commands, paste them in a text file, remove any line breaks, and then copy and paste the commands into the CLI.
[edit] edit firewall family inet filter RE-protect edit term dhcp-client-accept set from source-address 0.0.0.0/32 set from destination-address 255.255.255.255/32 set from protocol udp set from source-port 68 set then count dhcp-client-accept set then accept up edit term dhcp-server-accept set from protocol udp set from source-port 67 set from source-port 68 set from destination-port 67 set from destination-port 68 set then count dhcp-server-accept set then accept top
Step-by-Step Procedure
The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.
To configure a DHCP firewall filter to protect the Routing Engine:
Create or specify a firewall filter.
[edit firewall] user@host# edit family inet filter RE-protect
Create a filter term for the client.
[edit firewall family inet filter RE-protect] user@host# edit term dhcp-client-accept
Specify the match conditions for DHCP packets.
[edit firewall family inet filter RE-protect term dhcp-client-accept] user@host# set from source-address 0.0.0.0/32 user@host# set from destination-address 255.255.255.255/32 user@host# set from protocol udp user@host# set from source-port 68 user@host# set from destination-port 67
Specify the action to take for matched packets.
[edit firewall family inet filter RE-protect term dhcp-client-accept] user@host# set then count dhcp-client-accept user@host# set then accept
Create a filter term for the server.
[edit firewall family inet filter RE-protect] user@host# edit term dhcp-server-accept
Specify the match conditions for DHCP packets.
[edit firewall family inet filter RE-protect term dhcp-server-accept] user@host# set from protocol udp user@host# set from source-port [67 68] user@host# set from destination-port [67 68]
Specify the action to take for matched packets.
[edit firewall family inet filter RE-protect term dhcp-server-accept] user@host# set then count dhcp-client-accept user@host# set then accept
Results
From configuration mode, confirm your configuration by entering the show firewall command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.
[edit]
user@host# show firewall
family inet {
filter RE-protect {
term dhcp-client-accept {
from {
source-address {
0.0.0.0/32;
}
destination-address {
255.255.255.255/32;
}
protocol udp;
source-port 68;
destination-port 67;
}
then {
count dhcp-client-accept;
accept;
}
}
term dhcp-server-accept {
from {
protocol udp;
source-port [ 67 68 ];
destination-port [ 67 68 ];
}
then {
count dhcp-server-accept;
accept;
}
}
}
}
If you are done configuring the device, enter commit from configuration mode.
Verification
To confirm that the Routing Engine DHCP protection filter is properly passing DHCP packets, perform these tasks:
Verifying the DHCP Filter Operation
Purpose
Verify that both counters increment as DHCP traffic passes to the Routing Engine.
Action
From operational mode, enter the show firewall family inet filter RE-protect command.
user@host> show firewall family inet filter RE-protect Filter: RE-protect Counters: Name Bytes Packets dhcp-client-accept 328 1 dhcp-server-accept 574 1 user@host> show firewall family inet filter RE-protect Filter: RE-protect Counters: Name Bytes Packets dhcp-client-accept 660 2 dhcp-server-accept 1152 2
Meaning
The output lists both configured counters, dhcp-client-accept and dhcp-server-accept. By issuing the command more than once, you can see that the byte and packet fields both show that traffic is being accepted and counted.