Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?


Example: Configuring a DHCP Firewall Filter to Protect the Routing Engine

This example shows how to configure a firewall filter to ensure that proper DHCP packets can reach the Routing Engine on MX Series routers.


This configuration example applies only to routers where DHCP local server and DHCP relay agent services are provided by the jdhcpd process rather than the legacy dhcpd process or fud (UDP forwarding) process. MX Series routers, M120 routers, and M320 routers use jdhcpd. For DHCP relay, that means the configuration is required only at the [edit forwarding-options dhcp-relay] hierarchy level and not at the [edit forwarding-options helpers bootp] hierarchy level.

No special configuration beyond device initialization is required before you can configure this feature.


Firewall filters that perform some action on DHCP packets at the Routing Engine, such as a filter to protect the Routing Engine by allowing only proper DHCP packets, require that both port 67 (bootps) and port 68 (bootpc) are configured as both source and destination ports.

DHCP packets received on the line cards are encapsulated by jdhcpd with a new UDP header where their source and destination addresses are set to port 68 before being forwarded to the Routing Engine. For DHCP relay and DHCP proxy, packets sent to the DHCP server from the router have both the source and destination UDP ports set to 67. The DHCP server responds using the same ports. However, when the line card receives these DHCP response packets, it changes both port numbers from 67 to 68 before passing the packets to the Routing Engine. Consequently the filter needs to accept port 67 for packets relayed from the client to the server, and port 68 for packets relayed from the server to the client.

In this example, you configure two filter terms, dhcp-client-accept and dhcp-server-accept. The match conditions for dhcp-client-accept specify a source address and destination address for broadcast packets, the UDP protocol used for DHCP packets, and the bootpc (68) source port. Packets that match these conditions are counted and accepted. This term does not need to specify a match condition for the boot ps (67) destination port. As configured below, this term can handle both the actual packet (port 68) passing to the Packet Forwarding Engine and the encapsulated packet (port 67 converted to 68 by jdhcpd) that reaches the DHCP daemon.

The match conditions for dhcp-server-accept specify the UDP protocol used for DHCP packets, and both port 67 and 68 for both source port and destination port. Packets that match these conditions are counted and accepted.


This example does not show all possible configuration choices, nor does it show how the filter is applied in your configuration. This example applies to both static application of the filter as well as dynamic application with a dynamic profile.



CLI Quick Configuration

To quickly configure the sample Routing Engine DHCP filter, copy the following commands, paste them in a text file, remove any line breaks, and then copy and paste the commands into the CLI.

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

To configure a DHCP firewall filter to protect the Routing Engine:

  1. Create or specify a firewall filter.

  2. Create a filter term for the client.

  3. Specify the match conditions for DHCP packets.

  4. Specify the action to take for matched packets.

  5. Create a filter term for the server.

  6. Specify the match conditions for DHCP packets.

  7. Specify the action to take for matched packets.


From configuration mode, confirm your configuration by entering the show firewall command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

If you are done configuring the device, enter commit from configuration mode.


To confirm that the Routing Engine DHCP protection filter is properly passing DHCP packets, perform these tasks:

Verifying the DHCP Filter Operation


Verify that both counters increment as DHCP traffic passes to the Routing Engine.


From operational mode, enter the show firewall family inet filter RE-protect command.


The output lists both configured counters, dhcp-client-accept and dhcp-server-accept. By issuing the command more than once, you can see that the byte and packet fields both show that traffic is being accepted and counted.