DHCP

DHCP Relay

The following is a sample DHCP relay configuration that defines DHCP server address, binds a DHCP relay group to the server group, and adds client-facing interfaces to the DHCP relay group:

Additionally, you can enable the following DHCP relay configurations at the [edit forwarding-options dhcp-relay group group-name] hierarchy level:

• overrides allow-snooped-clients—Enable DHCP snooping support for the relay group.
• forward-snooped-clients configured-interfaces—Forward snooped packets only on interfaces that belong to the configured group.
  • If you want snooped packets handled on all interfaces, use the set forwarding-options dhcp-relay forward-snooped-clients all-interfaces configuration statement.
  • If you want snooped packets handled only on interfaces that is not in the relay group, use the set forwarding-options dhcp-relay forward-snooped-clients non-configured-interfaces configuration statement.
• relay-option-82 circuit-id use-interface-description—Insert interface description information into Option 82 if required.

DHCP Relay No-Snoop (optional)

The DHCP relay no-snoop feature enhances network performance by preventing the DHCP relay agent from processing unicast packets related to DHCP lease renewals at the CPU level. DHCP traffic is handled at the hardware level using dynamic firewall filters, significantly reducing CPU load and optimizing system performance.

To enable the DHCP relay no-snoop feature, include the no-snoop configuration statement at the [edit forwarding-options dhcp-relay] hierarchy level.

For more information, see Understanding DHCP Relay No-Snoop.

Verify DHCP Relay

Use the following commands to verify the DHCP relay configuration:

• show configuration forwarding-options dhcp-relay—Confirm the committed relay and snooping settings.
• show forwarding-options dhcp-relay statistics—Verify relay activity and packet handling.
• show dhcp relay statistics—Verify relay activity and packet handling.

DHCP Limitations on ACX7000 Family of Routers

On ACX7000 family of routers, DHCP relay filtering is enabled using global hardware filters rather than per-VRF filter instances. As a result, DHCP packet processing is determined by a global hardware filter policy, regardless of the routing instance where the DHCP configuration is applied.

• When the DHCP no-snoop statement at the [edit forwarding-options dhcp-relay] hierarchy is not enabled, DHCP relay filters are installed on the hardware. All DHCP packets, including unicast server replies, are sent to the Routing Engine for relay processing. Cross-VRF DHCP relay is supported, including forward-only designs using Option 82 or interface identifier.
• When the DHCP no-snoop statement at the [edit forwarding-options dhcp-relay] hierarchy is enabled, ACX installs no-snoop filters globally. Unicast transit DHCP packets are ignored and are not sent to the Routing Engine for relay processing. ACX enforces VRF local forwarding checks.

Because the no-snoop filter is applied at the global level and takes precedence over DHCP relay behavior:

• Enabling no-snoop statement in a single VRF affects DHCP processing in all VRFs.
• In cross-VRF DHCP relay deployments without route leaking, DHCP server unicast replies (OFFER/ACK) are dropped before reaching the relay process.
• Since the packet never reaches the DHCP relay application, relay features such as forward-only-replies are not invoked and cannot recover the session.

Cross-VRF DHCP relay with no-snoop enabled is not supported unless the server VRF has reachability to the destination address. Otherwise, DHCP OFFER and ACK messages are dropped in hardware, preventing successful DHCP address assignment.