In dual-DHCP server environments, commonly deployed across separated data centers for redundancy, leases are
synchronized between servers to ensure continuity.

 
 A DHCP client may initially receive an IP lease from DHCP Server A, and SRX will track this binding using the DHCP_CLIENT_IP, MAC, DHCP_SERVER_IDENTIFIER (typically the IP of Server A).If the client is later factory reset or reinitialized, it may send a new DHCPDISCOVER and receive a valid offer or ACK from DHCP Server B, which holds the same lease due to synchronization.

However, by default, SRX enforces strict binding validation. If the DHCP_SERVER_IDENTIFIER in the incoming ACK does not match the original server tracked in the binding, SRX will drop the packet, even if both servers are listed in the Relay configuration. This results in failed lease renewal or assignment, despite the DHCP infrastructure functioning correctly. 

This behavior is logged as:

[MSTR][DEBUG] jdhcpd_packet_ack_server_mismatch: Dropping ACK with null ciaddr and server-identifier mismatch
[MSTR][DEBUG] jdhcpd_packet_handle: Dropping ACK due to server-identifier mismatch

To resolve this, administrators can either disable binding tracking using forward-only, or enable allow-server-change to permit ACKs from any server in the active group.

1-Enable forwarding for the active server group:

[edit forwarding-options dhcp-relay active-server-group]

 user@host# set allow-server-change

2-Disable binding tracking

[edit]

user@host# set forwarding-options dhcp-relay forward-only 

09/30/2025: Article created

Related KB77516 [juniper.net]