DHCP OFFER packets are forwarded with Option 82 in inter-VRF multi-relay deployments

ex4600-40f

Working Junos: 21.4R3-S3.4
On 21.4R3-S3.4, after the server sends the DHCP Offer, Relay agent removes Option 82 before forwarding the packet to the client. This is working as expected

Non-Working Junos: 21.4R3-S11.3
On 21.4R3-S11.3, Relay agent does not remove Option 82, and forwards the packet with Option 82 still included. This abnormal behaviour. Before the upgrade, users in VLAN 10 obtain IP addresses normally.

However, after upgrading to 21.4R3-S11.3, all users in VLAN 10 are failing to receive IP addresses. Based on our packet capture (pcap) analysis, we identified the following: On 21.4R3-S3.4: The relay agent did not insert Option 82 information for VLAN 10 packets sent to the client. On 21.4R3-S11.3: The relay agent now inserts Option 82 information into packets for VLAN 10.

set routing-instances TEST forwarding-options dhcp-relay forward-only routing-instance current

• This issue occurs only when DHCP clients and DHCP servers reside in different VRFs and one or more transit relay agents exist between them.
• By default, DHCP relay agent is expected to strip Option 82 from the server reply before forwarding it to the client. But when this issue occurs, DHCP OFFER packets received from the server and will be incorrectly processed by the relay agent connected to the client.
• When the DHCP OFFER packet arrives from the server VRF, the destination IP address corresponds to the relay interface in the client VRF.
• The relay incorrectly treats the packet as transit traffic rather than a reply destined for local relay processing. As a result, the relay forwards the OFFER packet toward the client without removing DHCP Option 82 information.
• The issue can be identified by capturing DHCP traffic on the client-facing relay interface and verifying that DHCP OFFER or ACK packets forwarded to the client still contain Option 82 information as shown below:

user@host>monitor traffic interface <client-facing-interface> no-resolve matching "port 67 or port 68"

OFFER/ACK packets forwarded toward the client still contain Relay Agent Information Option (Option 82)

External-TriggerThis issue might be seen if the following conditions are met:

* On all Junos and Junos OS Evolved platforms

* DHCP relay agent configuration with Option 82 enabled

* Clients and DHCP servers are in different VRFs

* DHCP traffic traverses multiple relay agents between the client and server

• Resolved-In
• evo:26.3R1-EVO junos:26.3R1
• https://prsearch.juniper.net/#!/search?page=prcontent&id=PR1946278
• Note: Future release list will be updated on the PR.