Description

This Article explains how to apply RE protect filter for DHCP packets.

Symptoms

If we do not have term to allow packets for DHCP on CP protect filter, and last term is discard it will block/discard all DHCP packets.

Here we show example of configuring DHCP filter term.

Solution

We can add the below terms in RE filter to allow dhcp packets. Make sure it is inserted above last term(which could be DENY-ALL term). Also the configs are with policer.



set firewall family inet filter TEST-RE term FROM-DHCP-CLIENT from destination-address 255.255.255.255/32

set firewall family inet filter TEST-RE term FROM-DHCP-CLIENT from source-port [ bootps bootpc ]

set firewall family inet filter TEST-RE term FROM-DHCP-CLIENT from destination-port [ bootps bootpc ]

set firewall family inet filter TEST-RE term FROM-DHCP-CLIENT then policer LIMIT 1M

set firewall family inet filter TEST-RE term FROM-DHCP-CLIENT then count from_dhcp_client

set firewall family inet filter TEST-RE term FROM-DHCP-CLIENT then accept


set firewall family inet filter TEST-RE term FROM-DHCP-SERVER from source-prefix-list HOSTS

set firewall family inet filter TEST-RE term FROM-DHCP-SERVER from source-port [ bootps bootpc ]

set firewall family inet filter TEST-RE term FROM-DHCP-SERVER from destination-port [ bootps bootpc ]

set firewall family inet filter TEST-RE term FROM-DHCP-SERVER then policer LIMIT 1M

set firewall family inet filter TEST-RE term FROM-DHCP-SERVER then count from_dhcp_server

set firewall family inet filter TEST-RE term FROM-DHCP-SERVER then accept


set firewall policer LIMIT if-exceeding bandwidth-limit 1m

set firewall policer LIMIT if-exceeding burst-size-limit 250k

set firewall policer LIMIT then discard


set policy-options prefix-list HOSTS x.x.x.x/x

Modification History

2026-08-03 : Article Created