This article describes how to configure an SRX-Series device as a Dynamic Host Configuration Protocol (DHCP) server and how to verify and troubleshoot your configuration. For other topics, go to the SRX Getting Started main page.
How do I configure an SRX Series device as a Dynamic Host Configuration Protocol (DHCP) server for a subnet?
Note:
Starting with Junos OS 12.1 and later, the DHCP process has been modified to an enhanced process called JDHCP. For DHCP server using JDHCP, refer to KB29401 - [SRX] Example - Configuring SRX with a DHCP server in multiple routing instances [juniper.net]
Starting with Junos OS 12.1 and later, the DHCP process has been modified to an enhanced process called JDHCP.
For DHCP server using JDHCP, refer to KB29401 - [SRX] Example - Configuring SRX with a DHCP server in multiple routing instances [juniper.net]
Note: An SRX-Series device can act as a DHCP client, DHCP server, and DHCP relay agent at the same time, but you cannot configure more than one DHCP role on a single interface.
For information about configuring the device as a DHCP client, see KB15753 - SRX Getting Started - Configure DHCP Client [juniper.net]. For information about configuring the device as a DHCP relay agent, see KB15755 - Getting Started - Configure Global DHCP Relay Service [juniper.net].
Note: This example does not use every option available for DHCP server configuration. For information about additional DHCP server configuration options, see Administration Guide for Security Devices.
To configure an SRX Series device as a DHCP server for a subnet by using J-Web, perform the following steps:
Select Configure > Services > DHCP > DHCP Service.
Click the DHCP Pools tab.
To add a DHCP pool, click Add.
In the Address Pool Subnet text box, enter the subnet for which DHCP is configured (for example, 192.168.1.0/24).
In the Address Range Low text box, enter the lowest IP address of the pool range (for example, 192.168.1.33).
In the Address Range High text box, enter the highest IP address of the pool range (for example, 192.168.1.64).
Expand the Server Information heading.
In the Domain Name text box, enter the domain name to be assigned to DHCP clients (for example, example.net).
In the Name Servers text box (next to the Add button), enter the IP address of a DNS server that the DHCP clients will use (for example, 192.168.1.1).
Click Add. The server appears in the Name Servers list.
In the Gateway Routers text box (next to the Add button), enter the IP address of the router assigned to the clients for the DHCP pool (for example, 192.168.1.1).
Click Add. The router appears in the Gateway Routers list.
Expand the Lease Time heading.
Under Lease Time and Boot Options, in the Default Lease Time text box, enter the number of seconds a client can hold a lease if a client does not request a specific lease length (for example, 3600).
Click OK. The DHCP Pools tab is active.
If you have finished creating DHCP pools, click Apply.
To create additional DHCP pools, repeat this procedure for each pool.
Next, you must specify Dynamic Host Configuration Protocol (DHCP) as an allowed inbound service for each interface that is associated with it. The IP address of the interface must be in the same network as the DHCP pool. For information about configuring an interface, see Junos OS Interfaces Library for Security Devices.
Select Configure > Security > Zones.
Click the security zone that you want to modify (for example, untrust).
Under Interfaces Configuration, select an interface in the zone that is associated with DHCP, and click Edit.
In the Host Inbound Traffic Option section, under System Services, select Allow Selected Services.
In the Allowed Selected Services text box, select dhcp, and click Add.
Click OK.
To apply your changes, click Apply.
Repeat this procedure for each interface that is associated with DHCP.
If you have finished configuring the device, click Commit to commit the configuration.
To configure an SRX Series device as a DHCP server for a subnet by using the Command Line Interface (CLI), perform the following steps:
Specify the lowest IP address of the pool range (for example, 192.168.1.33).
user@host# set system services dhcp pool 192.168.1.0/24 address-range low 192.168.1.33
Specify the highest IP address of the pool range (for example, 192.168.1.64).
user@host# set system services dhcp pool 192.168.1.0/24 address-range high 192.168.1.64
Specify the domain to be specified for DHCP clients (for example, example.net).
user@host# set system services dhcp pool 192.168.1.0/24 domain-name example.net
Specify the DNS server that clients use (for example, 192.168.1.1).
user@host# set system services dhcp pool 192.168.1.0/24 name-server 192.168.1.1
Specify the IP address of the router assigned to the clients for the DHCP pool (for example, 192.168.1.1).
user@host# set system services dhcp pool 192.168.1.0/24 router 192.168.1.1
Specify the number of seconds a client can hold a lease if a client does not request a specific lease length (for example, 3600).
user@host# set system services dhcp pool 192.168.1.0/24 default-lease-time 3600
Specify DHCP as an allowed inbound service for each interface that is associated with DHCP. In the following example, DHCP discovery messages are expected on the fe-0/0/5.0 and fe-0/0/6.0 interfaces, so DHCP is configured as an inbound service for fe-0/0/5.0 and fe-0/0/6.0.
user@host# set security zones security-zone untrust interfaces fe-0/0/5.0 host-inbound-traffic system-services dhcp user@host# set security zones security-zone untrust interfaces fe-0/0/6.0 host-inbound-traffic system-services dhcp
Note: The IP address of the interface must be in the same network as the DHCP pool. For example, if the subnet for the DHCP pool is 192.168.1.0/24, use the set interfaces command to specify the appropriate IP address:
user@host# set interfaces fe-0/0/6 unit 0 family inet address 192.168.1.1/24
To verify the DHCP service configuration, use the following operational commands:
user@host> show system services dhcp pool
For sample output, see show system services dhcp pool.
user@host> show system services dhcp binding
For sample output, see show system services dhcp binding.
user@host> show system services dhcp statistics
For sample output, see show system services dhcp statistics.
user@host>
show system services dhcp conflict
For sample output, see show system services dhcp conflict.
Use the following commands to troubleshoot your DHCP server configuration:
user@host# set system services dhcp traceoptions file dhcp.dbg user@host# set system services dhcp traceoptions flag all
2026-02-17: Minor, non-technical modifications made for search optimization
2019-05-13: Added note about DHCP process modified to an enhanced process called JDHCP; corrected documentation links.
KB21169 - How to setup DHCP server on SRX with DHCP clients in non-default routing-instance [juniper.net]
KB26100 - How to configure DHCP server under a routing-instance [juniper.net]