Description

This article provides information on how to configure the DHCP on multiple VLANs in a SRX.

  • Multiple address pools can be configured for a DHCP server. A different IP from separate address pools can be allocated to VLANs.
  • DHCP maintains the state information for all the configured pools.
  • Clients are assigned addresses from pools with subnets that match the interface on which the DHCPDISCOVER packet is received.

 

Symptoms

  • Multiple switches each spanning over a plethora of hosts. Every switch connected to an interface on the SRX is working as a DHCP server.
  • This design requirement is not feasible due to extensive requirement of external switches.
  • The optimal solution to this issue would be to use multiple VLANs spanning over several hosts and each VLAN interface getting an IP from a DHCP server configured on the SRX.

Solution

For version before 12.1 (DHCPD):  

    system {
      host-name DHCP_VLAN;
      root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
        }
     
      services {
        dhcp {
          pool 192.168.15.0/24 {
            address-range low 192.168.15.100 high 192.168.15.254;
            router {
              192.168.15.1;
            }
            propagate-settings vlan.300;
          }
          pool 192.168.16.0/24 {
            address-range low 192.168.16.100 high 192.168.16.254;
            router {
              192.168.16.1;
            }
            propagate-settings vlan.100;
          }
        }
      }
    }

    interfaces {
      ge-2/0/0 {
        unit 0 {
          family ethernet-switching {
            port-mode access;
            vlan {
              members test;
            }
          }
        }
      }
      ge-2/0/1 {
        unit 0 {
          family ethernet-switching {
            port-mode access;
            vlan {
              members test2;
            }
          }
        }
      }
    }

    vlan {
      unit 100 {
        family inet {
          address 192.168.16.1/24;
        }
      }
      unit 300 {
        family inet {
          address 192.168.15.1/24;
        }
      }
    }
    
    security {
      zones {
        security-zone trust {
          interfaces {
            vlan.300 {
              host-inbound-traffic {
                system-services {
                  dhcp;
                }
                protocols {
                  all;
                }
              }
            }
            vlan.100 {
              host-inbound-traffic {
                system-services {
                  dhcp;
                }
                protocols {
                  all;
                }
              }
            }
          }
        }
      }
    }
    
    vlans {
      test {
        vlan-id 300;
        interface {
          ge-2/0/0.0;
        }
        l3-interface vlan.300;
      }
      test2 {
        vlan-id 100;
        interface {
          ge-2/0/1.0;
        }
        l3-interface vlan.100;
      }
    }

    SRX-650

    VERSION: 10.4R3.4


    root@DHCP_VLAN# run show system services dhcp statistics
    Sep 22 20:38:57
    Packets dropped:
    Total 0

    Messages received:
    BOOTREQUEST 0
    DHCPDECLINE 0
    DHCPDISCOVER 4
    DHCPINFORM 7
    DHCPRELEASE 0
    DHCPREQUEST 5

    Messages sent:
    BOOTREPLY 0
    DHCPOFFER 4
    DHCPACK 12
    DHCPNAK 0

    [edit]
    root@DHCP_VLAN# run show route
    Sep 22 20:39:02

    inet.0: 4 destinations, 4 routes (4 active, 0 holddown, 0 hidden)
    + = Active Route, - = Last Active, * = Both

    192.168.15.0/24 *[Direct/0] 00:02:43
    > via vlan.300
    192.168.15.1/32 *[Local/0] 01:44:13
    Local via vlan.300
    192.168.16.0/24 *[Direct/0] 00:05:07
    > via vlan.100
    192.168.16.1/32 *[Local/0] 00:16:45
    Local via vlan.100
For version after 12.1, user may opt for using JDHCPD: 
    system {
      host-name DHCP_VLAN;
      root-authentication {
        encrypted-password "$ABC123"; ## SECRET-DATA
        }
      services {
        dhcp-local-server {
          group test {
            interface vlan.100;
            interface vlan.300;
          }
        }
      }
    }

    interfaces {
      ge-2/0/0 {
        unit 0 {
          family ethernet-switching {
            port-mode access;
            vlan {
              members test;
            }
          }
        }
      }
      ge-2/0/1 {
        unit 0 {
          family ethernet-switching {
            port-mode access;
            vlan {
              members test2;
            }
          }
        }
      }
    }

    vlan {
      unit 100 {
        family inet {
          address 192.168.16.1/24;
        }
      }
      unit 300 {
        family inet {
          address 192.168.15.1/24;
        }
      }
    }
    
    security {
      zones {
        security-zone trust {
          interfaces {
            vlan.300 {
              host-inbound-traffic {
                system-services {
                  dhcp;
                }
                protocols {
                  all;
                }
              }
            }
            vlan.100 {
              host-inbound-traffic {
                system-services {
                  dhcp;
                }
                protocols {
                  all;
                }
              }
            }
          }
        }
      }
    }
    
    access {
      address-assignment {
        pool p1 {
          family inet {
            network 192.168.15.0/24;
            range r1 {
              low 192.168.15.100; 
              high 192.168.15.254;
            }
          }
        }
        pool p2 {
          family inet {
            network 192.168.16.0/24;
            range r2 {
              low 192.168.16.100;
              high 192.168.16.254;
            }
          }
        }
      }
    }

    vlans {
      test {
        vlan-id 300;
        interface {
          ge-2/0/0.0;
        }
        l3-interface vlan.300;
      }
      test2 {
        vlan-id 100;
        interface {
          ge-2/0/1.0;
        }
        l3-interface vlan.100;
      }
    }

lab@SRX# run show dhcp statistics interface vlan.100 
Packets dropped:
    Total                      0

Messages received:
    BOOTREQUEST                2
    DHCPDECLINE                0
    DHCPDISCOVER               1
    DHCPINFORM                 0
    DHCPRELEASE                0
    DHCPREQUEST                1

Messages sent:
    BOOTREPLY                  2
    DHCPOFFER                  1
    DHCPACK                    1
    DHCPNAK                    0
    DHCPFORCERENEW             0

lab@SRX# run show dhcp statistics interface vlan.300    
Packets dropped:
    Total                      0

Messages received:
    BOOTREQUEST                2
    DHCPDECLINE                0
    DHCPDISCOVER               1
    DHCPINFORM                 0
    DHCPRELEASE                0
    DHCPREQUEST                1

Messages sent:
    BOOTREPLY                  2
    DHCPOFFER                  1
    DHCPACK                    1
    DHCPNAK                    0
    DHCPFORCERENEW             0

lab@SRX# run show interfaces terse vlan     
Interface               Admin Link Proto    Local                 Remote
vlan                    up    up
vlan.100                up    up   inet     192.168.16.1/24 
vlan.300                up    up   inet     192.168.15.1/24

lab@SRX# run show dhcp server binding           

IP address        Session Id  Hardware address   Expires     State      Interface
192.168.16.100    3           00:24:dc:d9:7d:4f  82992       BOUND      vlan.100            
192.168.15.100    4           00:24:dc:d9:5d:41  82993       BOUND      vlan.300

Modification History

2017-03-22: Added sample configuration and output for JDHCPD.