Article Detail

Description

This article describes the change of DHCP relay option name "vpn" to "source-ip-change" starting in Junos OS 15.1X49-D130. This is also documented in PR1318487 .

Symptoms

Prior to Junos OS 15.1X49-D130, the vpn option in the forwarding-options stanza changes the source IP address of the DHCP relay packet . Even if you do not establish a VPN connection, the behavior is the same.

The following topology is used for showing how the vpn option changes the source IP address of DHCP relay packets.

              [DHCP Relay server]  
Client ----------  SRX300 =======Route-Based VPN======= SRX ---- DHCP server
            <irb.10>  <st0.0> 
         192.168.1.254 1.1.1.1                                  192.168.10.100

Behavior when the VPN option is enabled

Source IP address of DHCP relay packet is the outgoing interface's IP address . In the above topology, the st0.0 interface's IP address is used for the source IP address of the Discover and Request messages.

The Offer and ACK message from the DHCP server is destined for the irb.10 address as it is defined as the DHCP relay agent's IP address.

Discover <Relay server -> DHCP server>
Src:1.1.1.1 <<st0.0 interface on SRX300 (DHCP relay server)
Dst:192.168.10.100 << DHCP server

Offer <DHCP Server -> Relay server>
Src:192.168.10.100 << DHCP server
Dst:192.168.1.254 <<irb interface(LAN) on SRX300 (DHCP relay server)

Request <Relay server -> DHCP server>
Src:1.1.1.1  <<st0.0 interface on SRX300 (DHCP relay server)
Dst:192.168.10.100 << DHCP server

Ack <DHCP server -> Relay server>
Src:192.168.10.100 << DHCP server
Dst:192.168.1.254 <<irb interface(LAN) on SRX300 (DHCP relay server)</pre>

The Discover and Request message uses the st0.0 IP address as the source IP address.

Return traffic reaches the DHCP relay server's LAN interface.

Behavior when the VPN option is not configured

Source IP address of DHCP relay packet is the incoming interface's IP address. In the above topology, the irb.10 interface's IP address is used for the source IP address of the Discover and Request messages.

The Offer and ACK message from the DHCP server is destined for irb.10 address as it is defined as the DHCP relay agent's IP address.

Discover <Relay server -> DHCP server>
Src:192.168.1.254 <<irb interface(LAN) on SRX300 (DHCP relay server)
Dst:192.168.10.100 << DHCP server

Offer <DHCP server -> Relay server>
Src:192.168.10.100 << DHCP server
Dst:192.168.1.254 <<irb interface(LAN) on SRX300 (DHCP relay server)

Request <Relay server -> DHCP server>
Src:192.168.1.254 <<irb interface(LAN) on SRX300 (DHCP relay server)
Dst:192.168.10.100 << DHCP server

Ack <DHCP server -> Relay server>
Src:192.168.10.100 << DHCP server
Dst:192.168.1.254 <<irb interface(LAN) on SRX300(DHCP relay server)</pre>

Solution

To make it clearer and more accurately reflect the behavior, the option vpn has been renamed to source-ip-change starting in Junos OS15.1X49-D130:

root@SRX# set forwarding-options dhcp-relay group TEST active-server-group TEST-GROUP ?
<snip>
source-ip-change     Use address of egress interface as source IP address

When upgrading to Junos OS 15.1X49-D130, the option name vpn is automatically renamed to source-ip-change . Junos OS 17.4R2 and 18.1R1 also follow this change.

Note: Users who have configured the vpn option do not need to change anything.

Caution: When downgrading to previous software releases from Junos OS 15.1X49-D130, the configuration relating to "source-ip-change" will be removed. The vpn option needs to be added manually.

Example:

Prior to Junos OS 15.1X49-D130:

set forwarding-options dhcp-relay server-group aaa 1.1.1.1
set forwarding-options dhcp-relay group bbb active-server-group aaa
set forwarding-options dhcp-relay group bbb vpn    << "vpn" option is enabled.

After upgrade to Junos OS 15.1X49-D130:

set forwarding-options dhcp-relay server-group aaa 1.1.1.1
set forwarding-options dhcp-relay group bbb active-server-group aaa
set forwarding-options dhcp-relay group bbb source-ip-change << automatically renamed to "source-ip-change"

After rollback to earlier version:

set forwarding-options dhcp-relay server-group aaa 1.1.1.1
set forwarding-options dhcp-relay group bbb active-server-group aaa
 "source-ip-change" configuration is removed.  It needs to be manually added with the "vpn" option.

Related Information

PR1318487