DHCP Relay snooping provides DHCP security by identifying incoming DHCP packets. The SRX activates snooping for DHCP Relay as soon as the option for dhcp-relay under [forwarding-options] is configured. This is the default SRX behavior which cannot be changed in Junos OS 15.1X49 releases.​​ However, Junos 17.3 onwards, this feature can be disabled on the SRX Devices. This article explains the impact.

When your devices are running different versions of Junos OS code, one might come across issues where a certain configuration is working for DHCP Relay on Junos OS 17.3, but does not work for Junos OS 15.1X49. This is because in Junos OS 17.3 and later, there is a way to disable the DHCP Relay snooping, which makes sure that DHCP Relay packets do not reach the RE.

Hence for Junos OS 17.3 and later, there is no need to accept the DHCP (v4 or v6) packets at the firewall filters applied to the loopback interface, if dhcp-relay snooping is disabled:

​DHCPv4:
[edit forwarding-options dhcp-relay]
    'no-snoop;'

DHCPv6:
[edit forwarding-options dhcp-relay dhcpv6]
    'no-snoop;'

The problem is that on Junos OS 15.1X49, the above configuration is not supported and hence is ignored. The snoop is enabled (by default) and in the absence of an RE filter, these packets are dropped and break the DHCP Relay function.

When snooping is enabled, DHCP Relay packets during binding go to the RE for the snoop function.

For your devices running Junos OS 15.1X49, since you cannot disable snooping, opening the communication with the RE is mandatory to forward the DHCP Relay packets to the server. The firewall filters applied at loopback interface (family inet and/or inet6) should have a term allowing the DHCP Relay protocol.