Description

It has been observed that in certain scenarios, DHCP client does not release its IP address when the SRX is acting as a DHCP relay, despite the SRX and the DHCP server being in the same VLAN.

Symptoms

DHCP client cannot release IP address, which causes DHCP server to keep multiple addresses for one DHCP client. In a packet capture, only "DHCP Release" messages are sent from the client, with no ACK from the server back; see the packet capture below:

No.   Time           Source                Destination             Info
28    8.011519       0.0.0.0               255.255.255.255         DHCP Discover - Transaction ID 0xe480661a
29    8.011549       0.0.0.0               255.255.255.255         DHCP Request  - Transaction ID 0xe480661a
30    8.476154       0.0.0.0               255.255.255.255         DHCP Discover - Transaction ID 0xe480661a
31    8.476164       0.0.0.0               255.255.255.255         DHCP Request  - Transaction ID 0xe480661a
32    18.025016      172.16.11.119         172.16.1.77             DHCP Release  - Transaction ID 0x615cc743
33    23.046266      172.16.11.122         172.16.1.77             DHCP Release  - Transaction ID 0x649bb43 1
 

Topology:

 DHCP client
    |
    |
(reth4.0)
   SRX
(reth0.161)( 172.16.1.153 )
    |
    |
L3 switch ( 172.16.1.1 )(vlan.161)
    |
    |
DHCP server ( 172.16.1.77 )
  • DHCP server and SRX's reth0.161 are connecting to same VLAN via an L3 switch. This L3 switch acts as default gateway to the DHCP server.
  • SRX acts as the DHCP Relay. 
  • DHCP clients address pool: 172.16.11.0/24.
 

Solution

"DHCP RELEASE" and "DHCP RELEASE-ACK" are unicast packets. Therefore, the DHCP server sends these packets to its default gateway (i.e. L3 switch). The L3 switch needs correct routes back towards the DHCP clients. In absence of the correct routes, the "DHCP RELEASE ACK" cannot be sent back to DHCP clients, causing the clients to NOT release the IP.

Note: This issue is NOT exclusive to the SRX or Junos devices, but can be observed on any setup where the intermediate switches and routers don't know how to reach the DHCP client subnet.


 

On the L3 switch, add the route for the client subnet pointing towards the relay's IP.  

ip route 172.16.11.0/24 172.16.1.153   

Note: Please note that the command to add the route will depend upon the L3 switch OS.