Description

This article explains how to configure DHCP snooping on switches running on Juniper Networks devices with ELS support.

Symptoms

How to configure DHCP snooping on ELS.

Solution

Junos OS for EX Series switches with support for the Enhanced Layer 2 Software (ELS) configuration style and MX Series routers do not have a configuration statement that explicitly enables DHCP snooping.
DHCP snooping is enabled automatically by Junos OS if any of the following is configured at the [edit vlans vlan-name forwarding-options dhcp-security] hierarchy level for EX Series and QFX Series switches

Basic DHCP snooping configuration 
[edit vlans]
default {
    vlan-id 1;
    forwarding-options {
        dhcp-security;
    }
}

When DHCP snooping is enabled on a VLAN, the system examines DHCP messages sent from untrusted hosts associated with the VLAN and extracts their IP addresses and lease information. This information is used to build and maintain the DHCP snooping database. Only hosts that can be verified using this database are allowed access to the network.

By default, all trunk ports on the switch are trusted and all access ports are untrusted for DHCP snooping.

The server sends a DHCPOFFER packet to offer an address. If the DHCPOFFER packet is from a trusted interface, the switch forwards the packet to the network device.

Note that while DHCP snooping is active, the access ports will not permit any DHCP offer/acknowledge packets. The same will only be trusted through trunk ports. If the DHCP server is connected through an access port, you may need to configure overrides to trust a that interface.

Example: 
[edit vlans]
default {
    vlan-id 1;
    forwarding-options {
        dhcp-security {
            group TRUSTED {
                overrides {
                    trusted;
                }
                interface ge-0/0/8.0;  <<< Server connected here.
            }
        }
    }
}

Modification History

2023-04-25: KB created.

Related Information

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/ref/statement/no-dhcp-snooping-edit-vlans.html

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/concept/port-security-dhcp-snooping-els.html