Customer configured DHCP relay agent which using bridge interface(L2) as access interface and irb(L3) interface as gateway.
If there is illegal dhcp server in same vlan, the dhcp client will get incorrect address.
Refer below topo and example configuration:
xe-0/2/0 +--------------+
Client+--------------+ |xe-0/3/0
. . | MX dhcp relay+------------+Dhcp server
Illegal Server+------+ |
xe-0/2/1 +--------------+
set interfaces xe-0/2/0 flexible-vlan-tagging
set interfaces xe-0/2/0 encapsulation flexible-ethernet-services
set interfaces xe-0/2/0 unit 100 encapsulation vlan-bridge
set interfaces xe-0/2/0 unit 100 vlan-id 100
set interfaces xe-0/2/1 flexible-vlan-tagging
set interfaces xe-0/2/1 encapsulation flexible-ethernet-services
set interfaces xe-0/2/1 unit 100 encapsulation vlan-bridge
set interfaces xe-0/2/1 unit 100 vlan-id 100
set interfaces xe-0/3/0 unit 0 proxy-arp restricted
set interfaces xe-0/3/0 unit 0 family inet address 10.0.0.1/24
set interfaces irb unit 100 family inet address 192.168.0.1/24
set forwarding-options dhcp-relay server-group dhcp-server 10.0.0.2
set forwarding-options dhcp-relay group dhcpv4-relay active-server-group dhcp-server
set forwarding-options dhcp-relay group dhcpv4-relay overrides no-bind-on-request
set forwarding-options dhcp-relay group dhcpv4-relay overrides proxy-mode single-proxy
set forwarding-options dhcp-relay group dhcpv4-relay overrides send-release-on-delete
set forwarding-options dhcp-relay group dhcpv4-relay interface irb.100
set bridge-domains v100 vlan-id 100
set bridge-domains v100 interface xe-0/2/0.100
set bridge-domains v100 interface xe-0/2/1.100
set bridge-domains v100 routing-interface irb.100
Checking dhcp relay binding status, its state was stuck at "selecting".
Because client has got wrong address from illegal dhcp server.
user@mx# run show dhcp relay binding
IP address Session Id Hardware address Expires State Interface
0.0.0.0 14 00:10:94:00:00:02 0 SELECTING irb.100
Create L2 filter and discard all dhcp message which from server to client.
Apply this L2 filter on bridge-domain input direction.
All illegal server message will be discarded by this filter.
set firewall family bridge filter block-dhcp term 1 from source-port 67
set firewall family bridge filter block-dhcp term 1 from destination-port 68
set firewall family bridge filter block-dhcp term 1 then count block-dhcp
set firewall family bridge filter block-dhcp term 1 then discard
set firewall family bridge filter block-dhcp term 2 then accept
set bridge-domains v100 forwarding-options filter input block-dhcp
The dhcp client will get correct address from dhcp server.
192.168.0.2 17 00:10:94:00:00:02 3592 BOUND irb.100