[MX] MPLS filter to count DHCP UDP packet in MPLS encapsulated packet on CORE P router

Description

This document is to represent lab test-based results to identify DHCP requests sent from clients passing through MPLS routers and check if in between MPLS routers can see DHCP requests from MPLS encapsulated payload with the help of firewall filters.

Symptoms

Details from customer request ---

The customer has requested that they confirm if the remote DHCP client request is passing through the MPLS network.
From customer topology DHCP clients and servers were connected across the MPLS network.
The customer also had another PATH through the internet cloud and the DHCP request was passing very well from that path.
They were unable to confirm whether the DHCP client request was indeed passing through the MPLS network or not.
We have tried to test other firewall filters but they were not helping to confirm the same.

Solution

server <-----> PE1 <-----> P <-----> PE2(relay) <-----> Client

The above topology depicts the snip of the topology used for this test.
Some more intermediate devices were not included in the below topology. They are part of PE routers to Server end PE routers MPLS network.

Below is the traceroute from the PE2_RE device to the 11.11.11.11 (server). I have not used the LIVE server intentionally here because the target was only to see DHCP client requests passing through MPLS devices visible in the MPLS filter or not.

traceroute to 11.11.11.11 (11.11.11.11), 30 hops max, 52 byte packets
1 10.10.10.2 2.277 ms 1.851 ms 30.102 ms
2 10.220.68.1 3.770 ms 3.299 ms 3.337 ms
MPLS Label=299824 CoS=0 TTL=1 S=1
3 10.220.24.1 6.664 ms 10.220.34.1 5.473 ms 5.528 ms
MPLS Label=27 CoS=0 TTL=1 S=1
4 10.220.13.1 5.791 ms 6.100 ms 10.220.12.1 6.174 ms
5 11.11.11.11 9.271 ms 7.655 ms 7.836 ms

Simulated DHCP client request from one MX device with the below configuration
root@DHCP-CLIENT_RE> show configuration |display set |match dhcp
set interfaces ge-0/0/0 unit 0 family inet dhcp

As soon as we hit the below command having the above configuration, the device sends a DHCP request to its connected next-hop router.
root@DHCP-CLIENT_RE> request dhcp client renew all

Use the below CLI to confirm client binding though it's not established can say that the request initiated
root@DHCP-CLIENT_RE> show dhcp client binding
IP address Hardware address Expires State Interface
0.0.0.0 56:04:1a:00:15:df 0 INIT ge-0/0/0.0

You can also verify client request counts with the below command on the simulated client router.
root@DHCP-CLIENT_RE> show dhcp client statistics
Packets dropped:
Total 1
Send error 1

Messages received:
BOOTREPLY 0
DHCPOFFER 0
DHCPACK 0
DHCPNAK 0
DHCPFORCERENEW 0

Messages sent:
BOOTREQUEST 135
DHCPDECLINE 0
DHCPDISCOVER 135
DHCPREQUEST 0
DHCPINFORM 0
DHCPRELEASE 0
DHCPRENEW 0
DHCPREBIND 0

root@DHCP-CLIENT_RE>

Provider router directly connected with DHCP client here will have to configure RELAY as below.
root@PE2_RE> show configuration |display set |match DHCP
set forwarding-options dhcp-relay server-group DHCP-RELAY 11.11.11.11
set forwarding-options dhcp-relay active-server-group DHCP-RELAY
set forwarding-options dhcp-relay group all interface ge-0/0/5.0

root@PE2_RE> show dhcp relay statistics
Packets dropped:
Total 18
No binding found 18

Messages received:
BOOTREQUEST 65
DHCPDECLINE 0
DHCPDISCOVER 65
DHCPINFORM 0
DHCPRELEASE 0
DHCPREQUEST 0
DHCPLEASEACTIVE 0
DHCPLEASEUNASSIGNED 0
DHCPLEASEUNKNOWN 0
DHCPLEASEQUERYDONE 0
DHCPACTIVELEASEQUERY 0

Messages sent:
BOOTREPLY 0
DHCPOFFER 0
DHCPACK 0
DHCPNAK 0
DHCPFORCERENEW 0
DHCPLEASEQUERY 0
DHCPBULKLEASEQUERY 0
DHCPLEASEACTIVE 0
DHCPLEASEUNASSINGED 0
DHCPLEASEUNKNOWN 0
DHCPLEASEQUERYDONE 0
DHCPACTIVELEASEQUERY 0

root@PE2_RE>

The provider "P" router is used to configure the firewall filter as shown below.

root@P_RE> show configuration |display set |match firewall
set firewall family mpls filter ip-mpls-ip term ipv4-term from ip-version ipv4 protocol udp destination-port 67
set firewall family mpls filter ip-mpls-ip term ipv4-term from ip-version ipv4 source-address 10.221.4.1/32
set firewall family mpls filter ip-mpls-ip term ipv4-term from ip-version ipv4 destination-address 11.11.11.11/32
set firewall family mpls filter ip-mpls-ip term ipv4-term then count ip-mpls-ip
set firewall family mpls filter ip-mpls-ip term ipv4-term then accept
set firewall family mpls filter ip-mpls-ip term ipv4-term-2 then count all
set firewall family mpls filter ip-mpls-ip term ipv4-term-2 then accept

Use below show command on P router to check if same number of counter is increasing as soon as DHCP client request counters are seen from the CLIENT device.

root@P_RE> show firewall filter ip-mpls-ip

Filter: ip-mpls-ip
Counters:
Name Bytes Packets
all 11558 73
ip-mpls-ip 13524 42

Below packets seen at the end server side device as soon as DHCP request is sent from DHCP client.

root@server_RE> monitor traffic interface ge-0/0/2.0 extensive no-resolve matching "port 67"
Address resolution is OFF.
Listening on ge-0/0/2.0, capture size 1514 bytes

08:13:21.866704 In
Juniper PCAP Flags [Ext, no-L2, In], PCAP Extension(s) total length 16
Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
Device Interface Index Extension TLV #1, length 2, value: 151
Logical Interface Index Extension TLV #4, length 4, value: 337
-----original packet-----
PFE proto 2 (ipv4): (tos 0x0, ttl 60, id 25643, offset 0, flags [none], proto: UDP (17), length: 314) 10.221.4.1.67 > 11.11.11.11.67: [udp sum ok] BOOTP/DHCP, Request from 56:04:1a:00:15:df, length 286, hops 1, xid 0x2ceaaf86, Flags [Broadcast] (0x8000)
Gateway-IP 10.221.4.1
Client-Ethernet-Address 56:04:1a:00:15:df
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Lease-Time Option 51, length 4: 86400
Hostname Option 12, length 33: "DHCP-CLIENT_RE"
08:13:25.703892 In
Juniper PCAP Flags [Ext, no-L2, In], PCAP Extension(s) total length 16
Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
Device Interface Index Extension TLV #1, length 2, value: 151
Logical Interface Index Extension TLV #4, length 4, value: 337
-----original packet-----
PFE proto 2 (ipv4): (tos 0x0, ttl 60, id 25840, offset 0, flags [none], proto: UDP (17), length: 314) 10.221.4.1.67 > 11.11.11.11.67: [udp sum ok] BOOTP/DHCP, Request from 56:04:1a:00:15:df, length 286, hops 1, xid 0x5414afc1, Flags [Broadcast] (0x8000)
Gateway-IP 10.221.4.1
Client-Ethernet-Address 56:04:1a:00:15:df
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Lease-Time Option 51, length 4: 86400
Hostname Option 12, length 33: "DHCP-CLIENT_RE"
08:13:33.706217 In
Juniper PCAP Flags [Ext, no-L2, In], PCAP Extension(s) total length 16
Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
Device Interface Index Extension TLV #1, length 2, value: 151
Logical Interface Index Extension TLV #4, length 4, value: 337
-----original packet-----
PFE proto 2 (ipv4): (tos 0x0, ttl 60, id 26202, offset 0, flags [none], proto: UDP (17), length: 314) 10.221.4.1.67 > 11.11.11.11.67: [udp sum ok] BOOTP/DHCP, Request from 56:04:1a:00:15:df, length 286, hops 1, xid 0x175be183, Flags [Broadcast] (0x8000)
Gateway-IP 10.221.4.1
Client-Ethernet-Address 56:04:1a:00:15:df
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Lease-Time Option 51, length 4: 86400
Hostname Option 12, length 33: "DHCP-CLIENT_RE"
08:13:49.710418 In
Juniper PCAP Flags [Ext, no-L2, In], PCAP Extension(s) total length 16
Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
Device Interface Index Extension TLV #1, length 2, value: 151
Logical Interface Index Extension TLV #4, length 4, value: 337
-----original packet-----
PFE proto 2 (ipv4): (tos 0x0, ttl 60, id 26924, offset 0, flags [none], proto: UDP (17), length: 314) 10.221.4.1.67 > 11.11.11.11.67: [udp sum ok] BOOTP/DHCP, Request from 56:04:1a:00:15:df, length 286, hops 1, xid 0x1ad20123, Flags [Broadcast] (0x8000)
Gateway-IP 10.221.4.1
Client-Ethernet-Address 56:04:1a:00:15:df
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Lease-Time Option 51, length 4: 86400
Hostname Option 12, length 33: "DHCP-CLIENT_RE"
08:14:21.711518 In
Juniper PCAP Flags [Ext, no-L2, In], PCAP Extension(s) total length 16
Device Media Type Extension TLV #3, length 1, value: Ethernet (1)
Logical Interface Encapsulation Extension TLV #6, length 1, value: Ethernet (14)
Device Interface Index Extension TLV #1, length 2, value: 151
Logical Interface Index Extension TLV #4, length 4, value: 337
-----original packet-----
PFE proto 2 (ipv4): (tos 0x0, ttl 60, id 28362, offset 0, flags [none], proto: UDP (17), length: 314) 10.221.4.1.67 > 11.11.11.11.67: [udp sum ok] BOOTP/DHCP, Request from 56:04:1a:00:15:df, length 286, hops 1, xid 0x762bce89, Flags [Broadcast] (0x8000)
Gateway-IP 10.221.4.1
Client-Ethernet-Address 56:04:1a:00:15:df
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message Option 53, length 1: Discover
Lease-Time Option 51, length 4: 86400
Hostname Option 12, length 33: "DHCP-CLIENT_RE"

Modification History

2024-07-08 : Article Created