CanI prevent a secondary DHCP server on the LAN from taking over from SRX Juniper's DHCP?

Question

I have admin access to a SRX550 Juniper, but I cannot get help from Juniper or joint their boards because the Juniper belongs to Century Link, not us.

I have the following:

# show system services dhcp
NEW JUNIPER CONFIG 20180409
version 12.1X44-D35.5;

[...]

pool 10.203.0.0/24 {
    address-range low 10.203.0.10 high 10.203.0.254;
    exclude-address {
        10.203.0.101;
        10.203.0.102;
        10.203.0.103;
        10.203.0.104;
        10.203.0.105;
        10.203.0.106;
    }
    maximum-lease-time 31622400;
    name-server {
        208.67.222.222;
        208.67.220.220;
    }
    router {
        10.203.0.1;
    }
}

But when someone on the LAN decides to hook up a router of their own, suddenly some people get IPs in 10.0.1.1 or 10.0.7.1. I am trying to track these people down and apply a clue-bat, but it's a game of whack-a-mole since they aren't employees. Is it possible to set up the Juniper so that it will not pass any DHCP assignments but its own?

(The excluded address list is for static-bindings which are not working as yet)

Answer 1

You should enable DHCP snooping on your switch.DHCP snooping was solely designed for this particular use case.

The fundamental use case for DHCP snooping is to prevent unauthorized (rogue) DHCP servers offering IP addresses to DHCP clients. Rogue DHCP servers are often used in man in the middle or denial of service attacks for malicious purposes.

To enable DHCP snooping:

On a specific VLAN:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan vlan-name examine-dhcp
On all VLANs:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan all examine-dhcp

To enable DHCPv6 snooping:

On a specific VLAN:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan vlan-name examine-dhcpv6
On all VLANs:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan all examine-dhcpv6