1

I have admin access to a SRX550 Juniper, but I cannot get help from Juniper or joint their boards because the Juniper belongs to Century Link, not us.

I have the following:

# show system services dhcp
NEW JUNIPER CONFIG 20180409
version 12.1X44-D35.5;

[...]

pool 10.203.0.0/24 {
    address-range low 10.203.0.10 high 10.203.0.254;
    exclude-address {
        10.203.0.101;
        10.203.0.102;
        10.203.0.103;
        10.203.0.104;
        10.203.0.105;
        10.203.0.106;
    }
    maximum-lease-time 31622400;
    name-server {
        208.67.222.222;
        208.67.220.220;
    }
    router {
        10.203.0.1;
    }
}

But when someone on the LAN decides to hook up a router of their own, suddenly some people get IPs in 10.0.1.1 or 10.0.7.1. I am trying to track these people down and apply a clue-bat, but it's a game of whack-a-mole since they aren't employees. Is it possible to set up the Juniper so that it will not pass any DHCP assignments but its own?

(The excluded address list is for static-bindings which are not working as yet)

1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 8:18

1 Answer 1

1

You should enable DHCP snooping on your switch.DHCP snooping was solely designed for this particular use case.

The fundamental use case for DHCP snooping is to prevent unauthorized (rogue) DHCP servers offering IP addresses to DHCP clients. Rogue DHCP servers are often used in man in the middle or denial of service attacks for malicious purposes.

To enable DHCP snooping:

On a specific VLAN:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan vlan-name examine-dhcp
On all VLANs:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan all examine-dhcp

To enable DHCPv6 snooping:

On a specific VLAN:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan vlan-name examine-dhcpv6
On all VLANs:
[edit ethernet-switching-options secure-access port]
user@switch# set vlan all examine-dhcpv6
5
  • I simply enabling stopping enough? or are the other configuration options that need to be applied?
    – lbutlr
    Apr 9, 2018 at 13:54
  • You can apply it on one particular Vlan or all the vlans in the switch.
    – Maverick
    Apr 9, 2018 at 13:57
  • My command line wants set interface vlan <name>, but then there is no examine-dhcp option. I've also looked on interface ge-0/0/1 with the same results.
    – lbutlr
    Apr 9, 2018 at 14:12
  • 23:38:10.982797 In arp who-has 169.254.1.0 tell 10.203.0.11 23:38:11.209126 In arp who-has 10.0.1.1 tell 10.0.1.10 23:38:11.210959 In arp who-has 10.0.1.1 tell 10.0.1.7 23:38:11.991991 In arp who-has 169.254.1.0 tell 10.203.0.11 23:38:12.209288 In arp who-has 10.0.1.1 tell 10.0.1.10 23:38:12.211024 In arp who-has 10.0.1.1 tell 10.0.1.7 23:38:15.011774 In arp who-has 169.254.1.0 tell 10.203.0.1 I am not misinterpreting this, am I? there's not some hidden 10.0.1.0/24 in the Juniper, right?
    – lbutlr
    Apr 9, 2018 at 23:42
  • examine-dhcp is not a command on the SRX550, sadly. help apropos examine-dhcp => error: nothing matches 'examine-dhcp'
    – lbutlr
    Apr 10, 2018 at 6:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.