Example: Configuring a DHCP Firewall Filter to Protect the Routing Engine

• DHCP Snooping Support on page 16

• Grouping Interfaces with Common DHCP Configurations on page 33

• Enabling and Disabling DHCP Snooped Packets Support for DHCP Relay Agent on page 46

Example: Configuring a DHCP Firewall Filter to Protect the Routing Engine

This example shows how to configure a firewall filter to ensure that proper DHCP packets can reach the Routing Engine on MX Series routers.

• Requirements on page 85

• Overview on page 86

• Configuration on page 86

• Verification on page 88

Requirements

This configuration example applies only to routers where DHCP local server and DHCP relay agent services are provided by the jdhcpd process rather than the legacy dhcpd process or fud (UDP forwarding) process. MX Series routers, M120 routers, and M320 routers use jdhcpd. For DHCP relay, that means the configuration is required only at the

[edit forwarding-options dhcp-relay]hierarchy level and not at the [edit forwarding-options helpers bootp]hierarchy level.

No special configuration beyond device initialization is required before you can configure this feature.

Overview

Firewall filters that perform some action on DHCP packets at the Routing Engine, such as a filter to protect the Routing Engine by allowing only proper DHCP packets, require that both port 67 (bootps) and port 68 (bootpc) are configured as both source and destination ports.

DHCP packets received on the line cards are encapsulated by jdhcpd with a new UDP header where their source and destination addresses are set to port 68 before being forwarded to the Routing Engine. For DHCP relay and DHCP proxy, packets sent to the DHCP server from the router have both the source and destination UDP ports set to 67.

The DHCP server responds using the same ports. However, when the line card receives these DHCP response packets, it changes both port numbers from 67 to 68 before passing the packets to the Routing Engine. Consequently the filter needs to accept port 67 for packets relayed from the client to the server, and port 68 for packets relayed from the server to the client.

In this example, you configure two filter terms, dhcp-client-accept and dhcp-server-accept.

The match conditions for dhcp-client-accept specify a source address and destination address for broadcast packets, the UDP protocol used for DHCP packets, and the bootpc (68) source port and bootps (67) destination port. Packets that match these conditions are counted and accepted.

The match conditions for dhcp-server-accept specify the UDP protocol used for DHCP packets, and both port 67 and 68 for both source port and destination port. Packets that match these conditions are counted and accepted.

NOTE: This example does not show all possible configuration choices, nor does it show how the filter is applied in your configuration. This example applies to both static application of the filter as well as dynamic application with a dynamic profile.

Configuration

CLI Quick Configuration

To quickly configure the sample Routing Engine DHCP filter, copy the following commands, paste them in a text file, remove any line breaks, and then copy and paste the commands into the CLI.

[edit]

edit firewall family inet filter RE-protect edit term dhcp-client-accept

set from source-address 0.0.0.0/32

set from destination-address 255.255.255.255/32 set from protocol udp

set from source-port 68

set from destination-port 67 set then count dhcp-client-accept set then accept

edit term dhcp-server-accept set from protocol udp set from source-port 67 set from source-port 68 set from destination-port 67 set from destination-port 68 set then count dhcp-server-accept set then accept

top

Step-by-Step Procedure

The following example requires you to navigate various levels in the configuration hierarchy. For instructions on how to do that, see Using the CLI Editor in Configuration Mode.

To configure a DHCP firewall filter to protect the Routing Engine:

1. Create or specify a firewall filter.

[edit firewall]

user@host# edit family inet filter RE-protect 2. Create a filter term for the client.

[edit firewall family inet filter RE-protect]

user@host# edit term dhcp-client-accept 3. Specify the match conditions for DHCP packets.

[edit firewall family inet filter RE-protect term dhcp-client-accept]

user@host# set from source-address 0.0.0.0/32

user@host# set from destination-address 255.255.255.255/32 user@host# set from protocol udp

user@host# set from source-port 68 user@host# set from destination-port 67 4. Specify the action to take for matched packets.

[edit firewall family inet filter RE-protect term dhcp-client-accept]

user@host# set then count dhcp-client-accept user@host# set then accept

5. Create a filter term for the server.

[edit firewall family inet filter RE-protect]

user@host# edit term dhcp-server-accept 6. Specify the match conditions for DHCP packets.

[edit firewall family inet filter RE-protect term dhcp-server-accept]

user@host# set from protocol udp user@host# set from source-port [67 68]

user@host# set from destination-port [67 68]

7. Specify the action to take for matched packets.

[edit firewall family inet filter RE-protect term dhcp-server-accept]

user@host# set then count dhcp-client-accept user@host# set then accept

Results From configuration mode, confirm your configuration by entering the show firewall command. If the output does not display the intended configuration, repeat the configuration instructions in this example to correct it.

[edit]

destination-port [ 67 68 ];

}

If you are done configuring the device, enter commit from configuration mode.

Verification

To confirm that the Routing Engine DHCP protection filter is properly passing DHCP packets, perform these tasks:

• Verifying the DHCP Filter Operation on page 88 Verifying the DHCP Filter Operation

Purpose Verify that both counters increment as DHCP traffic passes to the Routing Engine.

Action From operational mode, enter the show firewall family inet filter RE-protect command.

user@host> show firewall family inet filter RE-protect

Filter: RE-protect Counters:

Name Bytes Packets dhcp-client-accept 328 1 dhcp-server-accept 574 1 user@host> show firewall family inet filter RE-protect

Filter: RE-protect Counters:

Name Bytes Packets dhcp-client-accept 660 2 dhcp-server-accept 1152 2

Meaning The output lists both configured counters, dhcp-client-accept and dhcp-server-accept.

By issuing the command more than once, you can see that the byte and packet fields both show that traffic is being accepted and counted.