Support Support Downloads Knowledge Base Service Request Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

[ScreenOS] The firewall not responding to the DHCP request that is sent by a DHCP Relay Agent

0

0

Article ID: KB19962 KB Last Updated: 28 Jan 2013Version: 3.0
Summary:
If the ScreenOS firewall Interface is configured as a DHCP Server, the request may come from a client via DHCP Discover or as a unicast from a Relay Agent. However, the firewall responds only to the Discover messages.
Symptoms:

The ScreenOS firewall interface can be configured as a DHCP server so that clients can simply connect and access network resources. Now DHCP requests are of 2 types:

  • Directly from a client using DHCP Discover, which is an broadcast on UDP port 67.

  • From an DHCP Relay Agent as an unicast on UDP port 67.

The ScreenOS firewall works correctly in scenario 1; but will not work in scenario 2. The following message is reported in the output of debug flow basic:

ipid = 8475(211b), @2d57f910

packet passed sanity check.
ethernet0/2:172.27.201.131/67->172.27.201.132/67,17<Root>
no session found
flow_first_sanity_check: in <ethernet0/2>, out <N/A>
self check, not for us
chose interface ethernet0/2 as incoming nat if.

packet dropped: for self but not interested

Cause:

Solution:

This configuration is not supported in ScreenOS. For more information, refer to KB3390 - [ScreenOS] Can a NetScreen firewall be used as a DHCP server in a DHCP relay environment

The ScreenOS firewall responds to only broadcasted DHCP Discover messages. It does not address unicast DHCP request packets (mostly from Relay Agents). The DHCP functionality is just an add-on that is provided on the firewall. It cannot act as an full fledge DHCP server. This is by design.

Related Links

Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Security Alerts and Vulnerabilities

Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search