SRX

I can't seem to get DHCP to work on the new SRX 300.

The error I get is “dhcp subsystem not running”…

I gather there's two ways of doing it, the old SRX100 method and a new one (see below)

Is there a trick to this ?

The old way was just:

Services{

….

dhcp {

            pool 192.168.15.0/24 {

                address-range low 192.168.15.50 high 192.168.15.150;

                default-lease-time 3600;

                name-server {

                    8.8.8.8;

                }

                router {

                    192.168.15.1;

                }

            }

        }

}

I tried the new way:

Services {

….

dhcp-local-server {

                group Data-Vlan-DHCP {

                interface irb.1;

                interface vlan.1;

                }

        }

……

access {

                address-assignment {

                                pool DHCP_Data_Network {

                                                family inet {

                                                                network 192.168.15.0/24;

                                                                range 192_168_15_0 {

                                                                                low 192.168.15.50;

                                                                                high 192.168.15.150;

                                                                }

                                                                dhcp-attributes {

                                                                                name-server {

                                                                                                8.8.8.8;

                                                                                }

                                                                                router {

                                                                                                192.168.15.1;

                                                                                }

                                                                }

                                                }

                                }

                }

}

Neither worked.

See my config below:

## Last commit: 2016-08-09 04:03:12 GMT+10 by root
version 15.1X49-D50.3;
system {
host-name Laser-SRX300;
time-zone GMT+10;
root-authentication {
encrypted-password "???????????????????"; ## SECRET-DATA
}
name-server {
8.8.8.8;
}
name-resolution {
no-resolve-on-input;
}
services {
ssh;
telnet;
xnm-clear-text;
web-management {
http {
interface all;
}
https {
system-generated-certificate;
interface all;
}
session {
idle-timeout 60;
}
}
dhcp-local-server {
group Data-Vlan-DHCP {
interface irb.1;
interface vlan.1;
}
}
}
syslog {
archive size 100k files 3;
user * {
any emergency;
}
file messages {
any critical;
authorization info;
}
file interactive-commands {
interactive-commands error;
}
}
max-configurations-on-flash 5;
max-configuration-rollbacks 5;
archival {
configuration {
transfer-on-commit;
}
}
license {
autoupdate {
url https://ae1.juniper.net/junos/key_retrieval;
}
}
ntp {
server 0.oceania.pool.ntp.org;
}
}
security {
alg {
sip disable;
ike-esp-nat {
enable;
}
}
flow {
tcp-mss {
all-tcp {
mss 1400;
}
}
}
screen {
ids-option untrust-screen {
icmp {
ping-death;
}
ip {
source-route-option;
tear-drop;
}
tcp {
syn-flood {
alarm-threshold 1024;
attack-threshold 200;
source-threshold 1024;
destination-threshold 2048;
timeout 20;
}
land;
}
}
}
nat {
source {
rule-set nat_to_internet {
from zone DataNetwork;
to zone Internet;
rule nat_to_data_net_rule {
match {
source-address 0.0.0.0/0;
destination-address 0.0.0.0/0;
}
then {
source-nat {
interface;
}
}
}
}
}
destination {
pool port_fwd_6180 {
address 192.168.15.151/24 port 6180;
}
pool port_fwd_6181 {
address 192.168.15.151/24 port 6181;
}
pool port_fwd_6182 {
address 192.168.15.151/24 port 6182;
}
pool port_fwd_6183 {
address 192.168.15.151/24 port 6183;
}
pool port_fwd_6184 {
address 192.168.15.151/24 port 6184;
}
pool port_fwd_6185 {
address 192.168.15.151/24 port 6185;
}
pool port_fwd_6186 {
address 192.168.15.151/24 port 6186;
}
pool port_fwd_6187 {
address 192.168.15.151/24 port 6187;
}
pool port_fwd_6188 {
address 192.168.15.151/24 port 6188;
}
pool port_fwd_9630 {
address 192.168.15.200/24 port 9630;
}
pool port_fwd_9631 {
address 192.168.15.200/24 port 9631;
}
pool port_fwd_9632 {
address 192.168.15.200/24 port 9632;
}
rule-set dst-nat {
from zone Internet;
rule port_fwd_6180 {
match {
destination-address 0.0.0.0/0;
destination-port 6180;
}
then {
destination-nat {
pool {
port_fwd_6180;
}
}
}
}
rule port_fwd_6181 {
match {
destination-address 0.0.0.0/0;
destination-port 6181;
}
then {
destination-nat {
pool {
port_fwd_6181;
}
}
}
}
rule port_fwd_6182 {
match {
destination-address 0.0.0.0/0;
destination-port 6182;
}
then {
destination-nat {
pool {
port_fwd_6182;
}
}
}
}
rule port_fwd_6183 {
match {
destination-address 0.0.0.0/0;
destination-port 6183;
}
then {
destination-nat {
pool {
port_fwd_6183;
}
}
}
}
rule port_fwd_6184 {
match {
destination-address 0.0.0.0/0;
destination-port 6184;
}
then {
destination-nat {
pool {
port_fwd_6184;
}
}
}
}
rule port_fwd_6185 {
match {
destination-address 0.0.0.0/0;
destination-port 6185;
}
then {
destination-nat {
pool {
port_fwd_6185;
}
}
}
}
rule port_fwd_6186 {
match {
destination-address 0.0.0.0/0;
destination-port 6186;
}
then {
destination-nat {
pool {
port_fwd_6186;
}
}
}
}
rule port_fwd_6187 {
match {
destination-address 0.0.0.0/0;
destination-port 6187;
}
then {
destination-nat {
pool {
port_fwd_6187;
}
}
}
}
rule port_fwd_6188 {
match {
destination-address 0.0.0.0/0;
destination-port 6188;
}
then {
destination-nat {
pool {
port_fwd_6188;
}
}
}
}
rule port_fwd_9630 {
match {
destination-address 0.0.0.0/0;
destination-port 9630;
}
then {
destination-nat {
pool {
port_fwd_9630;
}
}
}
}
rule port_fwd_9631 {
match {
destination-address 0.0.0.0/0;
destination-port 9631;
}
then {
destination-nat {
pool {
port_fwd_9631;
}
}
}
}
rule port_fwd_9632 {
match {
destination-address 0.0.0.0/0;
destination-port 9632;
}
then {
destination-nat {
pool {
port_fwd_9632;
}
}
}
}
}
}
}
policies {
from-zone DataNetwork to-zone DataNetwork {
policy data2data {
description "Allows traffic within Data zone";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone DataNetwork to-zone VoiceNetwork {
policy data2voice {
description "Allows traffic between Data and Voice zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone DataNetwork to-zone Internet {
policy data2www {
description "Allows traffic between Data and Internet zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone VoiceNetwork to-zone Internet {
policy voice2www {
description "Allows traffic between Voice and Internet zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone VoiceNetwork to-zone DataNetwork {
policy voice2data {
description "Allows traffic between Voice and Data zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone SIPconnection to-zone SIPconnection {
policy sip2sip {
description "Allows traffic between sip zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone SIPconnection to-zone DataNetwork {
policy sip2data {
description "Allows traffic between SIP and Data zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone SIPconnection to-zone VoiceNetwork {
policy sip2voice {
description "Allows traffic between SIP and Voice zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone DataNetwork to-zone SIPconnection {
policy data2sip {
description "Allows traffic between Data and SIP zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone VoiceNetwork to-zone SIPconnection {
policy voice2sip {
description "Allows traffic between Voice and SIP zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone Internet to-zone DataNetwork {
policy www2data {
description "Allows traffic between Internet and Data zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
from-zone Internet to-zone VoiceNetwork {
policy www2voice {
description "Allows traffic between Internet and Voice zones";
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
}
}
}
}
zones {
security-zone DataNetwork {
description "Data vlan";
interfaces {
irb.1 {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
}
}
}
security-zone VoiceNetwork {
description "Voice vlan";
interfaces {
irb.20 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
}
security-zone SIPconnection {
description "SIP Connection";
interfaces {
irb.30 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
}
security-zone Internet {
description "Telstra NBN Connection";
interfaces {
ge-0/0/0.0 {
host-inbound-traffic {
system-services {
all;
}
}
}
}
}
}
}
interfaces {
ge-0/0/0 {
description "Telstra NBN Internet";
unit 0 {
encapsulation ppp-over-ether;
}
}
ge-0/0/1 {
description "SIP Port";
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members SIP-VLAN;
}
native-vlan-id default;
}
}
}
ge-0/0/2 {
description "Voice Port";
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members Voice-VLAN;
}
native-vlan-id default;
}
}
}
ge-0/0/3 {
description "Data Port";
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members default;
}
native-vlan-id default;
}
}
}
ge-0/0/4 {
description "Data Port";
unit 0 {
family ethernet-switching {
interface-mode access;
vlan {
members default;
}
native-vlan-id default;
}
}
}
ge-0/0/5 {
description "Trunk Port";
unit 0 {
family ethernet-switching {
interface-mode trunk;
vlan {
members all;
}
}
}
}
irb {
unit 1 {
description Data;
family inet {
address 192.168.15.1/24;
}
}
unit 20 {
description Voice;
family inet {
address 172.16.1.1/24;
}
}
unit 30 {
description Voice;
family inet {
address 192.168.20.1/24;
}
}
}
vlan {
unit 1 {
description Data;
family inet {
address 192.168.15.1/24;
}
}
unit 20 {
description Voice;
family inet {
address 172.16.1.1/24;
}
}
unit 30 {
description Voice;
family inet {
address 192.168.20.1/24;
}
}
}
pp0 {
unit 0 {
pppoe-options {
underlying-interface ge-0/0/0.0;
idle-timeout 0;
auto-reconnect 20;
client;
}
family inet {
negotiate-address;
}
}
}
}
routing-options {
static {
route 0.0.0.0/0 next-hop pp0.0; ## Internet - Telstra NBN interface
route 203.52.0.0/16 next-hop 192.168.20.2;
route 203.41.188.96/28 next-hop 192.168.20.2;
route 203.42.70.224/28 next-hop 192.168.20.2;
route 144.140.208.16/29 next-hop 192.168.20.2;
route 144.140.162.40/29 next-hop 192.168.20.2;
route 144.140.208.32/28 next-hop 192.168.20.2;
route 144.140.162.48/28 next-hop 192.168.20.2;
route 144.140.208.80/28 next-hop 192.168.20.2;
route 144.140.162.80/28 next-hop 192.168.20.2;
route 203.52.1.160/28 next-hop 192.168.20.2;
route 203.52.0.160/28 next-hop 192.168.20.2;
route 203.52.3.160/28 next-hop 192.168.20.2;
route 203.44.43.160/28 next-hop 192.168.20.2;
route 203.52.2.160/28 next-hop 192.168.20.2;
route 203.44.44.160/28 next-hop 192.168.20.2;
route 203.44.42.0/27 next-hop 192.168.20.2;
route 203.44.42.224/27 next-hop 192.168.20.2;
}
}
protocols {
l2-learning {
global-mode switching;
}
}
vlans {
SIP-VLAN {
description "Voice Network";
vlan-id 30;
l3-interface irb.30;
}
Voice-VLAN {
description "Voice Network";
vlan-id 20;
l3-interface irb.20;
}
default {
description "Data Network";
vlan-id 1;
l3-interface irb.1;
}
}
access {
address-assignment {
pool DHCP_Data_Network {
family inet {
network 192.168.15.0/24;
range 192_168_15_0 {
low 192.168.15.50;
high 192.168.15.150;
}
dhcp-attributes {
name-server {
8.8.8.8;
}
router {
192.168.15.1;
}
}
}
}
}
}

Hello,

Can you post the complete error message?

Which command you are attempting to run when the error message appears?

I am assuming that there is no issue with committing the configuration.

Regards,

Rushi

Hi, 

The error possibly indicates the dhcp daemon not running.

Maybe you could try restarting it:

restart dhcp-service gracefully

or "restart dhcp gracefully".

Cheers,
Ashvin

ASAIK, on 15.1 we dont have old dhcp, its the new jdhcp and your configuration is also for new jdhcp model.

Can you run below commmand to confirm if JDHCP is running?

root# run show system processes extensive | match dhcp
1281 root 1 96 0 50280K 12060K select 19:38 0.00% jdhcpd

And if you see jdhcp running please use "restart dhcp-service " to refersh the process.

you may also remove the vlan.1 from DHCP configurations.

I couldn't get my SRX300 to pull an address on ge0/0/0 out of the box. I found it worked after upgrading to a newer Junos 15.1 version than the one it shipped with. In my case 15.1X49-D60.7 got DHCP working without other intervention.

To be honest, the SRX300 is not a great out-of-the-box experience. The default setup seems a bit whimsical and the fact that it doesn't actually have functional DHCP and is configured in transparent mode out-of-the-box is unhelpful.

Hi,

I am also using 15.1X49-D60.7 but still can't get a dhcp address.

our configuration is SRX320 in a chassis cluster, and we are trying to get a dhcp allocation on a reth interface

this is our config:

set interfaces reth2 redundant-ether-options redundancy-group 2

set interfaces reth2 unit 0 family inet dhcp-client

set security zones security-zone untrust interfaces reth2.0 host-inbound-traffic system-services all

when trying to restart dhcp-services we get the following error:

restart dhcp-service gracefully
error: Junos Dynamic Host Configuration Protocol process is not running
error: Junos Dynamic Host Configuration Protocol process was not restarted

any help will be highly appriciated 🙂

Hi all,

any update on this one ?

I am facing the same issue ?

Can`t get an IP-Adress for reth-Interface with SRX300 running 15.1X49-D70.3.

Thanks.

Cheers, Christoph.