I made a couple changes.
[edit] root@HSRX300# show access address-assignment pool guest { family inet { network 10.10.20.0/24; range scope { low 10.10.20.30; high 10.10.20.99; } dhcp-attributes { grace-period 86400; name-server { 8.8.8.8; 8.8.4.4; } router { 10.10.20.1; } } } } pool internal { family inet { network 10.10.10.0/24; range scope { low 10.10.10.30; high 10.10.10.99; } dhcp-attributes { grace-period 86400; name-server { 8.8.8.8; 8.8.4.4; } router { 10.10.10.1; } } } } root@HSRX300# show interfaces irb unit 10 { description Internal; family inet { address 10.10.10.1/24; } } unit 20 { description Guest; family inet { address 10.10.20.1/24; } } root@HSRX300# show vlans Guest { vlan-id 20; l3-interface irb.20; } Internal { vlan-id 10; l3-interface irb.10; } root@HSRX300# show system services dhcp-local-server group guest { interface irb.20; } group internal { interface irb.10; } root@HSRX300# show security policies from-zone internal to-zone untrust { policy internal-to-untrust { match { source-address any; destination-address any; application any; } then { permit; } } } from-zone guest to-zone untrust { policy guest-to-untrust { match { source-address any; destination-address any; application any; } then { permit; } }