KEA DHCP

Kea is the next generation of DHCP software, developed by Internet Systems Consortium (ISC).

It is considered the replacement for ISC-DHCP in larger HA enabled setups and synergizes well with radvd for HA enabled router advertisements.

Currently it is not possible to register hostnames dynamically between KEA and Unbound, only static reservations will be synchronized on an Unbound service restart.

Control Agent

The Kea Control Agent (CA) is a daemon which exposes a RESTful control interface for managing Kea servers. When building a high available dhcp setup, the control agent is a requirement for these kind of setups.

DDNS Agent

The Kea DHCP DDNS (D2) server is a middleware between the DHCP servers, and authoritative DNS servers. Enabling it is a requirement if dynamic DNS updates (RFC2136) should be sent when clients are assigned an IP address in configured subnets.

Kea DHCPv4/v6

This is the DHCPv4/v6 service available in KEA, which offers the following tab sheets with their corresponding settings:

Settings (DHCPv4/v6)

Subnets (DHCPv4/v6)

DHCPv4

DHCPv6

PD Pools (DHCPv6)

Reservations (DHCPv4/v6)

DHCPv4

DHCPv6

Options (DHCPv4/v6)

HA Peers (DHCPv4/DHCPv6)

Configuration examples

DHCPv4 for medium/large HA setups

KEA DHCPs main strength is the ability to synchronize leases between multiple servers, which makes it ideal for medium to large HA setups (more than 1000 unique clients) where you cannot use Dnsmasq DHCP.

As example we configure a network with two KEA DHCP instances on a master and backup Ixolate.

To configure KEA with a minimal HA setup for LAN using the 192.168.1.0/24 network follow these steps:

LAN Network:

• CARP IPv4 address: 192.168.1.1/24
• Master IPv4 address: 192.168.1.2/24
• Backup IPv4 address: 192.168.1.3/24

• Go to Services › KEA DHCP › Control Agent:

• Press Apply then go to Services › KEA DHCP › KEA DHCPv4 and follow through these tabs:

Settings

• Press Apply and go to Subnets

Subnets

• Press Save and go to HA Peers

HA Peers

• First entry:

• Second entry:

• Press Save and Apply

Now the initial configuration is finished, and we synchronize it with the backup server. Both servers will always share the exact same configuration.

Go to System: › High Availability › Settings and ensure that KEA is selected in Services to synchronize.

Then go to System: › High Availability › Status and press Synchronize and reconfigure all.

Immediately afterwards, KEA will be active on both master and backup, and a bidirectional lease synchronization will be configured.

DHCP Options

Each subnet and reservation has an DHCP option data list available. If Auto collect option data is enabled, some DHCP options like router, DNS server and system domain are added automatically. Additional fields can be filled out with other common options.

In cases where more advanced DHCP options need to be sent, you can use the Options tab found in Services › KEA DHCP › KEA DHCPv4 and Services › KEA DHCP › KEA DHCPv6.

When adding a new option, you can enter matching and setting parameters:

• When matching a DHCP option, a client class with a test is created. The set option will only be sent to clients that pass the test.
• When setting a DHCP option, the payload will be sent unconditionally if no match exists in the same input mask.

To send a created option, attach it to a reservation or subnet in their respective tabs with the available Options dropdown menu.

Combining both set and match enables you to create multiple options with the same code, but different payloads. A common example is matching based on client architecture and sending a specific boot file as payload:

• Go to Services › KEA DHCP › KEA DHCPv4 and follow through these tabs:

Option

Create an option for BIOS boot:

Create an option for EFI boot:

• Press Save and go to Subnets

Subnets

Select an available subnet, and add the Options you created:

• Press Save and Apply

With this configuration, any client that sends client-system [93] containing the value 0 will be provided with bootfile-name [67] and undionly.kpxe. The same logic applies to the efi bootfile.

Dynamic DNS (RFC2136)

KEA allows registering client FQDNs via dynamic DNS (RFC2136) to an authoritative DNS server.

Such an authoritative DNS server will be ISC BIND or an alternative like PowerDNS. Recursive DNS servers like Dnsmasq or Unbound are not able to fulfill this role.

When clients register their IP address, the DHCP server will receive a Client FQDN (DHCP option 81) that either contains a client hostname or an FQDN. In cases where clients only send a hostname, using the DNS qualifying suffix will construct an FQDN and force an update anyway.

As an example setup, we have configured a zone like this in ISC BIND. The example taken from the KEA DDNS documentation:

:
key "key.four.example.com." {
    algorithm hmac-sha224;
    secret "bZEG7Ow8OgAUPfLWV3aAUQ==";
};
:

To configure the forward zone for a DHCPv4 range, go to Services › KEA DHCP › KEA DHCPv4 and select a subnet:

Next, enable the KEA DDNS Agent. Go to Services › KEA DHCP › DDNS Agent:

After applying the configuration, the DHCP servers construct DDNS update requests, known as NameChangeRequests (NCRs), based on DHCP lease change events and then post them to the DDNS Agent. The DDNS Agent attempts to match each request to the appropriate DNS server and carries out the necessary conversation with those servers to update the DNS data.

For reverse zone updates enable the advanced mode inside a subnet. Add your DNS reverse zone to the existing forward configuration. Please note that reverse zone updates will be sent to the same DNS server as the forward zone updates.

Some clients might send client specific flags to avoid reverse zone updates. You can override that behavior with Override no update and Override client update.

Prefix Delegation (IA_PD)

Kea supports prefix delegation with static or dynamic prefixes. A prefix delegation is most commonly used for router behind router setups, yet also in client implementations that run their own VMs.

Route Installation

Whenever an IA_PD lease is acknowledged, a route targeting the link-local address of the requesting DHCPv6 client will be automatically installed.

Since lease files are synchronized in high availability mode, the routes will also be installed and cleaned up on both peers.

Static Prefix

As an example setup, we will use unique local addresses (ULA) to lease an IA_NA address (/128 IPv6 address) and a IA_PD prefix (/56 IPv6 prefix) to a requesting client.

Prefix: fd80::/48

• Go to Services › KEA DHCP › KEA DHCPv6 and follow through these tabs:

Settings

Subnets

For the IA_NA address pool, we take the first /52 prefix (fd80::/52) of the available /48 prefix (fd80::/48)

PD Pools

For the IA_PD pool, we take the second /52 prefix (fd80:0:0:1000::/52), and lease up to 16 prefixes (fd80:0:0:1000::/56 - fd80:0:0:10F0::/56) to clients.

After applying the configuration, clients will receive an IA_NA address (e.g., fd80::100/128) and an IA_PD prefix (e.g., fd80:0:0:1000::/56).

Dynamic Prefix

As an example setup, our provider has provided us a prefix via DHCPv6 on our WAN interface.

Prefix: 2001:db8:1234::/56

We will use Identity association mode to carve out a prefix on LAN that is big enough to host a PD pool.

• Go to Interfaces and set the following configuration:

LAN

To reserve a prefix range, the combination of the hexadecimal value Assign prefix ID and the decimal length value Reserved prefix range is used. On our LAN interface, we start with an assigned prefix ID of 0, which marks the first /64 network available. We reserve a /60 prefix for KEA’s subnet on this interface, so we count up 16x /64 networks via the reserved prefix range.

LAN will now reserve the hexadecimal prefix IDs 0-F.

OPT1

In this example we want to reserve a /61 prefix, so our decimal reserved prefix range is 8. Since our LAN interface already reserves the hexadecimal prefix IDs 0-F, for OPT1 we start at the hexadecimal prefix ID 10.

OPT1 will now reserve the hexadecimal prefix IDs 10-17.

OPT2

In this example we want to reserve a /62 prefix, so our decimal reserved prefix range is 4. Since our LAN interface reserves the hexadecimal prefix IDs 0-F, and our OPT1 interface the hexadecimal prefix IDs 10-17, for OPT1 we start at the hexadecimal prefix ID 18.

OPT2 will now reserve the hexadecimal prefix IDs 18-1B.

• Next, go to Services › Kea DHCP › Kea DHCPv6 and configure the dynamic PD pool for LAN:

Settings

Subnets

The subnet pool is automatically calculated. Since our example prefix ID range is from 0-F, the calculated subnet size will be 2001:db8:1234::/60. This subnet will be automatically split into two subnets: * the first subnet 2001:db8:1234::/61 will host the IA_NA pool 2001:db8:1234::/64 * the second subnet 2001:db8:1234:8::/61 will host the IA_PD pool.

PD Pools

For the IA_PD pool, the automatically calculated IA_PD prefix of the subnet is used. In our example that is 2001:db8:1234:8::/61. This is the range which can be delegated to other routers. We can set the delegated length to control how many prefixes can be leased from this pool. In our case we need 2 delegated prefixes, so we set a delegated length of /62.

After applying the configuration, clients will receive an IA_NA address (e.g., 2001:db8:1234::100/128) and an IA_PD prefix (e.g., 2001:db8:1234:8::/62).

Leases DHCPv4/v6

This page offers an overview of the (non static) leases being offered by KEA DHCPv4/v6.