<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">CCing the list.. sorry.<br>
</span></div>
<div class="elementToProof">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<b>Eric Graham</b></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i>DevOps Specialist</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="font-size: 8pt;">Direct: 605.990.1859</span><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 8pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"></span><i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 8pt; color: rgb(0, 0, 0); background-color: rgba(0, 0, 0, 0);"></span></i><a href="mailto:eric.graham@vantagepnt.com" title="mailto:eric.graham@vantagepnt.com" data-loopstyle="link"><span style="font-size: 8pt;">Eric.Graham@vantagepnt.com</span></a><i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<i><img style="max-width:100%" class="ContentPasted0" id="imageSelected0" data-outlook-trace="F:1|T:1" src="cid:16f20d06-c1b9-49c2-80f4-06819b01d04a"><br>
</i></div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Eric Graham <eric.graham@vantagepnt.com><br>
<b>Sent:</b> Wednesday, January 4, 2023 4:13 PM<br>
<b>To:</b> Kevin P. Fleming <lists.kea-users@kevin.km6g.us><br>
<b>Subject:</b> Re: [Kea-users] Load-Balancing Network issue between Relay and Kea</font>
<div> </div>
</div>
<style type="text/css" style="display:none">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div class="x_elementToProof">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
You're right. There's a table of values against which the DUID (if IPv6) is hashed. The result % number of servers is used as an index pointing to the server that will process the packet.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div class="x_ContentPasted1" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<a href="https://gitlab.isc.org/isc-projects/kea/-/blob/46dc8d276efda1a240f0c05580bdcba62ae5a6c7/src/hooks/dhcp/high_availability/query_filter.cc#L416-L446" id="LPNoLPOWALinkPreview_1">https://gitlab.isc.org/isc-projects/kea/-/blob/46dc8d276efda1a240f0c05580bdcba62ae5a6c7/src/hooks/dhcp/high_availability/query_filter.cc#L416-L446</a></div>
<div class="x__Entity x__EType_OWALinkPreview x__EId_OWALinkPreview_1 x__EReadonly_1">
</div>
<br>
<div class="x__Entity x__EType_OWALinkPreview x__EId_OWALinkPreview x__EReadonly_1">
</div>
</div>
<div class="x_elementToProof x_ContentPasted2" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Even though the Kea load balancing algorithm (as well as the DHCPd load balancing algorithm) is not exactly RFC compliant, this part seems to be. See RFC 3074 § 6.<br>
</div>
<div class="x_elementToProof">
<div class="x_ContentPasted1" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div class="x_ContentPasted1" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
I have encountered this same issue when one server cannot communicate. For me, it was partially caused by my socket type being wrong. However, I found the load balancing behavior to be sufficiently finnicky that I have standardized on hot-standby. With the
size deployments I deal with, load balancing provides marginal performance improvement at the cost of issues like this and more complicated configuration.</div>
<div class="x_ContentPasted1" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div class="x_ContentPasted1" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
Additionally, having a RADIUS backend made this issue even worse. Load balancing + RADIUS = a bad time.<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<br>
</div>
<div id="x_Signature">
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<b>Eric Graham</b></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<i>DevOps Specialist</i></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<span style="font-size:8pt">Direct: 605.990.1859</span><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:8pt; color:rgb(0,0,0); background-color:rgba(0,0,0,0)"></span><i><br>
</i></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<i><span style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:8pt; color:rgb(0,0,0); background-color:rgba(0,0,0,0)"></span></i><a href="mailto:eric.graham@vantagepnt.com" title="mailto:eric.graham@vantagepnt.com"><span style="font-size:8pt">Eric.Graham@vantagepnt.com</span></a><i><br>
</i></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0); background-color:rgb(255,255,255)">
<i><img class="x_ContentPasted0" id="x_imageSelected0" style="max-width:100%" data-outlook-trace="F:2|T:2" src="cid:611bb96b-af22-42ae-9890-37d6469ab42b"><br>
</i></div>
</div>
</div>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Kea-users <kea-users-bounces@lists.isc.org> on behalf of Kevin P. Fleming <lists.kea-users@kevin.km6g.us><br>
<b>Sent:</b> Wednesday, January 4, 2023 3:59 PM<br>
<b>To:</b> kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject:</b> Re: [Kea-users] Load-Balancing Network issue between Relay and Kea</font>
<div> </div>
</div>
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">CAUTION: This email originated outside the organization. Do not click any links or attachments unless you have verified the sender.<br>
<br>
On Wed, Jan 4, 2023, at 15:54, Simon wrote:<br>
<br>
> Kevin P. Fleming <lists.kea-users@kevin.km6g.us> wrote:<br>
><br>
>> If 'max-unacked-clients' isn't sufficient to address this, then this leaves a fairly large opening in the Kea high-availability story, as any network disruption which causes a server to no longer receive discovery packets from clients, but otherwise receives
all expected network traffic, won't be noticed except by the clients! This concerns me, as (like other users here) my Kea servers receive all client traffic via DHCP relays, and misconfiguration of the relay such that it only relays to one server and not both
will result in half of my clients not getting DHCP service at all.<br>
><br>
> Surely, if you misconfigure a relay agent in that way, around half your<br>
> clients will initially be unable to renew their leases, but eventually<br>
> will get serviced by the available server once their active lease has<br>
> expired ? That would mean the clients would drop their network config<br>
> momentarily before setting up a new one - meaning that active<br>
> connections would drop, but new ones would connect just fine once the<br>
> new settings are in place.<br>
<br>
That's why I posted; I don't really know!<br>
<br>
If the server receiving the client requests is not in partner-down state, based on my understanding of the Kea ARM section on HA it will not respond to those requests. That certainly seems to be the case while the lease is still active; once the lease has expired
I'm not sure what will happen.<br>
<br>
In my network with Kea in load-balancing mode, there seems to be some sort of algorithm involved even for DHCP DISCOVER, where only one of the two servers responds with DHCP OFFER even though they are both running in a normal state. It has been my assumption
(untested) up to this point that Kea is using the client's identifier (MAC address, DUID, etc.) to choose one or the other of the active servers to respond to that DISCOVER. If that's true, and both servers are in normal operation (neither is in partner-down),
then that algorithm would continue telling the second server to *not* respond to requests from that client because it believes the other server will do so... even if the other server is not receiving the client's requests.<br>
<br>
To summarize, that's what I assumed (against untested) 'max-unacked-clients' is for; if the second server assumes the first server will respond to those clients, but it does not (no leases are offered to them), it could notice the situation and decide that
the first server is unhealthy or partitioned and force it into a 'down' state.<br>
--<br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/">https://www.isc.org/contact/</a> for more information.<br>
<br>
To unsubscribe visit <a href="https://lists.isc.org/mailman/listinfo/kea-users">https://lists.isc.org/mailman/listinfo/kea-users</a>.<br>
<br>
Kea-users mailing list<br>
Kea-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/kea-users">https://lists.isc.org/mailman/listinfo/kea-users</a><br>
</div>
</span></font></div>
</div>
</body>
</html>