<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">The error “Unauthorized, error code 1” indicates that basic authentication if failing between the control agent and dhcp server. Not sure of additional log error “communication with kea_dhcp_2 is interrupted”. When I test my setup with
purposely bad password, I do not see that log message.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">You mention “keactrl is using a basic authentication with pre-shared key”. Per docs, I believe Kea currently only supports using basic authentication with username and password. You may want to verify that your control agent and partner
dhcp server are configured with same username/password . If nothing else, you could disable/remove authentication directives to verify heartbeat successful outside of authentication.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="font-size:12.0pt;color:black">From:
</span></b><span style="font-size:12.0pt;color:black">Kea-users <kea-users-bounces@lists.isc.org> on behalf of duluxoz <duluxoz@gmail.com><br>
<b>Date: </b>Thursday, January 26, 2023 at 2:27 AM<br>
<b>To: </b>kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject: </b>[Kea-users] Kea HA Heartbeat Failure<o:p></o:p></span></p>
</div>
<div style="border:solid #9C6500 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FFEB9C"><b><span style="font-size:10.0pt;color:#9C6500">CAUTION:</span></b><span style="font-size:10.0pt;color:black"> This email originated from outside of the organization. Do not click links or open
attachments unless you recognize the sender and know the content is safe.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Hi All,</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Looking for some pointers on an issue we've got.</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">TL:DR: Our Kea HA Servers' Heartbeat not connecting - permissions issue.</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">So we've got to Kea servers (v2.2) running on two Rocky Linux v9.1 servers. Clients are getting IP Addresses (both dynamic and reserved) and keactrl works fine, etc. But we're getting the following
error messages showing up in the logs:</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">~~~</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">2023-01-26 16:20:37.013 WARN [kea-dhcp4.ha-hooks/7896.140594097562496] HA_HEARTBEAT_FAILED heartbeat to kea_dhcp_2 (<a href="https://nam02.safelinks.protection.outlook.com/?url=http%3A%2F%2F192.168.1.3%3A8000%2F&data=05%7C01%7Crick.frey%40windstream.com%7C61a169e047054ccb964008daff771a97%7C2567b4c1b0ed40f5aee358d7c5f3e2b2%7C0%7C0%7C638103184289627508%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=VJ%2B7UkQyhlliH7F%2BU5Mr18f7lzVsjNVlmDXIAGSCIYA%3D&reserved=0">http://192.168.1.3:8000/</a>)
failed: Unauthorized, error code 1<br>
2023-01-26 16:20:37.013 WARN [kea-dhcp4.ha-hooks/7896.140594097562496] HA_COMMUNICATION_INTERRUPTED communication with kea_dhcp_2 is interrupted<br>
~~~</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Its not SELinux (we turned off SELinux and the problem persisted).</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Its not firewalld (we think) - ie the ports are opened, confirmed by netstat.</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">We are using the default port of 8000 for keactrl and the heartbeat (I assume this is OK, as the doco seems to imply that it is).</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">keactrl is using a basic authentication with a pre-shared key, and we've checked that its the same on both servers.</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">We've bound port 8000 to the actual IPv4 address of the server (not 127.0.0.1). We originally had it bound to the loopback address, and we were getting "connection refused" errors, so we bound
it to the real IP Address and not we're getting the above error.</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">The two servers' IP Addresses are in the correct "allow" statement, and when we removed the allow statement from the config (ie opened up connection to all) we still had the same problem.</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Finally, our config files are practically the same as those shown on numerous websites and in the official doco and sample files - with the relevant details changed (ie IP Addresses, etc) - I can
post them here if required, but I'm loath to fill up a post with irrelevant info unless requested. :-)</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">So, any pointers would be appreciated</span><o:p></o:p></p>
<p><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Cheers</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Dulux-Oz</span>
<o:p></o:p></p>
</div>
</div>
<br>
<p style="font-family:Calibri;font-size:8pt;color:#000000;margin:15pt;" align="Left">
Sensitivity: Internal<br>
</p>
</body>
</html>