<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
We would have the same use-case as you, Tobi, and I guess we would not be the only ones ?</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
The problem is also mentioned on <a href="https://kea.readthedocs.io/en/latest/arm/hooks.html?highlight=replace-client-id#the-replace-client-id-flag" title="https://kea.readthedocs.io/en/latest/arm/hooks.html?highlight=replace-client-id#the-replace-client-id-flag" id="LPlnk921418">https://kea.readthedocs.io/en/latest/arm/hooks.html?highlight=replace-client-id#the-replace-client-id-flag</a> by
the way.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
On <a href="https://kea.readthedocs.io/en/latest/arm/dhcp4-srv.html?#conflicts-in-dhcpv4-reservations" title="https://kea.readthedocs.io/en/latest/arm/dhcp4-srv.html?#conflicts-in-dhcpv4-reservations" id="LPlnk630249">https://kea.readthedocs.io/en/latest/arm/dhcp4-srv.html?#conflicts-in-dhcpv4-reservations</a> doc
says </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<span> </span>"<span style="color:rgb(64, 64, 64);font-family:Lato, proxima-nova, "Helvetica Neue", Arial, sans-serif;background-color:rgb(252, 252, 252);display:inline !important" class="ContentPasted0">The best way to avoid such a recovery is not to
define new reservations that conflict with existing leases. Another recommendation is to use out-of-pool reservations; if the reserved address does not belong to a pool, there is no way that other clients can get it.</span>" </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);" class="elementToProof">
But indeed, even with out-of-pool reservations, the hardware replacement use-case is not going to work :-/</div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)" class="elementToProof">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Kea-users <kea-users-bounces@lists.isc.org> on behalf of GIRSTMAIR Tobias via Kea-users <kea-users@lists.isc.org><br>
<b>Sent:</b> Friday, January 27, 2023 1:07 PM<br>
<b>To:</b> kea-users@lists.isc.org <kea-users@lists.isc.org><br>
<b>Subject:</b> [Kea-users] DHCPv4 Conflict resolution on MAC change</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText elementToProof">Hi all,<br>
<br>
We recently migrated to Kea 2.2.0 and now ran into the following<br>
situation:<br>
<br>
Initially:<br>
- Leases are valid for a long time (11 days, per customer requirement)<br>
- There is a host reservation for <mac1> and <ip1><br>
- The device with <mac1> got a lease for <ip1><br>
<br>
Now, the hardware is replaced and the reservation is updated, so the<br>
new device gets the same IP:<br>
- remove reservation for <mac1> and <ip1><br>
- add reservation for <mac2> and <ip1><br>
- the old device is unplugged, and therefore cannot release its lease<br>
- the new device is plugged in and requests a lease<br>
<br>
Now, Kea looks for the host reservation for <mac2> and notices that<br>
<ip1> is still leased to <mac1>, so it refuses to reassign this IP.<br>
This looks like this in the log:<br>
<br>
2023-01-26 08:43:18.065 WARN [kea-dhcp4.alloc-<br>
engine/1409.139836331153152] ALLOC_ENGINE_V4_DISCOVER_ADDRESS_CONFLICT<br>
[hwtype=1 00:15:bc:28:2b:0c], cid=[01:00:15:bc:28:2b:0c],<br>
tid=0xaf01221b: conflicting reservation for address 10.58.166.192 with<br>
existing lease Address: 10.58.166.192<br>
Valid life: 950400<br>
Cltt: 1674552388<br>
Hardware addr: 00:15:bc:28:09:e7<br>
Client id: 01:00:15:bc:28:09:e7<br>
Subnet ID: 5164<br>
State: default<br>
<br>
I read through section 8.3.2 of the documentation, and the conflict<br>
resolution protocol used seems to not handle our case here (where the<br>
old device doesn't release its lease). It expects the old device with<br>
<mac1> to renew its lease, before responding with DHCPNAK and<br>
reallocating <ip1> to <mac2>.<br>
<br>
As a workaround, an operator could manually delete the lease with kea-<br>
shell (or its underlying api), but that does not scale to our size.<br>
<br>
The documentation describes that "A naive approach would to be<br>
immediately remove the existing lease for Host A and create a new one<br>
for Host B" -- this would be exactly what we want, and what our<br>
previous setup did. Our reservations are out-of-pool, and we can be<br>
certain that when the MAC of a reservation changes, the old device will<br>
not be online any longer. Is there a way to achieve this?<br>
<br>
Thanks,<br>
<br>
Tobi<br>
-- <br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/" data-auth="NotApplicable">https://www.isc.org/contact/</a> for more information.<br>
<br>
To unsubscribe visit <a href="https://lists.isc.org/mailman/listinfo/kea-users" data-auth="NotApplicable">
https://lists.isc.org/mailman/listinfo/kea-users</a>.<br>
<br>
Kea-users mailing list<br>
Kea-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/kea-users" data-auth="NotApplicable">https://lists.isc.org/mailman/listinfo/kea-users</a><br>
</div>
</span></font></div>
</body>
</html>