ISC Kea DHCP and Stork Training Notes (Heise Workshop, June 2026)

• We work on the primary Kea-DHCP Server keaNNNa.dane.onl
• Start a root-shell

  $ sudo -i
  

• Install puplic GPG keys used to verify the packages

  % apt install -y debian-keyring apt-transport-https debian-archive-keyring
  % keyring_location=/usr/share/keyrings/isc-kea-3-0-archive-keyring.gpg
  % curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-3-0/gpg.B16C44CD45514C3C.key' |  gpg --dearmor >> ${keyring_location}
  % chmod 644 ${keyring_location}   
  

• Download the repo information

  % curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-3-0/config.deb.txt?distro=debian&codename=trixie&component=main' > \
    /etc/apt/sources.list.d/isc-kea-3-0.list
  % chmod 644 /etc/apt/sources.list.d/isc-kea-3-0.list
  % apt update
  

• Install Kea-DHCP binaries

  % apt install isc-kea
  

• Work on the primary Kea-DHCP Server keaNNNa.dane.onl
• Make a backup copy of the original Kea-DHCP6 configuration file

  % mv /etc/kea/kea-dhcp6.conf /etc/kea/kea-dhcp6.orig
  

• Create the Kea DHCP Server configuration file /etc/kea/kea-dhcp6.conf. Change the IPv6 address in the interface configuration to the IPv6 address of the VM machine. Use hostname -I to find the address.

{
    "Dhcp6": {
        "interfaces-config": {
            "interfaces": [
                "eth0/2001:db8:100::zzzz" # <-- change this to the IPv6 address of the machine
            ]
        },
        "lease-database": {
            "type": "memfile",
            "persist": true,
            "name": "/var/lib/kea/dhcp6.leases"
        },
        "subnet6": [
            {
                "subnet": "fd00:100::/64",
		"id": 1000,
                "pools": [
                    {
                        "pool": "fd00:100::1-fd00:100::ffff"
                    }
                ]
            },
            {
                "subnet": "fd00:200::/64",
		"id": 2000,
                "pools": [
                    {
                        "pool": "fd00:200::1-fd00:200::ffff"
                    }
                ]
            }
        ]},
        "loggers": [
            {
                "name": "kea-dhcp6",
                "output_options": [
                    {
                        "output": "/var/log/kea/kea-dhcp6.log"
                    }
                ],
                "severity": "INFO",
                "debuglevel": 0
            }
        ]
    }
}

• Check the syntax of the Kea DHCP4 configuration file. This time, the Kea-DHCP6 syntax check should return with an error

% kea-dhcp6 -t /etc/kea/kea-dhcp6.conf
2026-05-31 07:03:56.316 WARN  [kea-dhcp6.dhcp6/13333.139903392525376] DHCP6_CONFIG_SYNTAX_WARNING configuration syntax warning: /etc/kea/kea-dhcp6.conf:32.11: Extraneous comma. A piece of configuration may have been omitted.
Syntax check failed with: /etc/kea/kea-dhcp6.conf:33.9-17: syntax error, unexpected constant string, expecting "," or }

• Try to find and fix the error and check again. Solution: ( The "]}," before "loggers" has one extra "}", needs to be replaced with "]," )
• Successful Syntax check

% kea-dhcp6 -t /etc/kea/kea-dhcp6.conf
2026-05-31 07:04:35.008 WARN  [kea-dhcp6.dhcpsrv/13341.140495060110400] DHCPSRV_MT_DISABLED_QUEUE_CONTROL disabling dhcp queue control when multi-threading is enabled.
2026-05-31 07:04:35.008 WARN  [kea-dhcp6.dhcp6/13341.140495060110400] DHCP6_RESERVATIONS_LOOKUP_FIRST_ENABLED Multi-threading is enabled and host reservations lookup is always performed first.
2026-05-31 07:04:35.008 INFO  [kea-dhcp6.dhcpsrv/13341.140495060110400] DHCPSRV_CFGMGR_NEW_SUBNET6 a new subnet has been added to configuration: fd00:100::/64 with params: valid-lifetime=7200, rapid-commit is false
2026-05-31 07:04:35.008 INFO  [kea-dhcp6.dhcpsrv/13341.140495060110400] DHCPSRV_CFGMGR_NEW_SUBNET6 a new subnet has been added to configuration: fd00:200::/64 with params: valid-lifetime=7200, rapid-commit is false
2026-05-31 07:04:35.009 INFO  [kea-dhcp6.dhcpsrv/13341.140495060110400] DHCPSRV_CFGMGR_SOCKET_TYPE_SELECT using socket type raw
2026-05-31 07:04:35.009 INFO  [kea-dhcp6.dhcpsrv/13341.140495060110400] DHCPSRV_CFGMGR_USE_UNICAST listening on unicast address 2a03:b0c0:3:f0:0:2:7751:e000, on interface eth0
2026-05-31 07:04:35.009 INFO  [kea-dhcp6.dhcpsrv/13341.140495060110400] DHCPSRV_LEASE_MGR_BACKENDS_REGISTERED the following lease backend types are available: memfile
2026-05-31 07:04:35.009 INFO  [kea-dhcp6.hosts/13341.140495060110400] HOSTS_BACKENDS_REGISTERED the following host backend types are available:
2026-05-31 07:04:35.009 INFO  [kea-dhcp6.dhcpsrv/13341.140495060110400] DHCPSRV_FORENSIC_BACKENDS_REGISTERED the following forensic backend types are available:
2026-05-31 07:04:35.009 INFO  [kea-dhcp6.database/13341.140495060110400] CONFIG_BACKENDS_REGISTERED the following config backend types are available:

• (Re-)Start the Kea DHCPv6 server module via systemd

% systemctl restart isc-kea-dhcp6-server

• Check the status of the service

% systemctl status isc-kea-dhcp6-server
 * isc-kea-dhcp6-server.service - Kea DHCPv4 Service
     Loaded: loaded (/usr/lib/systemd/system/isc-kea-dhcp6-server.service; disabled; preset: enabled)
     Active: active (running) since Sat 2026-05-30 14:08:40 UTC; 2min 2s ago
 Invocation: 956a332d17c94910a5702aff0ae68b9e
       Docs: man:kea-dhcp6(8)
   Main PID: 46849 (kea-dhcp6)
      Tasks: 6 (limit: 506)
     Memory: 2.7M (peak: 2.9M)
        CPU: 60ms
     CGroup: /system.slice/isc-kea-dhcp6-server.service
             |-46849 /usr/sbin/kea-dhcp6 -c /etc/kea/kea-dhcp6.conf

May 31 07:05:58 kea001a systemd[1]: Started isc-kea-dhcp6-server.service - Kea DHCPv6 Service.
May 31 07:05:58 kea001a kea-dhcp6[13363]: 2026-05-31 07:05:58.864 INFO  [kea-dhcp6.dhcp6/13363.140540406717504] DHCP6_STARTING Kea DHCPv6 server version 3.0.3 (stable) starting
May 31 07:05:58 kea001a kea-dhcp6[13363]: 2026-05-31 07:05:58.865 INFO  [kea-dhcp6.commands/13363.140540406717504] COMMAND_RECEIVED Received command 'config-set'

• Observer the Kea-DHCP6 logfile

  % tail -f /var/log/kea/kea-dhcp6.log
  

• Work on the DHCP-Client VM machine
• Become root

  [dhcp]$ sudo -s
  

• Install the ISC-DHCP relay and client. Anwer all installation questions with ENTER.

  [dhcp]% apt install isc-dhcp-relay isc-dhcp-client
  [dhcp]% systemctl stop isc-dhcp-relay
  

• Create a virtual ethernet subnet using veth network interfaces (virtual ethernet)

  [dhcp]% ip link add client-veth0 type veth peer name relay-veth0
  [dhcp]% ip addr add fd00:100::ffff/64 dev relay-veth0
  [dhcp]% ip link set dev relay-veth0 up
  [dhcp]% ip link set dev client-veth0 up
  

• Manually start the ISC DHCP relay agent for DHCPv6

  [dhcp]% dhcrelay -6 -d -l relay-veth0 -u <ipv6-addr-of-kea-server>%eth0
  

• Manually start the ISC DHCP client

  [dhcp]% dhclient -d -6 client-veth0
  Internet Systems Consortium DHCP Client 4.4.3-P1
  Copyright 2004-2022 Internet Systems Consortium.
  All rights reserved.
  For info, please visit https://www.isc.org/software/dhcp/
  
  Listening on Socket/client-veth0
  Sending on   Socket/client-veth0
  Created duid "\000\001\000\0011\256\234\352\322\307\366\330\325\177".
  PRC: Soliciting for leases (INIT).
  XMT: Forming Solicit, 0 ms elapsed.
  XMT:  X-- IA_NA f6:d8:d5:7f
  XMT:  | X-- Request renew in  +3600
  XMT:  | X-- Request rebind in +5400
  XMT: Solicit on client-veth0, interval 1060ms.
  RCV: Advertise message on client-veth0 from fe80::2c97:e5ff:fe13:a902.
  RCV:  X-- IA_NA f6:d8:d5:7f
  RCV:  | X-- starts 1780211819
  RCV:  | X-- t1 - renew  +2250
  RCV:  | X-- t2 - rebind +3600
  RCV:  | X-- [Options]
  RCV:  | | X-- IAADDR fd00:100::1
  RCV:  | | | X-- Preferred lifetime 4500.
  RCV:  | | | X-- Max lifetime 7200.
  RCV:  X-- Server ID: 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3
  RCV:  Advertisement recorded.
  PRC: Selecting best advertised lease.
  PRC: Considering best lease.
  PRC:  X-- Initial candidate 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3 (s: 10103, p: 0).
  XMT: Forming Request, 0 ms elapsed.
  XMT:  X-- IA_NA f6:d8:d5:7f
  XMT:  | X-- Requested renew  +3600
  XMT:  | X-- Requested rebind +5400
  XMT:  | | X-- IAADDR fd00:100::1
  XMT:  | | | X-- Preferred lifetime +7200
  XMT:  | | | X-- Max lifetime +7500
  XMT:  V IA_NA appended.
  XMT: Request on client-veth0, interval 910ms.
  RCV: Reply message on client-veth0 from fe80::2c97:e5ff:fe13:a902.
  RCV:  X-- IA_NA f6:d8:d5:7f
  RCV:  | X-- starts 1780211820
  RCV:  | X-- t1 - renew  +2250
  RCV:  | X-- t2 - rebind +3600
  RCV:  | X-- [Options]
  RCV:  | | X-- IAADDR fd00:100::1
  RCV:  | | | X-- Preferred lifetime 4500.
  RCV:  | | | X-- Max lifetime 7200.
  RCV:  X-- Server ID: 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3
  PRC: Bound to lease 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3.
  PRC: Renewal event scheduled in 2250 seconds, to run for 1350 seconds.
  PRC: Depreference scheduled in 4500 seconds.
  PRC: Expiration scheduled in 7200 seconds.
  

• IPv6 Address configured on the client-veth0 interface

  [dhcp]% ip addr show dev client-veth0
  5: client-veth0@relay-veth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
   link/ether d2:c7:f6:d8:d5:7f brd ff:ff:ff:ff:ff:ff
   inet6 fd00:100::1/128 scope global dynamic
      valid_lft 7187sec preferred_lft 4487sec
   inet6 fe80::d0c7:f6ff:fed8:d57f/64 scope link proto kernel_ll
      valid_lft forever preferred_lft forever
  

• Log-Output on the DHCPv6 relay agent (The message Can't process packet from interface 'client-veth0'. is an artifact of the lab environment and can be ignored in this lab setup).

  Internet Systems Consortium DHCP Relay Agent 4.4.3-P1
  Copyright 2004-2022 Internet Systems Consortium.
  All rights reserved.
  For info, please visit https://www.isc.org/software/dhcp/
  Bound to *:547
  Listening on Socket/client-veth0
  Sending on   Socket/client-veth0
  Listening on Socket/eth1
  Sending on   Socket/eth1
  Listening on Socket/eth0
  Sending on   Socket/eth0
  Listening on Socket/relay-veth0
  Sending on   Socket/relay-veth0
  Can't process packet from interface 'client-veth0'.
  Relaying Solicit from fe80::d0c7:f6ff:fed8:d57f port 546 going up.
  Relaying Advertise to fe80::d0c7:f6ff:fed8:d57f port 546 down.
  Can't process packet from interface 'client-veth0'.
  Relaying Request from fe80::d0c7:f6ff:fed8:d57f port 546 going up.
  Relaying Reply to fe80::d0c7:f6ff:fed8:d57f port 546 down.
  

• Log output on the Kea-DHCPv6 Server:

  2026-05-31 07:16:59.542 INFO  [kea-dhcp6.dhcp6/13363.140540358358720] DHCP6_QUERY_LABEL received query: duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0x14dc4e
  2026-05-31 07:16:59.542 INFO  [kea-dhcp6.packets/13363.140540358358720] DHCP6_PACKET_RECEIVED duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0x14dc4e: SOLICIT (type 1) received from 2a03:b0c0:3:f0:0:2:7752:
  2000 to 2a03:b0c0:3:f0:0:2:7751:e000 on interface eth0
  2026-05-31 07:16:59.542 INFO  [kea-dhcp6.leases/13363.140540358358720] DHCP6_LEASE_ADVERT duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0x14dc4e: lease for address fd00:100::1 and iaid=4141405567 will be a
  dvertised
  2026-05-31 07:16:59.542 INFO  [kea-dhcp6.packets/13363.140540358358720] DHCP6_PACKET_SEND duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0x14dc4e: trying to send packet ADVERTISE (type 2) from [2a03:b0c0:3:
  f0:0:2:7751:e000]:547 to [2a03:b0c0:3:f0:0:2:7752:2000]:547 on interface eth0
  2026-05-31 07:17:00.597 INFO  [kea-dhcp6.dhcp6/13363.140540358358720] DHCP6_QUERY_LABEL received query: duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0xd89f32
  2026-05-31 07:17:00.597 INFO  [kea-dhcp6.packets/13363.140540358358720] DHCP6_PACKET_RECEIVED duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0xd89f32: REQUEST (type 3) received from 2a03:b0c0:3:f0:0:2:7752:2000 to 2a03:b0c0:3:f0:0:2:7751:e000 on interface eth0
  2026-05-31 07:17:00.598 INFO  [kea-dhcp6.leases/13363.140540358358720] DHCP6_LEASE_ALLOC duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0xd89f32: lease for address fd00:100::1 and iaid=4141405567 has been allocated for 7200 seconds
  2026-05-31 07:17:00.598 INFO  [kea-dhcp6.packets/13363.140540358358720] DHCP6_PACKET_SEND duid=[00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f], [no hwaddr info], tid=0xd89f32: trying to send packet REPLY (type 7) from [2a03:b0c0:3:f0:0:2:7751:e000]:547 to [2a03:b0c0:3:f0:0:2:7752:2000]:547 on interface eth0
  

• Kea-DHCP DHCPv6 Lease-file on the server side

  [kea-server]% cat /var/lib/kea/dhcp6.leases
  address,duid,valid_lifetime,expire,subnet_id,pref_lifetime,lease_type,iaid,prefix_len,fqdn_fwd,fqdn_rev,hostname,hwaddr,state,user_context,hwtype,hwaddr_source,pool_id
  fd00:100::1,00:01:00:01:31:ae:9c:ea:d2:c7:f6:d8:d5:7f,7200,1780219020,1000,4500,0,4141405567,128,0,0,,d2:c7:f6:d8:d5:7f,0,,1,2,0
  

• We work on the primary Kea-DHCP server keaNNNa.dane.onl
• A Kea-DHCP server takes control commands over either a unix, http or https socket. The socket location is defined in the Kea-Server configuration file. Make sure the socket definition for the DHCPv6 server looks like this (this will create a http control socket on the IPv6 loopback interface port 8005):

  {
      "Dhcp6": {
          "control-sockets": [
          {
              "socket-type": "http",
              "socket-address": "::1",
              "socket-port": 8005
          }
          ],
          "interfaces-config": {
  [...]
  

• Test the configuration and restart the service

  [kea-server]% kea-dhcp6 -t /etc/kea/kea-dhcp6.conf
  [kea-server]% systemctl restart isc-kea-dhcp6-server
  

• Check that the Kea-DHCPv6 server listens on port 8005

  [kea-server]% lsof -Poni :8005
  COMMAND     PID USER FD   TYPE DEVICE OFFSET NODE NAME
  kea-dhcp6 13735 _kea 11u  IPv6 183627    0t0  TCP [::1]:8005 (LISTEN)
  

• Sending API calls via curl. Here we send the config-get command to the DHCP server

  [kea-server]% curl --json '{ "command": "config-get" }' http://[::1]:8005/
  

• The output is unformatted JSON. The tool jq can be used to pretty-print the output

  [kea-server]% apt -y install jq
  [kea-server]% curl --json '{ "command": "config-get" }' http://[::1]:8005/ | jq
  

• jq can be used to filter specific parts of the configuration. (The jq filter ".[0].arguments" can be used to produce a valid Kea configuration file):

  [kea-server]% curl -s --json '{ "command": "config-get" }' \
                  http://[::1]:8005/ | jq ".[0].arguments.Dhcp6.loggers"
  [
    {
      "debuglevel": 0,
      "name": "kea-dhcp6",
      "output-options": [
        {
          "flush": true,
          "maxsize": 10240000,
          "maxver": 1,
          "output": "/var/log/kea/kea-dhcp6.log",
          "pattern": ""
        }
      ],
      "severity": "INFO"
    }
  ]
  

• The list-commands command returns back the API commands available for a specific Kea module

  [kea-server]% curl -s --json '{ "command": "list-commands" }' http://[::1]:8005/ | jq
  

• We work on the primary Kea-DHCP Server keaNNNa.dane.onl
• Dump the current configuration into the file kea-dhcp6.tmp

  [kea-server]% curl -s --json '{ "command": "config-get" }' http://[::1]:8005/ | jq ".[0]" > kea-dhcp6.tmp
  

• Edit the file, add the command information, remove the result and the hash structure at the end of the file and make changes to the configuration (in this example we set the default allocator, the algorithm how the DHCPv6 server allocates IPv6 addresses, to random):

  {
    "command": "config-set",
    "arguments": {
      "Dhcp6": {
        "allocator": "random",
        "cache-threshold": 0.25,
        "calculate-tee-times": true,
  [...]
        "t1-percent": 0.5,
        "t2-percent": 0.8,
        "valid-lifetime": 7200
      }
    }
  }
  

• Send the new configuration to the server

  [kea-server]% curl -s -X POST \
     -H "Content-Type: application/json" \
     -d @kea-dhcp6.tmp http://[::1]:8005/ | jq
  

• Successful result

  [
    {
      "arguments": {
        "hash": "8984F2EB3900894328BA333407FCA5085C382EEB16AF4DAB1F2252E852AF9234"
      },
      "result": 0,
      "text": "Configuration successful."
    }
  ]
  

• All dynamic changes are stored in memory. In order to make the changes persistent, write the in-memory configuration back to a file (be careful, any comments in the file will be gone and the formatting will be different)
• Writing the new file via the API fails. Why? What do we need to change to make the config-write API command work?

  Solution: The Linux-Security-Module apparmor has not yet been updated to allow Kea-DHCP to write into /etc/kea. Execute aa-teardown to disable AppArmor. On a production machine, you should write a new AppArmor Profile for Kea-DHCP that allows writing to /etc/kea

  [kea-server]% curl -s -X POST \
     --json '{ "command": "config-write", "arguments": { "filename": "kea-dhcp6-new.json" } }' \
     http://[::1]:8005/ | jq
  

• Successful result

  [
    {
      "arguments": {
        "filename": "/etc/kea/kea-dhcp6-new.json",
        "size": 4501
      },
      "result": 0,
      "text": "Configuration written to /etc/kea/kea-dhcp6-new.json successful"
    }
  ]
  

• Kea DHCP supports reservations of client leases based on hardware interface addresses (MAC-Address), DHCP Unique ID (DUID), Relay-Circut-ID (DHCPv4 only) or Client-ID (DHCPv4 only).
• Lookup the Hardware-MAC-Address of interface client-veth0 of your client machine with the command ip link show and create a reservation based on that hardware address in the Kea-DHCPv6 configuration on keaNNNa.dane.onl:

  [...]
  "subnet6": [
              {
                  "subnet": "fd00:100::/64",
                  "id": 1000,
                  "pools": [
                      {
                          "pool": "fd00:100::1-fd00:100::ffff"
                      }
                  ],
                  "reservations": [
                      {
                          "hw-address": "xx:xx:xx:xx:xx:xx",
                          "ip-addresses": [ "fd00:100::4242" ],
                          "hostname": "ipv6client",
                          "option-data": [
                          {
                              "name": "dns-servers",
                              "data": "2620:fe::fe, 2620:fe::9"
                          }
                          ]
                      }
                  ]
              },
  [...]
  

• Note: in DHCPv6, multiple IPv6-addresses can be assigned to a host. In DHCPv4 there can only be one IPv4 address assigned to a DHCP client, thus the parameter is "ip-address": "192.0.2.1"
• Test the configuration and restart the Kea DHCPv6 server
• Check from the client VM that the reserved IPv6 address is assigned and the list of DNS resolver is delivered

  [client]% dhclient -6 -r
  Killed old client process
  [client]% rm /var/lib/dhcp/dhclient6.leases
  [Client]% dhclient -v -6 client-veth0
  Internet Systems Consortium DHCP Client 4.4.3-P1
  Copyright 2004-2022 Internet Systems Consortium.
  All rights reserved.
  For info, please visit https://www.isc.org/software/dhcp/
  
  Listening on Socket/client-veth0
  Sending on   Socket/client-veth0
  Created duid "\000\001\000\0011\256\275\200\322\307\366\330\325\177".
  PRC: Soliciting for leases (INIT).
  XMT: Forming Solicit, 0 ms elapsed.
  XMT:  X-- IA_NA f6:d8:d5:7f
  XMT:  | X-- Request renew in  +3600
  XMT:  | X-- Request rebind in +5400
  XMT: Solicit on client-veth0, interval 1070ms.
  RCV: Advertise message on client-veth0 from fe80::2c97:e5ff:fe13:a902.
  RCV:  X-- IA_NA f6:d8:d5:7f
  RCV:  | X-- starts 1780220161
  RCV:  | X-- t1 - renew  +2250
  RCV:  | X-- t2 - rebind +3600
  RCV:  | X-- [Options]
  RCV:  | | X-- IAADDR fd00:100::4242
  RCV:  | | | X-- Preferred lifetime 4500.
  RCV:  | | | X-- Max lifetime 7200.
  RCV:  X-- Server ID: 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3
  RCV:  Advertisement recorded.
  PRC: Selecting best advertised lease.
  PRC: Considering best lease.
  PRC:  X-- Initial candidate 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3 (s: 10104, p: 0).
  XMT: Forming Request, 0 ms elapsed.
  XMT:  X-- IA_NA f6:d8:d5:7f
  XMT:  | X-- Requested renew  +3600
  XMT:  | X-- Requested rebind +5400
  XMT:  | | X-- IAADDR fd00:100::4242
  XMT:  | | | X-- Preferred lifetime +7200
  XMT:  | | | X-- Max lifetime +7500
  XMT:  V IA_NA appended.
  XMT: Request on client-veth0, interval 1090ms.
  RCV: Reply message on client-veth0 from fe80::2c97:e5ff:fe13:a902.
  RCV:  X-- IA_NA f6:d8:d5:7f
  RCV:  | X-- starts 1780220162
  RCV:  | X-- t1 - renew  +2250
  RCV:  | X-- t2 - rebind +3600
  RCV:  | X-- [Options]
  RCV:  | | X-- IAADDR fd00:100::4242
  RCV:  | | | X-- Preferred lifetime 4500.
  RCV:  | | | X-- Max lifetime 7200.
  RCV:  X-- Server ID: 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3
  PRC: Bound to lease 00:01:00:01:31:ae:9a:56:d6:2e:ca:8b:c8:c3.
  

• Checking for host reservations slows down the Kea dhcp server. By telling what identifiers are used for DHCP reservations (if at all), the performance of Kea DHCP can be optimized:

  [...]
          "host-reservation-identifiers": [ "duid", "hw-address" ],
  	"reservations-in-subnet": true,
  	"reservations-out-of-pool": true,
  	"reservations-global": false,
          "subnet4": [
  [...]
  

• We work on the primary Kea-DHCP-Server keaNNNa.dane.onl
• Install the PostgreSQL database server and the Kea-DHCP extension for acessing the PostgreSQL database

  [keaNNNa]% apt install postgresql isc-kea-pgsql
  

• Check that the PostgreSQL database is started

  [keaNNNa]% systemctl status postgresql
  

• Connect to the database server. This PostgreSQL-Server does not have a password set, use the empty password to log in. For a production installation, configure password authentication for the database server. PostgreSQL authentication configuration is out of scope of the ISC Kea DHCP training.

  [keaNNNa]% su - postgres
  [keaNNNa]$ psql postgres
  psql (17.10 (Debian 17.10-0+deb13u1))
  Type "help" for help.
  
  postgres=#
  

• Create a new database, kea_lease_db is the name of the database in this example

  postgres=# CREATE DATABASE kea_lease_db;
  CREATE DATABASE
  

• Create a user for Kea server to access the database

  postgres=# CREATE USER kea WITH PASSWORD 'secure-password';
  CREATE ROLE
  

• Set the permissions for the new user on the database

  postgres=# GRANT ALL PRIVILEGES ON DATABASE kea_lease_db TO kea;
  GRANT
  

• In PostgreSQL 15 (and higher) you must make the user kea the owner of the database and give this user the rights to change the database schema (see https://www.cybertec-postgresql.com/en/error-permission-denied-schema-public/)

  postgres=# GRANT ALL ON SCHEMA public TO kea;
  postgres=# ALTER DATABASE kea_lease_db OWNER TO kea;
  

• Leave PostgreSQL client

  postgres=# \q
  

• Leave the shell with user postgres to be user root again

  [kea-server]$ exit
  [kea-server]% id
  uid=0(root) gid=0(root) groups=0(root)
  

• Configure the PostgreSQL Database to use password authentication for the Kea database. The Kea database entries must appear before the all database entries in the file /etc/postgresql/17/main/pg_hba.conf

  # TYPE  DATABASE        USER            ADDRESS                 METHOD
  local   kea_lease_db    kea                                 password
  host    kea_lease_db    kea          127.0.0.1/32           password
  host    kea_lease_db    kea          ::1/128                password
  
  # "local" is for Unix domain socket connections only
  local   all             all                                     peer
  [...]
  

• Restart the PostgreSQL database server

  [keaNNNa]% systemctl restart postgresql
  

• Create the database tables using the kea-admin tool

  [keaNNNa]% kea-admin db-init pgsql -u kea -h 127.0.0.1 -p secure-password -n kea_lease_db
  

• Add support for the PostgreSQL-Database to Kea-DHCP with the database hook:

  {
  "Dhcp6": {
    "hooks-libraries": [
     {
       "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_pgsql.so"
     }
     ],
  

• Adjust the lease-database block in the Kea server configuration to use a PostgreSQL-type database:

  [...]
          "lease-database": {
            "type": "postgresql",
            "host": "localhost",
            "name": "kea_lease_db",
            "user": "kea",
            "password": "secure-password"
          },
  [...]
  

• Test the configuration file and restart the Kea DHCP server
• Test requesting a lease from the DHCP Client VM
• Dump the lease database using the kea-admin tool
  • Why don't we see the lease for fd00:100::4242?

[keaNNNa]% kea-admin lease-dump pgsql -u kea -h ::1 \
                -p secure-password -n kea_lease_db -o leases.csv -6
lease6 successfully dumped to leases.csv
[keaNNNa]% cat leases.csv		
address,duid,valid_lifetime,expire,subnet_id,pref_lifetime,lease_type,iaid,prefix_len,fqdn_fwd,fqdn_rev,hostname,hwaddr,state,user_context,hwtype,hwaddr_source,pool_id
fd00:100::3,00:01:00:01:31:af:2c:32:d2:c7:f6:d8:d5:7f,7200,1780255700,1000,4500,0,-153561729,128,0,0,,d2:c7:f6:d8:d5:7f,0,,1,2,0

• A host database can be created the same way as the lease database (instructions above)

  [...]
  	"hosts-database": {
  	  "type": "postgresql",
  	  "host": "localhost",
  	  "name": "kea_host_db",
  	  "user": "kea",
  	  "password": "secure-password"
  	},
  [...]
  

• If the database content is maintained via database updates, the host/reservation database can be configured in read-only mode:

  [...]
  	"hosts-database": {
  	  "readonly": true,
  	  "type": "postgresql",
  	  "host": "localhost",
  	  "name": "kea_host_db",
  	  "user": "kea",
  	  "password": "secure-password"
  	},
  [...]
  

• Work on the primary Kea-DHCP-Server keaNNNa.dane.onl
• Add the host-database block on the same level as the lease-database to the Kea-DHCP configuration. In this exercise, we use the same database for leases and reservations.

  [...]
          "hosts-database": {
            "type": "postgresql",
            "host": "localhost",
            "name": "kea_lease_db",
            "user": "kea",
            "password": "secure-password"
          },
  [...]
  

• We will fill the host database later in the workshop from the Stork application

• See https://kea.readthedocs.io/en/latest/arm/hooks.html#host-cmds-host-commands
• This hooks offers a number of new commands used to query and manipulate host reservations. Kea provides a way to store host reservations in a database. In many larger deployments it is useful to be able to manage that information while the server is running. This library provides management commands for adding, querying and deleting host reservations in a safe way without restarting the server.

"hooks-libraries": [
  {
    "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_pgsql.so"
  },
  {
    "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_host_cmds.so"
  },
  {
    "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_subnet_cmds.so"
  },

• The Host-Reservations can be managed directly on the SQL database layer, without the need of the host commands hook. However this is less convinient and the SQL code needs to be adapted when the SQL table schema changes between Kea release versions
• The document from ISC describes how to manage host reservations on the SQL level: https://gitlab.isc.org/isc-projects/kea/-/wikis/docs/editing-host-reservations
• It is recommended to create a wrapper around the SQL commands to use from the command line or a web interface

• We work on the primary Kea-DHCP Server keaNNNa.dane.onl
• Copy the prepared x509 certificates into the Kea-DHCP directory, replace NNN with your participant number

  [keaNNNa]% cp /root/.acme.sh/keaNNNa.dane.onl_ecc/keaNNNa.dane.onl.key /etc/kea/kea-cert.key
  [keaNNNa]% cp /root/.acme.sh/keaNNNa.dane.onl_ecc/fullchain.cer /etc/kea/kea-cert.pem
  [keaNNNa]% chown _kea /etc/kea/kea-cert.*
  

• Create a new (2nd) socket configuration for a https socket listening on the public IPv6 address of the kea server

  {
      "socket-type": "https",
      "socket-address": "2001:db8::1", # <- IP address of the Kea Lab server VN
      "socket-port": 8005,
      "http-headers": [
          {
              "name": "Strict-Transport-Security",
              "value": "max-age=31536000"
           }
      ],
      "trust-anchor": "/etc/ssl/certs/ca-certificates.crt",
      "cert-file": "/etc/kea/kea-cert.pem",
      "key-file": "/etc/kea/kea-cert.key",
      "cert-required": false
  }
  

• Test the Kea-DHCP configuration and restart the server
• Test from the DHCP-Client VM (now with https instead of http):

  [dhcp]% curl  --json '{ "command": "config-get" }' https://keaNNNa.dane.onl:8005/
  

• We work on the primary Kea-DHCP Server keaNNNa.dane.onl
• Add basic authentication to the existing https socket

  {
      "socket-type": "https",
      "socket-address": "2001:db8::1", # <- IP address of the Kea Lab server VN
      "socket-port": 8005,
      "http-headers": [
          {
              "name": "Strict-Transport-Security",
              "value": "max-age=31536000"
           }
      ],
      "trust-anchor": "/etc/ssl/certs/ca-certificates.crt",
      "cert-file": "/etc/kea/kea-cert.pem",
      "key-file": "/etc/kea/kea-cert.key",
      "cert-required": false,
  
      # --- new config-block starts here ---
      
      "authentication": {
         "type": "basic",
         "realm": "kea-dhcp6",
         "clients": [
             {
                 "user": "admin",
                 "password": "kea-dhcp"
             } ]
      }
  }
  

• Check the configuration and restart the Kea-DHCP Server
• From the DHCP client, try to connect to the API without authenticagtion. It should now fail:

  [dhcp]# curl  --json '{ "command": "config-get" }' https://keaNNNa.dane.onl:8005/
  { "result": 401, "text": "Unauthorized" }
  

• Try curl with authentication:

  [dhcp]# curl -u username:password  --json '{ "command": "config-get" }' https://keaNNNa.dane.onl:8005/
  

• We work on the second Kea-DHCP-Server keaNNNb.dane.onl, which will be also our DNS server
• Install a BIND 9 server from the Debian repositories

  [keaNNNb]% apt install bind9
  

• Create a simple BIND 9 configuration

  [keaNNNb]% cd /etc/bind
  [keaNNNb]% mv named.conf named.conf.orig
  [keaNNNb]% $EDITOR named.conf
  

• BIND 9 configuration file, add the IP-address (IPv6 or IPv4) of your primary Kea-DHCP-Server keaNNNa in the allow-update statement

  options {
          recursion no;
          directory "/var/cache/bind";
  };
  
  zone "example.com" {
       type master;
       allow-update { <ip-address-of-keaNNNa>; };
       file "example.com";
  };
  

• Create a simple zone file for the domain example.com

  [keaNNNb]% $EDITOR /var/cache/bind/example.com
  

• Content of the example.com zonefile

  $TTL 1h
  @    IN SOA  dns.example.com. hostmaster 1001 2h 30m 41d 1h
       IN NS   dns.example.com.
  dns  IN A    <ipv4-of-keaNNNb>
       IN AAAA <ipv6-of-keaNNNb>
  

• Adjust the file and directory permissions

  [keaNNNb]% chown -R bind /var/cache/bind
  

• Check configuration and reload the configuration in the BIND 9 DNS-Server

  [keaNNNb]% named-checkconf -z /etc/bind/named.conf
  zone example.com/IN: loaded serial 1001
  [keaNNNb]% rndc reload
  server reload successful
  

• Query the SOA record from the new DNS-Server, check the flags to see that the answer is authoritative (AA-Flag)

  [keaNNNb]% dig @localhost soa example.com
  ; <<>> DiG 9.20.23-1~deb13u1-Debian <<>> @localhost soa example.com
  ; (2 servers found)
  ;; global options: +cmd
  ;; Got answer:
  ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1598
  ;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
  ;; WARNING: recursion requested but not available
  
  ;; OPT PSEUDOSECTION:
  ; EDNS: version: 0, flags:; udp: 1232
  ; COOKIE: c6b2992e74e32610010000006a1fa3213a24a0da76b66c56 (good)
  ;; QUESTION SECTION:
  ;example.com.                   IN      SOA
  
  ;; ANSWER SECTION:
  example.com.            3600    IN      SOA     dns.example.com. hostmaster.example.com. 1001 7200 1800 3542400 3600
  
  ;; Query time: 4 msec
  ;; SERVER: ::1#53(localhost) (UDP)
  ;; WHEN: Wed Jun 03 03:44:33 UTC 2026
  ;; MSG SIZE  rcvd: 119
  

• Work on the primary Kea DHCP Server machine keaNNNa
• Make a backup copy of the original configuration file for the Kea-DHCP-DDNS-Service:

  % mv /etc/kea/kea-dhcp-ddns.conf /etc/kea/kea-dhcp-ddns.orig
  

• Create a configuration file for the kea-dhcp-ddns daemon in /etc/kea/kea-dhcp-ddns.conf (writing domain names in full qualified format, including the "." at the end, is very important!). Adjust the IP-Adress of the BIND 9 DNS-Server (use IPv6 or IPv4, same protocol as on the BIND 9 server side):

  {
      "DhcpDdns": {
          "ip-address": "127.0.0.1",
          "port": 53001,
          "dns-server-timeout": 100,
          "ncr-protocol": "UDP",
          "ncr-format": "JSON",
          "tsig-keys": [],
          "forward-ddns": {
              "ddns-domains": [
                  {
                      "name": "example.com.",
                      "key-name": "",
                      "dns-servers": [
                          {
                              "hostname": "",
                              "ip-address": "<ip-address-of-keaNNNb>", # <- change this
                              "port": 53
                          }
                      ]
                  }
              ]
          },
          "reverse-ddns": {
              "ddns-domains": []
          },
          "loggers": [
              {
                  "name": "kea-dhcp-ddns",
                  "severity": "INFO",
                  "output_options": [
                      {
                          "output": "/var/log/kea/kea-dhcp-ddns.log"
                      }
                  ]
              }
          ]
      }
  }
  

• Test the configuration file

  [kea-server]% kea-dhcp-ddns -t /etc/kea/kea-dhcp-ddns.conf
  2026-06-03 03:53:58.118 INFO  [kea-dhcp-ddns.dctl/49992.140367012293760] DCTL_CONFIG_CHECK_COMPLETE server has completed configuration check: listening on 127.0.0.1, port 53001, using UDP, result: success(0), text=Configura
  

• (Re-)Start the Kea DHCP-DDNS (D2) server

  [kea-server]% systemctl restart isc-kea-dhcp-ddns-server
  [kea-server]% systemctl status isc-kea-dhcp-ddns-server
  ● kea-dhcp-ddns.service - Kea DHCP-DDNS Server
     Loaded: loaded (/usr/lib/systemd/system/kea-dhcp-ddns.service; disabled; vendor preset: disabled)
     Active: active (running) since Sat 2018-12-08 21:34:07 UTC; 4s ago
       Docs: man:kea-dhcp-ddns(8)
   Main PID: 55 (kea-dhcp-ddns)
      Tasks: 1 (limit: 4915)
     Memory: 1.8M
     CGroup: /machine.slice/libpod-e96af203d05ac37853f65c7a93ffdbf87d509873172b7bab5abae1505f6a2c9b.scope/system.slice/kea-dhcp-ddns.service
             └─55 /usr/sbin/kea-dhcp-ddns -c /etc/kea/kea-dhcp-ddns.conf
  
  Dec 08 21:34:07 e96af203d05a systemd[1]: Started Kea DHCP-DDNS Server.
  Dec 08 21:34:07 e96af203d05a kea-dhcp-ddns[55]: 2018-12-08 21:34:07.445 INFO  [kea-dhcp-ddns.dctl/55] DCTL_STARTING DhcpDdns starting, pid: 55, version: 1>
  Dec 08 21:34:07 e96af203d05a kea-dhcp-ddns[55]: 2018-12-08 21:34:07.446 INFO  [kea-dhcp-ddns.dctl/55] DCTL_CONFIG_COMPLETE server has completed configurat>
  Dec 08 21:34:07 e96af203d05a kea-dhcp-ddns[55]: 2018-12-08 21:34:07.446 INFO  [kea-dhcp-ddns.dhcpddns/55] DHCP_DDNS_STARTED Kea DHCP-DDNS server version 1>
  

• Enable DDNS in the kea-dhcp6.conf configuration file

  {
    "Dhcp6": {
      "ddns-replace-client-name": "always",
      "ddns-generated-prefix": "host",
      "ddns-qualifying-suffix": "example.com.",
      "dhcp-ddns": {
        "enable-updates": true
      },
  [...]
  

• Test the configuration and restart the Kea DHCP server
• Monitor the Kea-DHCP-DDNS logfile

  [kea-server]% tail -f /var/log/kea/kea-dhcp-ddns.log
  

• Request a lease from the client dhcpNNN. Observe the Kea-DHCP-DDNS logfile:

  2026-06-03 03:58:39.257 INFO  [kea-dhcp-ddns.d2-to-dns/50027.139690965929088] DHCP_DDNS_ADD_SUCCEEDED DHCP_DDNS Request ID 0002019B3940D8B77DE40CF2FF2DF97188D1C31C52DFE423323F5A76C1AC87606C07FB: successfully added the DNS mapping addition for this request: Type: 0 (CHG_ADD)
  Forward Change: yes
  Reverse Change: no
  FQDN: [host-fd00-100--1.example.com.]
  IP Address: [fd00:100::1]
  DHCID: [0002019B3940D8B77DE40CF2FF2DF97188D1C31C52DFE423323F5A76C1AC87606C07FB]
  Lease Expires On: 19700101000000
  Lease Length: 2400
  Conflict Resolution Mode: check-with-dhcid
  

• Log on the BIND 9 DNS-Server

  [keaNNNb]% journalctl -fu named
  [...]
  Jun 03 03:45:40 kea015b named[45467]: configuring command channel from '/etc/bind/rndc.key'
  Jun 03 03:45:40 kea015b named[45467]: reloading configuration succeeded
  Jun 03 03:45:40 kea015b named[45467]: reloading zones succeeded
  Jun 03 03:45:40 kea015b named[45467]: all zones loaded
  Jun 03 03:45:40 kea015b named[45467]: FIPS mode is disabled
  Jun 03 03:45:40 kea015b named[45467]: running
  Jun 03 03:45:40 kea015b named[45467]: managed-keys-zone: Key 20326 for zone . is now trusted (acceptance timer complete)
  Jun 03 03:45:40 kea015b named[45467]: managed-keys-zone: Key 38696 for zone . is now trusted (acceptance timer complete)
  Jun 03 03:58:39 kea015b named[45467]: client @0x7f6976611000 104.248.142.199#32925: updating zone 'example.com/IN': adding an RR at 'host-fd00-100--1.example.com' AAAA fd00:100::1
  Jun 03 03:58:39 kea015b named[45467]: client @0x7f6976611000 104.248.142.199#32925: updating zone 'example.com/IN': adding an RR at 'host-fd00-100--1.example.com' DHCID AAIBmzlA2Ld95Azy/y35cYjRwxxS3+QjMj9adsGsh2BsB/s=
  

• Inspect updated zonefile on the BIND 9 DNS-Server

  [keaNNNb]% rndc sync
  [keaNNNb]% cat /var/cache/bind/example.com
  $TTL 3600       ; 1 hour
  example.com.            IN SOA  dns.example.com. hostmaster.example.com. (
                                  1002       ; serial
                                  7200       ; refresh (2 hours)
                                  1800       ; retry (30 minutes)
                                  3542400    ; expire (5 weeks 6 days)
                                  3600       ; minimum (1 hour)
                                  )
                          NS      dns.example.com.
  dns.example.com.        A       104.248.142.199
                          AAAA    2a03:b0c0:3:f0:0:2:7b4f:d000
  $TTL 2400       ; 40 minutes
  host-fd00-100--1.example.com. AAAA fd00:100::1
                          DHCID   ( AAIBmzlA2Ld95Azy/y35cYjRwxxS3+QjMj9adsGsh2Bs
                                  B/s= ) ; 2 1 32
  

• Operating DDNS with authentication based on IP-Adresses is insecure. In production environments, DDNS should be authenticated with TSIG
• In this exercise we change the previous DDNS configuration to use TSIG keys

• Add a reverse zones to the BIND 9 DNS-Server for the IP-Networks fd00:100::/64 (0.0.0.0.0.0.0.0.0.0.1.0.0.0.d.f.ip6.arpa.).
• Add the reverse zones to the Kea-DHCP-DDNS daemon configuration
• Reload and test

• Add a HA Standby configuration to keaNNNa in the file /etc/kea/kea-dhcp6.conf. The Hook-Library dhcp_lease_cmds is required for the HA Module (it uses the REST API functions defined in this hook):

"Dhcp6"{
[...]
        "hooks-libraries": [
        {
            "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_lease_cmds.so",
            "parameters": { }
        },
            {
            "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_ha.so",
            "parameters": {
                "high-availability": [ {
                    "this-server-name": "keaNNNa",
                    "mode": "hot-standby",
                    "heartbeat-delay": 10000,    # miliseconds
                    "max-response-delay": 20000, # miliseconds
                    "max-ack-delay": 5000,       # miliseconds
                    "max-unacked-clients": 0,    # immediate partner down
                    "peers": [
                        {
                            "name": "keaNNNa",
                            "url": "http://<ip-of-keaNNNa.dane.onl>:9098/",
                            "role": "primary",
                            "auto-failover": true
                        },
                        {
                            "name": "keaNNNb",
                            "url": "http://<ip-kea-keaNNNb.dane.onl>:9098/",
                            "role": "standby",
                            "auto-failover": true
                        }
                    ]
                } ]
            }
        }
    ],
[...]

• Test the Kea DHCP server configuration and start the Kea server
• Start monitoring the Kea DHCP6 log file

[keaNNNa]% tail -f /var/log/kea/kea-dhcp6.log

• On a different terminal, connect to keaNNNb, become root, install Kea-DHCP from the ISC-Cloudsmith repositories and move the copied configuration file to /etc/kea

[keaNNNb]%
   % apt install -y debian-keyring apt-transport-https debian-archive-keyring
   % keyring_location=/usr/share/keyrings/isc-kea-3-0-archive-keyring.gpg
   % curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-3-0/gpg.B16C44CD45514C3C.key' |  gpg --dearmor >> ${keyring_location}
   % chmod 644 ${keyring_location}
   % curl -1sLf 'https://dl.cloudsmith.io/public/isc/kea-3-0/config.deb.txt?distro=debian&codename=trixie&component=main' > \
   /etc/apt/sources.list.d/isc-kea-3-0.list
   % chmod 644 /etc/apt/sources.list.d/isc-kea-3-0.list
   % apt update && apt install isc-kea

• Copy the configuration from keaNNNa to keaNNNb using curl and the Kea-DHCP-API

  [keaNNNb]% apt install jq
  [keaNNNb]% curl -u admin:kea-dhcp  --json '{ "command": "config-get" }' https://keaNNNa.dane.onl:8005/ | jq ".[0].arguments" > /etc/kea/kea-dhcp6.conf
  

• Remove the result and hash information from the file
• Change the https socket IPv6 address to the address of keaNNNb Change the IPv6 address in the interfaces-config to the address of keaNNNb
• Copy the prepared x509 certificates into the Kea-DHCP directory

  [keaNNNb]% cp /root/.acme.sh/keaNNNb.dane.onl_ecc/keaNNNb.dane.onl.key /etc/kea/kea-cert.key
  [keaNNNb]% cp /root/.acme.sh/keaNNNb.dane.onl_ecc/fullchain.cer /etc/kea/kea-cert.pem
  [keaNNNb]% chown _kea /etc/kea/kea-cert.*
  

• Change the this-server-name configuration option in the Kea DHCP6 server configuration file to the text keaNNNb
• Remove the PostgreSQL host-database from the configuration
• Change the lease database back to memfile (or install and configure PostgreSQL on keaNNNb)

"lease-database": {
    "type": "memfile"
},

• Remove the Hook for PostgreSQL libdhcp_pgsql.so
• Test the configuration for the Kea DHCP6 server, start the server and check that the service has been started

[keaNNNb]% systemctl start isc-kea-dhcp6-server
[keaNNNb]% systemctl status isc-kea-dhcp6-server

• Start monitoring the Kea DHCP6 log file

[keaNNNb]% tail -f /var/log/kea/kea-dhcp6.log

• You should see the HA protocol to sync and to start sending heartbeat messages between the two servers

• On the DHCP-Client, stop the DHCP relay agent
• Start the DHCP-Relay to send the requests from clients to both Kea DHCP6 servers

[dhcp]% dhcrelay -6 -d -l relay-veth0 -u <ip-of-keaNNNa>%eth0 -u <ip-of-keaNNNb>%eth0

• Request a lease from a client. This lease should come from keaNNNa and the lease should be synced to keaNNNb (look into the lease file on disk)

[dhcp]% dhclient -v -6 client-veth0

• Stop the process kea-dhcp4 on the machine keaNNNa

[keaNNNa]% systemctl stop isc-kea-dhcp6-server

• The log messages on keaNNNb should indicate the partner-down state
• Requests from the DHCP client should now served after 5000ms from keaNNNb
• Start the process isc-kea-dhcp6-server on keaNNNa. Watch the lease-database synchronize, request a lease from the DHCP client, that client should now be served from keaNNNa again.

[keaNNNa]% systemctl start isc-kea-dhcp6-server

• Kea: 6-8 CPU cores, high clock rate, large CPU cache
• Database: 12-20 cores, moderate clock rate
• Disable SMT (Hyperthreading)
• Fast SSD for Memory-DB or SQL-DB
• Network Interface with UDP offloading

• Enable Multi-Threading
• Avoid shared networks
• Reduce reservation checks
• Reduce reservation identifier
• Keep pool utilization below 80%
• Avoid complex client class expressions
• Remove unused hooks
• Avoid costly hooks (Run-Script)

• Enable asynchronous writes in the database engine
• Tune lease database for fast writes
• Tune reservation database for fast reads
• Tune database memory caches

• Backup-Mode uses less resources than load-balancing or fail-over
• Avoid shared lease databases for HA setups
• Reduce latency between cluster nodes

• Blog: Kea Performance Optimization https://kb.isc.org/docs/kea-performance-optimization
• Kea Performance Test results https://reports.kea.isc.org/
• Video: Optimizing Kea Performance https://www.youtube.com/watch?v=tFYSOxMB33k

• On the Kea-DHCP6 server configuration file, enable rapid commit on a subnet:

[...]
        "subnet6": [
            {
                "subnet": "fd00:100::/32",
		"id": 1000,
                "rapid-commit": true,
                "pools": [
                    {
                        "pool": "fd00:100::1-fd00:100::ffff"
                    }
                ],
[...]

• Test the configuration and reload the DHCPv6 service
• Monitor the Kea server logfile and the relay-agent output

• On machine clientA, create the file /etc/dhcp/dhclient6.conf with the rapid commit option:

send dhcp6.rapid-commit;

• Remove the old DHCPv6 lease database on the client

[clientA]% rm /var/lib/dhclient/dhclient6.leases

• Request a DHCPv6 lease with rapid commit

[clientA]%  dhclient -6 -d -cf /etc/dhcp/dhclient6.conf
Internet Systems Consortium DHCP Client 4.3.6
Copyright 2004-2017 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on Socket/client1-eth0
Sending on   Socket/client1-eth0
Created duid "\000\0049\376\214\213\036\333G\374\242\034#T\354\325]\326".
PRC: Soliciting for leases (INIT).
XMT: Forming Solicit, 0 ms elapsed.
XMT:  X-- IA_NA a0:df:17:1a
XMT:  | X-- Request renew in  +3600
XMT:  | X-- Request rebind in +5400
XMT: Solicit on client1-eth0, interval 1080ms.
RCV: Reply message on client1-eth0 from fe80::3c1d:4ff:fe2e:950a.
RCV:  X-- IA_NA a0:df:17:1a
RCV:  | X-- starts 1544389491
RCV:  | X-- t1 - renew  +1000
RCV:  | X-- t2 - rebind +2000
RCV:  | X-- [Options]
RCV:  | | X-- IAADDR fd00:100::2
RCV:  | | | X-- Preferred lifetime 3000.
RCV:  | | | X-- Max lifetime 4000.
RCV:  X-- Server ID: 00:01:00:01:23:a0:2f:4b:76:de:2c:55:01:44
PRC: Bound to lease 00:01:00:01:23:a0:2f:4b:76:de:2c:55:01:44.
PRC: Renewal event scheduled in 999 seconds, to run for 1000 seconds.
PRC: Depreference scheduled in 2999 seconds.
PRC: Expiration scheduled in 3999 seconds.

• Add a prefix delegation subnet to the configuration file /etc/kea/kea-dhcp6.conf

[...]
        "subnet6": [
            {
                "subnet": "fd00:100::/32",
		"id": 1000,
                "pools": [
                    {
                        "pool": "fd00:100::1-fd00:100::ffff"
                    }
                ],
                "pd-pools": [
                    {
                        "prefix": "fd00:100:10::",
                        "prefix-len": 48,
                        "delegated-len": 56,
                        "excluded-prefix": "fd00:100:10::",
                        "excluded-prefix-len": 64
                    }
                ]
            },
[...]

• Request an IPv6 network with a prefix delegation (-P) request

[clientA]% dhclient -d -6 -P client1-eth0
Internet Systems Consortium DHCP Client 4.3.6
Copyright 2004-2017 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Listening on Socket/client1-eth0
Sending on   Socket/client1-eth0
PRC: Soliciting for leases (INIT).
XMT: Forming Solicit, 0 ms elapsed.
XMT:  X-- IA_PD a0:df:17:1a
XMT:  | X-- Request renew in  +3600
XMT:  | X-- Request rebind in +5400
XMT: Solicit on client1-eth0, interval 1030ms.
RCV: Advertise message on client1-eth0 from fe80::3c1d:4ff:fe2e:950a.
RCV:  X-- IA_PD a0:df:17:1a
RCV:  | X-- starts 1544388880
RCV:  | X-- t1 - renew  +1000
RCV:  | X-- t2 - rebind +2000
RCV:  | X-- [Options]
RCV:  | | X-- IAPREFIX fd00:100:10::/56
RCV:  | | | X-- Preferred lifetime 3000.
RCV:  | | | X-- Max lifetime 4000.
RCV:  X-- Server ID: 00:01:00:01:23:a0:2f:4b:76:de:2c:55:01:44
RCV:  Advertisement recorded.P
RC: Selecting best advertised lease.
PRC: Considering best lease.
PRC:  X-- Initial candidate 00:01:00:01:23:a0:2f:4b:76:de:2c:55:01:44 (s: 10103, p: 0).
XMT: Forming Request, 0 ms elapsed.
XMT:  X-- IA_PD a0:df:17:1a
XMT:  | X-- Requested renew  +3600
XMT:  | X-- Requested rebind +5400
XMT:  | | X-- IAPREFIX fd00:100:10::/56
XMT:  | | | X-- Preferred lifetime +7200
XMT:  | | | X-- Max lifetime +7500
XMT:  V IA_PD appended.
XMT: Request on client1-eth0, interval 1090ms.
RCV: Reply message on client1-eth0 from fe80::3c1d:4ff:fe2e:950a.
RCV:  X-- IA_PD a0:df:17:1a
RCV:  | X-- starts 1544388881
RCV:  | X-- t1 - renew  +1000
RCV:  | X-- t2 - rebind +2000
RCV:  | X-- [Options]
RCV:  | | X-- IAPREFIX fd00:100:10::/56
RCV:  | | | X-- Preferred lifetime 3000.
RCV:  | | | X-- Max lifetime 4000.
RCV:  X-- Server ID: 00:01:00:01:23:a0:2f:4b:76:de:2c:55:01:44
PRC: Bound to lease 00:01:00:01:23:a0:2f:4b:76:de:2c:55:01:44.
Prefix BOUND6 old= new=fd00:100:10::/56
PRC: Renewal event scheduled in 998 seconds, to run for 1000 seconds.
PRC: Depreference scheduled in 1690 seconds.
PRC: Expiration scheduled in 2690 seconds.