Does static mapping work in kea DHCP?

johnpoz

Not going to disagree that that wording could of been better..

Been a lot of threads where users fail to even read the release notes, and just click to switch because of the warning..

Like this one - nobody that read the release notes about all the stuff missing would think hey lets switch to kea now, unless they were running the most basic of setups with - hey hand out some IPs..

But on the other hand, most all the threads here are because someone fail to read the documentation in the first place ;)

SteveITS

@phormix
First off I agree the wording could have been way different. It came up here within days I think, and the answer was, essentially, ‘the note is correct, it will be removed, it doesn’t say anyone needs to use Kea.’ It’s led to unnecessary alarm, and confusion/frustration.

Redhat6 is deprecated. Windows XP is deprecated. SSLv3 is deprecated.

I’m going to nitpick a bit but I see it a lot. Those aren’t deprecated those are discontinued and unsupported. I think the word has shifted in meaning over the years in common speech from “will be removed” to “past EOL” to “has been removed,” and they are using the former, original meaning. I tried to look it up to be specific and the definition seems to vary quite a bit around/between those.

If it was replaced they would replace it.

johnpoz

@SteveITS exactly.. Deprecated does not mean - hey stop using this, it no longer works, or there is a serious exploit ;)

gauthig

Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.

As stated above, deprecated does not mean it is not available and is still stable. But deprecated software is a highly visible target for bad actors to start to find new vulnerabilities. Then heavily exploit it as deprecated means no more patching. There used to be a time that depricated meant no more licensing and minimal maintenance, it worked, you just left it alone. Not anymore, every security camp either ring fences software off the patch cycle or pushes to remove it all from the network.

johnpoz

@gauthig said in Does static mapping work in kea DHCP?:

highly visible target for bad actors to start to find new vulnerabilities.

Not going to disagree with you - but in what scenario would you dhcp server be exposed to "bad actors" in the first place?

Are there any known exploits that are of concern, ISC stated that if something does come up - its quite possible they would patch, etc. Its just really they are no longer going to be developing this product.. So its prob time to move on..

isc dhcp is a very stable and mature product..

Gertjan

@gauthig said in Does static mapping work in kea DHCP?:

Does anyone know if KEA DHCP integration to DNS Resolver will be fixed in 24.03 ? I would really want to migrate off of ISC.

Yes, of course.
We're all in the "Here is 23.09.1 (or 2.7.2), and we proudly present KEA" phase.
A minimum GUI parameter set is present, and as much as possible pfSense users out there can test drive KEA now.
If there are none or very view issues with the bare bone functionality : handing out IPv4 and IPv6 leases, then Netgate can continue with adding more 'KEA' options.

All they need to do, is picking the right choices from here ( ) and implementing them into the GUI.

And adding/resolving the long overdue "Register DHCP leases / host names into the local DNS" issue.

maverickws

Definitely
Apart from the DNS resolution issue, everything else been running just fine with KEA.

johnpoz

@maverickws said in Does static mapping work in kea DHCP?:

everything else been running just fine with KEA.

Yeah it hands out IPs ;) And to be honest, I bet you there are lots and lots of users that have moved over and not noticed anything different.. Their devices get Ips, they renew the lease, etc..

There are many scenarios where it would work just fine I am sure.. Which is why they prob released it "early" if you will.. And put up the notice, hey move over to kea, isc is going away. Because most likely for your typical user - won't even notice it switched over..

To be honest, other than I am not a fan of the current logging, this could use some polish for sure - I could prob switch over to it.. Not much work to just setup host overrides for your devices vs using dhcp reservation registration..

I do hand out some options - but could live without those most likely.

But what you almost exclusively see on forums about product X, is something not working.. You don't see floods of hey works great!!

So yeah, whenever anything changes in product be it good/bad or just "change" you get more posts - quite often from people that just didn't read the docs on what is new or what changed or what is being removed, etc..

I wouldn't expect a flood of posts, hey I moved over to kea - it works just like isc did - why the mention of "preview" ;)

Maybe I missed some posts, but most of the ones I have seen = didn't read the blog post, nor the release notes or just didn't catch or understand what "preview" means ;) Or took hey isc is going away at some future time to mean they "had" to move now or all hell would break loose and the sky would fall ;) And they wouldn't never get a chance to move later and their whole network would come crashing down..

Others just didn't like the warning ;) and didn't notice they could turn it off.. And only way to make the warning go away was switch..

maverickws

@johnpoz well I am definitely missing the name resolution part, I have approximately 1 hundred devices including the smart home stuff, I really don't feel like having to register as host overrides is something that doesn't make any sense to me.
Not only here in my homelab but for example professionally we do have pfSense as well, after creating a fixed lease for a machine being provisioned we do rely heavily on the firewalls name resolving capacity, and wouldn't be feasible to have to register hosts manually for DNS.

But anyway as you very well stressed this is a preview, I got KEA running at home, when these issues are overcome we will also adopt on the other instances.

wgstarks

It worked fine for me for several months since I don’t use name resolution typically. Were I did run into problems was when I replaced an existing device and changed the MAC address used to reserve that IP. KEA wouldn’t handout the proper IP until the old reservations had expired for both devices. This made it complicated to access webui’s to do configurations of devices. Rebooting the Netgate appliance would correct this and maybe there are other workarounds as well but I never really saw any benefit to me running KEA so decided to wait until it’s a little more mature. This really just applies to my use case though. I’m sure many people don’t even use MAC reservations.

johnpoz

@wgstarks said in Does static mapping work in kea DHCP?:

I’m sure many people don’t even use MAC reservations.

That might be a good poll.. The only things that don't have reservations on my network - are guest devices, like friends phone on my guest wifi. And devices when I first bring them online.. As soon as its ready to actually join the network full time, it gets a reservation and IP set, etc..

Just powered up my new nvr with cameras for outside.. To just make sure it worked and cameras worked, etc. I just plugged it into port on switch in the av cab.. It came up on my roku vlan.. Made sure it all worked - then setup a reservation for it on my new cam vlan.. Changed the config on the port on that switch, and rebooted it. Now its up on correct vlan, with IP I assigned it, etc..

I would bet many users of pfsense, use at least some reservations.. Can we create "polls" here on the forum, I don't think have ever seen one.. I would be curious to see.. Might throw up something in general off topic section.. even have to just count posts..

SteveITS

@johnpoz said in Does static mapping work in kea DHCP?:

Can we create "polls" here on the forum

You should probably talk to a Global Moderator about that. ;)

johnpoz

@SteveITS ahahahah - oh that is funny ;) hahaha

Here we go, https://forum.netgate.com/topic/186312/do-you-use-dhcp-reservations

Mod is different than Admin btw.. I can delete posts, that sort of thing.. But any sort of backend anything to do with the forums would have to be an Admin... You had me rolling on that comment.. Still giggling.. Good one!

Gertjan

@johnpoz said in Does static mapping work in kea DHCP?:

Can we create "polls" here on the forum

I'll start right away : don't.

@johnpoz said in Does static mapping work in kea DHCP?:

I would bet many users of pfsense, use at least some reservations..

Others, recently, just refuse to do so. For whatever their reasons are.
( they will be forced to the light as soon as IPv6 becomes main stream )

cybis

I'm running CE 2.7.2 and the static DHCP mapping does not work for me with KEA.

So here's the static mapping for my alpine host.

And here's the DHCP leases where the same host got a second (dynamic) IP assigned.

As I've never observed such a behaviour in the past, I switched back to the ISC DHCP.

SteveITS

@CyBiS https://docs.netgate.com/pfsense/en/latest/releases/2-7-1.html#kea-dhcp-server-feature-preview-now-available

“Currently the Kea implementation lacks the following DHCP server features:

Local DNS Resolver/Forwarder Registration for static and dynamic DHCP clients”

cybis

@SteveITS Thanks for the link, but I'm not sure how that is related to the static DHCP mapping (MAC address to IP address). I'm not looking for DNS resolution of the host (alpine host name to IP address) but its actual IP/DHCP lease which is supposed to be static, i.e. the host must not get any other IP than the one specified in the static DHCP mapping.

SteveITS

@CyBiS ah, sorry I misunderstood. I think there was a thread about that either here or on Reddit. IIRC it was a theory about how it had the lease already so was granted the renewal instead of sending the new/static IP? I didn’t notice it but mine had the same IPs for the brief time I used Kea.

cybis

@SteveITS No problem I had KEA active for a couple of weeks now but today I noticed the first time that the policy-based routing for that particular host wasn't working as expected due to the wrong IP. Not sure though what exactly triggers this incorrect DHCP lease.