KEA DHCP server setup for VLAN or networks that are not in use by pfSense (using transit gateway with L3 switch)

tcavaleiro

Hello all,

I have an Aruba L3 switch which I want to maintain for doing L3 traffic and just leave pfSense for all the other services (VPN, DNS, pfBlockerNG, etc..).
However on my mind I wanted to use pfsense for DHCP to avoid other servers being instanced and also to keep track of the DHCP leases on the pfSense admin console.

In this setup I am using a transit gateway between L3 switch and pfSense; however, since I wanted to use DHCP for the VLANs, that means I had to have two different routes for the VLAN (for the DHCP server and another on trunk).

This created an asymmetric routing issue whilst traversing the VPN site-to-site.
Later I discovered this was due to that second route for a given VLAN exposed on pfsense directly, which made the transit not working (asymmetric routing - return path was going different way than the original request path)

Given that pfSense doesn't allow KEA to have DHCP enabled on interfaces that don't exist (VLANs included) I have experimented with a few things and managed to have one VLAN working.
This workaround consists of disabling the DHCP server for this interface (and later disable the VLAN interface) and using the KEA Custom JSON Configuration. By other words: removing the direct VLAN route and serving DHCP to the switch via transit IP.

Wanted to share my finding in case someone is using this odd scenario like I am. I suspect once I disable all VLANs this might not work anymore - so at least one interface should still have DHCP enabled (can be the LAN for e.g.)

Wanted to get your feedback on this workaround and whether this makes sense to be supported in the future (or not).

Custom JSON:

{
  "interfaces-config": {
    "interfaces": [ "igc1" ]
  },
  "subnet4": [
    {
      "id": 105,
      "subnet": "10.20.28.0/22",
      "relay": {
        "ip-addresses": [ "10.20.254.2" ]
      },
      "option-data": [
        {
          "name": "domain-name-servers",
          "data": "10.20.254.1"
        },
        {
          "name": "routers",
          "data": "10.20.30.1"
        }
      ],
      "pools": [
        {
          "pool": "10.20.28.100 - 10.20.28.200"
        }
      ],
      "reservations-in-subnet": true
    }
  ]
}

Thanks.