KEA DHCP static mapping addition not being honoured
-
Hi,
I use DHCP static maps for all my IOT devices. I recently had a Kasa switch die on me and have replaced it. I assigned the new MAC address to the existing DHCP static map.I have repeatedly tried to assign the device to the same static IP as the old switch. No matter what I do KEA DHCP refuses to assign the switch to its static address!
I'm on pfsense 2.8.1. I have tried the following - but device continues to use DHCP from dynamic pool instead of assigned static map:
-Converted dynamic entry to static.
-Disconnected client, deleted all mentions of MAC address then created new static map entry.When I look under STATUS->DHCP LEASES, I always see two entries. One for static map and another for a dynamic pool entry. how can a DHCP server have two entries for the SAME MAC address?
Adding/removing/changing static maps with ISC DHCP server worked flawlessly for 4+ yrs before I switched to KEA!
-
Here's a screenshot:
-
I did the entire 'onboarding' process again. I reset the device to factory settings (so it's not pulling any DHCP from my network).
- Deleted ARP entries (why does pfsense not allow deletion of DHCP leases while ARP is in place?!!)
- Deleted all DHCP entries for device's MAC address (both static and dynamic). Didn't think this was permitted - two entries with same MAC address in same subnet?
- Shortened lease time on IOT interface to five minutes for now - to help with testing.
- Added a new static entry as follows:
IP Address. MAC address. Hostname 192.168.25.107 cc:ba:bd:45:59:bb 1-ss-driveway Kasa Smart Switch - Driveway Lights n/a n/a- Onboarded the Kasa switch, and assigned to my IOT network. It immediately got assigned a different address in the same subnet!
192.168.25.50 cc:ba:bd:45:59:bb 1-ss-driveway 2026/07/20 22:51:03 2026/07/20 22:56:03I also started a packet capture on the IOT interface, just prior to onboarding the device. DORA shows that device is being offered 192.168.25.50. Why is this being done - instead of the static entry that was in place prior to ever seeing the MAC address on pfsense firewall!
Here's the entire DORA process from device onboarding:
[2.8.1-RELEASE][admin@<removed>]/root: tcpdump -vv -n -i vmx1.15 port 67 or port 68 tcpdump: listening on vmx1.15, link-type EN10MB (Ethernet), snapshot length 262144 bytes 22:39:51.082067 IP (tos 0x0, ttl 255, id 82, offset 0, flags [none], proto UDP (17), length 336) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, Request from cc:ba:bd:45:59:bb, length 308, xid 0x7fd7edab, Flags [none] (0x0000) Client-Ethernet-Address cc:ba:bd:45:59:bb Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: Discover MSZ (57), length 2: 1500 Parameter-Request (55), length 4: Subnet-Mask (1), Default-Gateway (3), BR (28), Domain-Name-Server (6) 22:39:51.083207 IP (tos 0x10, ttl 128, id 0, offset 0, flags [DF], proto UDP (17), length 328) 192.168.25.251.67 > 192.168.25.50.68: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid 0x7fd7edab, Flags [none] (0x0000) Your-IP 192.168.25.50 Client-Ethernet-Address cc:ba:bd:45:59:bb Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: Offer Subnet-Mask (1), length 4: 255.255.255.0 Default-Gateway (3), length 4: 192.168.25.254 Domain-Name-Server (6), length 4: 10.20.30.254 Hostname (12), length 13: "1-ss-driveway" Domain-Name (15), length 9: "iot.local" Lease-Time (51), length 4: 300 Server-ID (54), length 4: 192.168.25.251 22:39:51.083492 IP (tos 0x10, ttl 128, id 0, offset 0, flags [DF], proto UDP (17), length 328) 192.168.25.251.67 > 192.168.25.51.68: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid 0x7fd7edab, Flags [none] (0x0000) Your-IP 192.168.25.51 Client-Ethernet-Address cc:ba:bd:45:59:bb Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: Offer Subnet-Mask (1), length 4: 255.255.255.0 Default-Gateway (3), length 4: 192.168.25.254 Domain-Name-Server (6), length 4: 10.20.30.254 Hostname (12), length 13: "1-ss-driveway" Domain-Name (15), length 9: "iot.local" Lease-Time (51), length 4: 300 Server-ID (54), length 4: 192.168.25.251 22:39:51.096959 IP (tos 0x0, ttl 255, id 83, offset 0, flags [none], proto UDP (17), length 336) 0.0.0.0.68 > 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, Request from cc:ba:bd:45:59:bb, length 308, xid 0x7fd7edab, Flags [none] (0x0000) Client-Ethernet-Address cc:ba:bd:45:59:bb Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: Request MSZ (57), length 2: 1500 Requested-IP (50), length 4: 192.168.25.50 Server-ID (54), length 4: 192.168.25.251 Parameter-Request (55), length 4: Subnet-Mask (1), Default-Gateway (3), BR (28), Domain-Name-Server (6) Hostname (12), length 5: "HS200" 22:39:51.101163 IP (tos 0x10, ttl 128, id 0, offset 0, flags [DF], proto UDP (17), length 328) 192.168.25.251.67 > 192.168.25.50.68: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid 0x7fd7edab, Flags [none] (0x0000) Your-IP 192.168.25.50 Client-Ethernet-Address cc:ba:bd:45:59:bb Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: ACK Subnet-Mask (1), length 4: 255.255.255.0 Default-Gateway (3), length 4: 192.168.25.254 Domain-Name-Server (6), length 4: 10.20.30.254 Hostname (12), length 13: "1-ss-driveway" Domain-Name (15), length 9: "iot.local" Lease-Time (51), length 4: 300 Server-ID (54), length 4: 192.168.25.251 22:39:51.105417 IP (tos 0x10, ttl 128, id 0, offset 0, flags [DF], proto UDP (17), length 328) 192.168.25.251.67 > 192.168.25.50.68: [udp sum ok] BOOTP/DHCP, Reply, length 300, xid 0x7fd7edab, Flags [none] (0x0000) Your-IP 192.168.25.50 Client-Ethernet-Address cc:ba:bd:45:59:bb Vendor-rfc1048 Extensions Magic Cookie 0x63825363 DHCP-Message (53), length 1: ACK Subnet-Mask (1), length 4: 255.255.255.0 Default-Gateway (3), length 4: 192.168.25.254 Domain-Name-Server (6), length 4: 10.20.30.254 Hostname (12), length 13: "1-ss-driveway" Domain-Name (15), length 9: "iot.local" Lease-Time (51), length 4: 300 Server-ID (54), length 4: 192.168.25.251 ^C 6 packets captured 6867 packets received by filter 0 packets dropped by kernel -
RESOLVED
Looks like this files under the 'not all features from ISC are implemented in KEA yet' for pfsense!TL;DR - I found two bugs in redline that are related to similar issues (don't have the bug ID's on hand right now). There is still a DHCP lease in the backend of KEA DHCP software that does not show up in the GUI. Seems like there's not a complete integration between KEA backend and pfsense GUI yet.
I still saw the old MAC address/map in /var/lib/kea/dhcp4.leases file - even though I configured the new MAC address to the old device IP (as shown above). Tried manually deleting this file and restarting kea service - made no difference.
I had 7-day lease times for my IOT network. Sometime in the last day or two the device has moved over to the static mapping I configured on day 1! The old MAC address/map is also gone from /var/lib/kea/dhcp4.leases file now too!
Looks like this bug is scheduled to be fix in upcoming plus release and next CE release as well. I am on 2.8.1 and tried applying the patch - but it was not designed for 2.8.1 (others in the bug report mentioned the same). In the meantime the only option is to wait for the old lease to expire. So setting a shorter DHCP lease time would be more fitting in the meantime.
Looks like once the lease expired (or maybe half-life of lease - mind you that is more of a client thing - where it updates its lease at half life of lease.).
-
@nocternal said in KEA DHCP static mapping addition not being honoured:
Tried manually deleting this file and restarting kea service - made no difference.
You mean, in this exact order :
Stop kea.
Delete the files.
Start kea.Right ?
Privacy Policy · Cookie Policy