Configuring the Kea High Availability setup - User Guide - BlueCat Horizon

You can configure High Availability (HA) for Kea DHCP servers from within DDI orchestrator. However, you can also sync and configure your Kea DHCP servers in an HA environment to communicate with each other before you add them to DDI orchestrator. In this case, after setting up the HA environment, the configuration file is parsed and all HA relationships are detected when the primary server is added to DDI orchestrator. As a result, the relationships are successfully imported to DDI orchestrator, and replication between servers begins.

For servers using HTTPS, meaning that they require TLS certificates, you must manually edit the high-availability section of the configuration to specify the locations of these certificates. This cannot be done in the Web Application. When Kea client certificates are defined in the preferences.cfg file for the DHCP Agent, they will also be used for the peer-to-peer configuration for any failover relationships in which that server is a member.

Here's an example of a hook-libraries section of the configuration where DDI orchestrator will successfully detect the setup and act accordingly:

"hooks-libraries": [{
    "library": "/usr/lib/kea/hooks/libdhcp_ha.so",
    "parameters": {
        "high-availability": [{
            "this-server-name": "server1",
            "mode": "load-balancing",
            "heartbeat-delay": 1000,
            "max-response-delay": 10000,
            "max-ack-delay": 5000,
            "max-unacked-clients": 0,
            "peers": [{
                "name": "server1",
                "url": "http://192.168.56.33:8000/",
                "role": "primary",
                "auto-failover": true
            }, {
                "name": "server2",
                "url": "http://192.168.56.66:8000/",
                "role": "secondary",
                "auto-failover": true
            }, {
                "name": "server3",
                "url": "http://192.168.56.99:8000/",
                "role": "backup",
                "auto-failover": false
            }]
        }]
    }

Here's some additional information about the parameters:

this-server-name (Server Tag)

This field must reflect the Kea DHCP server where the configuration file resides.

Note: When the servers are added to DDI orchestrator, this-server-name must match the peer with "role: "primary" in the high-availability section of the config.

This setting is also available in DDI orchestrator by editing the Server tag field in the DHCP server configuration. For more information, refer to Editing DHCP server configuration.

max-response-delay

This value should be greater than heartbeat-delay, and is typically greater than the combined duration of multiple heartbeat-delay values. The default value is 60000 ms.

When the server detects that communication is interrupted, it may transition to the partner-down state (when max-unacked-clients is 0) or initiate the failure-detection procedure by changing the value of the max-unacked-clients parameter:

• Setting max-unacked-clients to 0 ensures vigilant Kea servers that promptly change states if the connection between them is lost.
• To allow some flexibility, change the max-unacked-clients value to a positive number, such as 5.

Warning: If max-response-delay is configured incorrectly, the servers will not be able to consistently and efficiently detect downtime between one another, and DDI orchestrator won’t be able to ensure the correct replication and operations of the servers.