RFC 6853
DHCPv6 Redundancy Deployment Considerations
DHCPv6 Redundancy Deployment Considerations 🎀
- RFC: 6853
- BCP: 180
- Category: Best Current Practice
- ISSN: 2070-1721
- Date: February 2013
- Stream: Internet Engineering Task Force (IETF)
- Authors: J. Brzozowski (Comcast Cable Communications), J. Tremblay (Videotron G.P.), J. Chen (Time Warner Cable), T. Mrugalski (ISC)
- Obsoletes / Updates: the title block doesn't list either one 🙈
Abstract 💅
Okay so this doc is for anyone who wants to use DHCPv6 to support their IPv6 rollout 🌸. The main focus is semi-redundant DHCPv6 services, aka keeping your DHCP game strong even when one server is having a moment 😭.
Status of This Memo 🫶
This memo documents an Internet Best Current Practice.
This document is a product of the Internet Engineering Task Force (IETF). It represents the consensus of the IETF community. It has received public review and has been approved for publication by the Internet Engineering Steering Group (IESG). More info on BCPs is in Section 2 of RFC 5741 ✨.
Info about the current status of this doc, any errata, and how to give feedback is at http://www.rfc-editor.org/info/rfc6853 🦋.
Copyright Notice ⭐
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this doc 📜. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 💜.
Table of Contents 📑
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Scope and Assumptions . . . . . . . . . . . . . . . . . . . . 2
2.1. Applicability to Prefix Delegation . . . . . . . . . . . . 3
3. Service Provider Deployment . . . . . . . . . . . . . . . . . 3
4. Enterprise Deployment . . . . . . . . . . . . . . . . . . . . 4
5. Protocol Requirements . . . . . . . . . . . . . . . . . . . . 5
5.1. DHCPv6 Servers . . . . . . . . . . . . . . . . . . . . . . 5
5.2. DHCPv6 Relays . . . . . . . . . . . . . . . . . . . . . . 5
5.3. DHCPv6 Clients . . . . . . . . . . . . . . . . . . . . . . 5
6. Deployment Models . . . . . . . . . . . . . . . . . . . . . . 6
6.1. Split Prefixes . . . . . . . . . . . . . . . . . . . . . . 6
6.2. Multiple Unique Prefixes . . . . . . . . . . . . . . . . . 8
6.3. Identical Prefixes . . . . . . . . . . . . . . . . . . . . 10
7. Challenges and Issues . . . . . . . . . . . . . . . . . . . . 12
8. Security Considerations . . . . . . . . . . . . . . . . . . . 14
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 14
10. References . . . . . . . . . . . . . . . . . . . . . . . . . . 15
10.1. Normative References . . . . . . . . . . . . . . . . . . . 15
10.2. Informative References . . . . . . . . . . . . . . . . . . 151. Introduction 🦋
Redundancy and high availability for lots of IPv6 infrastructure are desirable and, in some deployments, mandatory 👑. Unfortunately, for DHCPv6 there's currently no standards-based failover or redundancy protocol 💀. So the interim fix is semi-redundant services, and this doc specifies an architecture for getting there 🧚.
2. Scope and Assumptions 🌈
DHCPv6 redundancy may be useful in a wide range of scenarios. The architecture suggested here can be used in a wide range of networks, but only two deployment environments are discussed: service provider and enterprise network. All other scenarios can be generalized to one of these two cases 💖.
In the rest of the doc, these assumptions are made about the existing DHCPv6 infrastructure, no matter which environment you're looking at:
- At least two DHCPv6 servers provide a service to the same clients. (The architecture does not limit the number of servers, and more may be provided if required.)
- The existing DHCPv6 servers will not directly communicate or interact with one another in the assignment of IPv6 addresses and the provision of configuration information to requesting clients.
- DHCPv6 clients are instructed to run stateful DHCPv6 to request at least one IPv6 address. Configuration information and other options (such as a delegated IPv6 prefix) may also be requested as part of the stateful DHCPv6 operation.
- Clients participating in DHCPv6 configuration have to properly handle the preference option, including the processing of ADVERTISE messages as required by [RFC3315].
- A DHCPv6 server failure does not imply a failure of any other network service or protocol (e.g., TFTP servers). The redundancy of any additional services configured by means of DHCPv6 is outside the scope of this document. (For example, a single DHCPv6 server may configure multiple TFTP servers, with preference for each TFTP server, as specified in [RFC5970].)
While the techniques described here give some aspects of redundancy, complete redundancy won't be available until a DHCPv6 failover protocol is standardized 🥺. The requirements for that protocol are described in [FAILREQ].
2.1. Applicability to Prefix Delegation 🎀
The same approaches discussed in this doc can potentially be applied to prefix delegation (PD) [RFC3633]. One obvious drawback of using a split prefix model for PD is that resource use is doubled 🙃. Heads up: that applicability is still theoretical and wasn't investigated thoroughly while this doc was being worked on. So the applicability of the presented mechanisms to prefix delegation is outside the scope of this document.
3. Service Provider Deployment 💼
The service provider model covers cases where the network and end-user devices may be administered by separate entities.
DHCPv6 clients include cable modems, customer gateways or home routers, and end-user devices. These are collectively referred to as Customer Premises Equipment (CPE) 🏠. In some cases hosts may be configured directly using the service provider DHCPv6 infrastructure. In others, configuration may come via an intermediate router that's being configured by the provider's DHCPv6 infrastructure. Either way, the service provider DHCPv6 infrastructure may be semi-redundant 🔥.
In this environment, these additional assumptions (on top of Section 2) were made:
- The service provider edge routers and access routers are IPv6 enabled when required. These routers are, for example, CMTS (Cable Modem Termination System) for cable or DSLAM/BRAS (Digital Subscriber Link Access Multiplexer / Broadband Remote Access Server) for DSL.
- CPE devices are instructed to perform stateful DHCPv6 to request at least one IPv6 address, delegated prefix, and/or configuration information. CPE devices may also be instructed to use stateless DHCPv6 [RFC3736] to acquire configuration information only, a situation that assumes the IPv6 address and prefix information has been acquired using other means.
- The primary application of this architecture is for native IPv6 services. (Use and applicability to transition mechanisms are out of scope for this document.)
- The CPE devices must implement a stateful DHCPv6 client [RFC3315]. Support for DHCPv6 prefix delegation [RFC3633] or stateless DHCPv6 [RFC3736] may also be implemented.
4. Enterprise Deployment 🏢
The enterprise deployment environment covers cases where end-user devices directly consume the configuration provided by the DHCP servers, with no intermediate devices. (That's different from the home routers used in the service provider environment.) Enterprise IPv6 environments quite often use or require DHCPv6 relay agents, but the relays don't influence or process the configuration in any way. They just act as a transport mechanism 🚚.
In this model, these additional assumptions (on top of Section 2) were made:
- DHCPv6 clients are hosts and are considered end nodes. In other words, they consume provided configuration and don't use it to provision other devices. Examples include desktop computers, laptops, printers, other typical office equipment, and some mobile devices 💻.
- The DHCPv6 clients generally don't require the assignment of an IPv6 prefix delegation, so they typically don't support DHCPv6 prefix delegation [RFC3633].
5. Protocol Requirements 📋
Implementing the architecture for semi-redundant DHCPv6 services using existing protocols requires the component DHCPv6 clients, relays, and servers to have certain capabilities. The sections below describe the requirements for those devices ✨.
5.1. DHCPv6 Servers 🖥️
This interim architecture requires DHCPv6 servers that are [RFC3315] compliant and support the necessary options. Support for stateful DHCPv6 and the DHCPv6 preference option [RFC3315] is essential to the architecture 👑. For deployment scenarios where IPv6 prefix delegation is needed, DHCPv6 servers must support DHCPv6 prefix delegation as defined by [RFC3633]. Furthermore, the DHCPv6 servers must support [RFC3736] if stateless DHCPv6 is used.
5.2. DHCPv6 Relays 🔁
DHCPv6 relay agents must be [RFC3315] compliant, and they must support the ability to relay DHCPv6 messages to more than one destination.
5.3. DHCPv6 Clients 🧸
DHCPv6 clients are required to be compliant with [RFC3315] and to support the necessary options for the solution. What exactly they need depends on the mode of operation and the desired behavior:
- If prefix delegation is required, DHCPv6 clients must support DHCPv6 prefix delegation as defined in [RFC3633].
- Clients must support the acquisition of at least one IPv6 address and configuration information using stateful DHCPv6 as specified by [RFC3315].
- Stateless DHCPv6 [RFC3736] may also be supported.
- DHCPv6 clients must recognize and adhere to the processing of the advertised DHCPv6 preference option sent by the DHCPv6 servers.
6. Deployment Models ✨
okay so bestie, at the time of writing there is no standards-based DHCPv6 redundancy protocol yet 😭. so the interim solution here is to take existing DHCPv6 server implementations as-is and get them to provide best effort, semi-redundant DHCPv6 services 🫶. how well that works depends a lot on how each server is configured. a bunch of DHCPv6 mechanisms from [RFC3315] get used to yield the behavior we want, but there is zero inter-server or inter-process communication to coordinate DHCPv6 events or activities. no cap, it's giving duct tape and vibes 🎀
the good news: this solution does not impact DHCPv4 at all 🦋. so DHCP for IPv4 and IPv6 can run at the same time on the same physical server(s), or they can live on different ones. your call, queen 👑
this section defines three semi-redundant models 🌈. the examples in the following sections use /64 prefixes, but other prefix lengths work too ✨
6.1. Split Prefixes
in the split prefixes model 💅, each DHCPv6 server gets its own unique, non-overlapping pool carved out of the /64 prefix deployed in the IPv6 network. for example, if you have an allocated 2001:db8:1:1::/64 and you want to share it between two servers, you split it into two /65 pools: 2001:db8:1:1:0000::/65 and 2001:db8:1:1:8000::/65 🍓
both DHCPv6 servers are active and operational at the same time 🔥. each one allocates IPv6 addresses from its own pool, per device class. the allocation is mostly steered by the DHCPv6 preference option, so the server with the higher preference value is always the one preferred 👑. you can also use proprietary mechanisms to push harder on favoring one DHCP server over the other. figure 1 shows an example of this setup 🧚
it's important to know that over time, bindings might end up unevenly spread across the DHCPv6 servers, and no single server is authoritative for all of them 🙈
here's the tea on [RFC3315]: a DHCPv6 ADVERTISE message with a preference option of 255 tells the client to immediately start a client-initiated message exchange by sending a REQUEST message to the server that sent the ADVERTISE 🦋. on the other hand, an ADVERTISE with no preference option (or one with a value less than 255) tells the client it has to wait for more ADVERTISE messages before picking which server to respond to, as described in Section 17.1.2 of [RFC3315] 💖
if a DHCPv6 server fails, it's desirable (but not essential) for a different server, not the one that originally responded, to be able to rebind the client's lease 🥺. the catch is that with this architecture, the remaining active server has a different address pool configured. so rebinding the client in its current state would be technically incorrect 💀. in the end, the rebind fails and the client grabs a brand new binding from the pool on the active server. it's giving "start over, but make it cute" 🌸
now, to cut down on the chance that a client or some other element on the network hits a service disruption or loses access to relevant binding data 😭, you can use shorter values for T1, T2, valid, and preferred lifetimes. you can adjust or configure the last three to minimize disruption 🍓. setting them equal (or nearly equal) can trigger a DHCPv6 client to reacquire its IPv6 address, prefix, and/or configuration information almost right after the rebinding fails ✨. the one thing to remember: shorter values put extra load on the DHCPv6 servers 💜
with a split prefix setup, dynamic updates to DNS [RFC2136] can be coordinated so DNS gets properly updated with current binding info 🫶. it gets messy with the PTR resource record for IPv6 addresses, since DNS info may need to be overwritten during a failure condition 😩. splitting prefixes lets you tell bindings and binding timing apart, which helps figure out which one reflects the current state 🔥. this really matters when DHCPv6 Leasequery [RFC5007] and/or DHCPv6 Bulk Leasequery [RFC5460] are used to determine lease or binding state 👑
last but not least 🎀, a perk of this scheme is that separate pools per DHCPv6 server make failure conditions more obvious and detectable 🦋
figure 1 is the split prefixes approach, and this is the exact diagram 👇
+----------+ +-----------+
| Client 1 +-\ +--+ Server 1 |
+----------+ \ | +-----------+
\ |
\ |
\ |
+----------+ \ | +-----------+
| Client 2 +--------------+--| Server 2 |
+----------+ / | +-----------+
. / .
. / .
. / .
+----------+ / . +-----------+
| Client N +-/ .--| n+1 Server|
+----------+ +-----------+
Server 1
========
Prefix = 2001:db8:1:1::/64
Pool = 2001:db8:1:1:0000::/65
Preference = 255
Server 2
========
Prefix = 2001:db8:1:1::/64
Pool = 2001:db8:1:1:8000::/65
Preference = 0
Server n+1
==========
Prefix, pool, and preference would
vary based on prefix definition
Figure 1: Split prefixes approach6.2. Multiple Unique Prefixes
in the multiple prefix model 🌸, each DHCPv6 server gets its own unique, non-overlapping prefix. a /64 pool equal to that prefix is configured on each server. for example, the 2001:db8:1:1::/64 pool goes to one DHCPv6 server to allocate to clients, and it matches its parent prefix 2001:db8:1:1::/64. the second server could use 2001:db8:1:5::/64 as both its pool and its prefix ✨. you repeat this for every active DHCP server 💅. figure 2 shows an example 🧚
the big difference between split prefixes and multiple unique prefixes is that the latter does not need the prefixes to be adjacent 🦋. honestly, split prefixes can be seen as a special case of multiple unique prefixes 🫶
this approach uses a unique prefix, and basically a single pool, per DHCPv6 server, with the matching prefixes configured for use in the network 🍓. the network infrastructure facing the DHCPv6 clients has to be configured to use multiple prefixes on those interfaces 💜. the config is similar on all the servers, but each one gets a different prefix and a different preference 🎀
heads up, this approach drastically increases the rate at which IPv6 prefixes get used up 😱. it also brings operational and management headaches on the underlying network, because a lot more prefixes need to be configured and routed 💀. and it doesn't give you a clean migration path to the desired solution, a standards-based DHCPv6 redundancy or failover protocol, which of course hasn't been specified yet 🥺
multiple unique prefixes gives you DNS dynamic update benefits that are similar to the ones in Section 6.1 💖. being able to tell bindings and binding timing apart, to figure out which one is current, also works here 🔥. that becomes especially important when DHCPv6 Leasequery [RFC5007] and/or DHCPv6 Bulk Leasequery [RFC5460] are used to determine lease or binding state 👑. and using separate prefixes and pools per DHCPv6 server makes failure conditions more obvious and detectable ✨
+----------+ +-----------+
| Client 1 +-\ +--+ Server 1 |
+----------+ \ | +-----------+
\ |
\ |
\ |
+----------+ \ | +-----------+
| Client 2 +--------------+--| Server 2 |
+----------+ / | +-----------+
. / .
. / .
. / .
+----------+ / . +-----------+
| Client N +-/ .--| n+1 Server|
+----------+ +-----------+
Server 1
========
Prefix = 2001:db8:1:1::/64
Pool = 2001:db8:1:1::/64
Preference = 255
Server 2
========
Prefix = 2001:db8:1:5::/64
Pool = 2001:db8:1:5::/64
Preference = 0
Server 3
========
Prefix = 2001:db8:1:f::/64
Pool = 2001:db8:1:f::/64
Preference = [1..254]
Figure 2: Multiple unique prefix approach6.3. Identical Prefixes ✨
okay so the identical prefix model is giving "everyone gets the same outfit" 👗💖 every DHCPv6 server gets configured with the same overlapping prefix and pool. So if you have two or more servers, the same /64 prefix and pool has to be set up on all of them. For example, the 2001:db8:1:1::/64 pool gets assigned to every DHCPv6 server, and they all hand out addresses to clients derived from 2001:db8:1:1::/64. You repeat that for each active DHCP server. Figure 3 shows what this looks like 🦋
+----------+ +-----------+
| Client 1 +-\ +--+ Server 1 |
+----------+ \ | +-----------+
\ |
\ |
\ |
+----------+ \ | +-----------+
| Client 2 +--------------+--| Server 2 |
+----------+ / | +-----------+
. / .
. / .
. / .
+----------+ / . +-----------+
| Client N +-/ .--| n+1 Server|
+----------+ +-----------+
Server 1
========
Prefix = 2001:db8:1:1::/64
Pool = 2001:db8:1:1::/64
Preference = 255
Server 2
========
Prefix = 2001:db8:1:1::/64
Pool = 2001:db8:1:1::/64
Preference = 0
Server 3
========
Prefix = 2001:db8:1:1::/64
Pool = 2001:db8:1:1::/64
Preference = [1..254]
Figure 3: Identical prefix approachEvery server uses the same prefix, prefix length and pool definition. The only thing that changes between them is the DHCPv6 preference 🎀 This approach could make it easier to move DHCPv6 services over to a standards-based redundancy or failover protocol once one is available 🌈 Just like the split prefix architecture we talked about earlier, this one doesn't put any extra addressing requirements on the network infrastructure ✨
Now the not-so-glam part 🙈 The identical prefix model doesn't help with dynamic DNS updates, DHCPv6 Leasequery [RFC5007] or DHCPv6 Bulk Leasequery [RFC5460]. Since every DHCP server has the exact same prefix and pool setup, it's way less obvious when something has gone wrong 😭
7. Challenges and Issues 💅
okay so DHCPv6 servers don't talk to each other, and that causes a bunch of drama when they're running the same services in production 💀 These are the big worries:
- In the identical prefixes scenario, both servers have to follow the same address allocation procedure. That means they both need the same algorithm and the same policy for deciding which address goes to which client. Otherwise there's a real chance that two different clients get handed the same address 😱 Both servers are expected to receive every incoming REQUEST message. Usually you don't have to do anything special for that, since clients send REQUEST messages to a multicast address. Relays are expected to forward incoming client messages to all servers. The client picks its server by putting its DHCP Unique Identifier (DUID) in the Server-ID option. The chosen server assigns the address and the other configuration options, and the other server throws away the incoming request. If one server fails, the other one assigns the same address by following the same algorithm and the same policy 🔥
- Dynamic update trouble with DNS servers happens when one or more DHCPv6 servers are unavailable, and the same address is involved. This gets especially tricky when nodes that were originally granted a lease:
- Try to renew or rebind the lease they originally got, or
- Try to get a brand new lease
The DHCID resource record [RFC4701] lets you figure out who currently owns a specific piece of DNS data that's the target of an update [RFC2136]. [RFC4704] explains how DHCPv6 servers and/or clients can do updates. [RFC4703] offers a way to sort out conflicts between clients. Even though [RFC4703] handles most cases, it's still possible to end up with abandoned resource records 🫠 Here's a scenario: there are two independent servers, A and B. Server A gives a lease to a client and updates DNS with an AAAA record for the assigned address. When the client renews, server A isn't available, so server B assigns a different lease. DNS gets updated again, and now there are two AAAA resource records for the client. There's no way to tell which of the two leases is active 🤷♀️ If server A never recovers, its information might stick around forever. (Note that this is kinda similar to what happens when a single server crashes and leaves abandoned resource records behind.)
- Interactions with DHCPv6 servers to get IPv6 lease data through the DHCPv6 Leasequery [RFC5007] or DHCPv6 Bulk Leasequery [RFC5460] protocols can go wrong when one or more DHCPv6 servers have granted leases to clients and then become unavailable. If you need the lease data and the server that granted the lease is down, you can't get any information about those leases until one of these happens:
- The granting DHCPv6 server comes back with all of its lease information restored.
- The client has renewed or rebound its lease against a different DHCPv6 server.
It's important to know that no exchange of available leases and no synchronization between DHCPv6 servers is possible until a redundancy or failover protocol is standardized or proprietary solutions become available 🚨
8. Security Considerations 🔐
This interim architecture brings in security considerations on top of what's already covered in Section 23 of [RFC3315] 😳 In particular, dynamic DNS updates using the models in this document can leave abandoned DNS records behind, even when the conflict resolution mechanism defined in [RFC4703] is in use. That said, this is no worse than the case where a single deployed server crashes and its lease database can't be recovered 💜
When you're using the identical prefixes model, care must be taken to make sure that all servers use the same lease allocation procedure and are configured with the same policy 🙏 If that guidance isn't followed, there's a risk that the same lease gets assigned to two separate clients. In some cases, that situation can be recovered by using Duplicate Address Detection (Neighbor Discovery) and the DECLINE mechanism (DHCPv6) 🛟
9. Acknowledgements 🫶
The authors would like to thank Bernie Volz, Kim Kinnear, Ralph Droms, David Hankins, Chuck Anderson, Ted Lemon, Stephen Farrel, Pete McCann, Robert Sparks, Martin Stiemerling, Brian Haberman, and Barry Leiba for their input and review 🌸
Special thanks to Stephen Morris for his numerous spelling and grammar corrections, and for proofreading ✨
This work has been partially supported by Department of Computer Communications (a division of Gdansk University of Technology) and the National Centre for Research and Development (Poland) under the European Regional Development Fund, Grant No. POIG.01.01.02-00-045/09-00 (Future Internet Engineering Project) 🇵🇱
10. References 📚
10.1. Normative References
- [RFC2136] Vixie, P., Thomson, S., Rekhter, Y., and J. Bound, "Dynamic Updates in the Domain Name System (DNS UPDATE)", RFC 2136, April 1997.
- [RFC3315] Droms, R., Bound, J., Volz, B., Lemon, T., Perkins, C., and M. Carney, "Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", RFC 3315, July 2003.
- [RFC3633] Troan, O. and R. Droms, "IPv6 Prefix Options for Dynamic Host Configuration Protocol (DHCP) version 6", RFC 3633, December 2003.
- [RFC3736] Droms, R., "Stateless Dynamic Host Configuration Protocol (DHCP) Service for IPv6", RFC 3736, April 2004.
- [RFC4701] Stapp, M., Lemon, T., and A. Gustafsson, "A DNS Resource Record (RR) for Encoding Dynamic Host Configuration Protocol (DHCP) Information (DHCID RR)", RFC 4701, October 2006.
- [RFC4703] Stapp, M. and B. Volz, "Resolution of Fully Qualified Domain Name (FQDN) Conflicts among Dynamic Host Configuration Protocol (DHCP) Clients", RFC 4703, October 2006.
- [RFC4704] Volz, B., "The Dynamic Host Configuration Protocol for IPv6 (DHCPv6) Client Fully Qualified Domain Name (FQDN) Option", RFC 4704, October 2006.
- [RFC5007] Brzozowski, J., Kinnear, K., Volz, B., and S. Zeng, "DHCPv6 Leasequery", RFC 5007, September 2007.
- [RFC5460] Stapp, M., "DHCPv6 Bulk Leasequery", RFC 5460, February 2009.
- [RFC5970] Huth, T., Freimann, J., Zimmer, V., and D. Thaler, "DHCPv6 Options for Network Boot", RFC 5970, September 2010.
10.2. Informative References
- [FAILREQ] Mrugalski, T. and K. Kinnear, "DHCPv6 Failover Requirements", Work in Progress, September 2012.
Authors' Addresses 🦋
John Jason Brzozowski
Comcast Cable Communications
1306 Goshen Parkway
West Chester, PA 19380
USA
Phone: +1-609-377-6594
EMail: john_brzozowski@cable.comcast.comJean-Francois Tremblay
Videotron G.P.
612 Saint-Jacques
Montreal, Quebec H3C 4M8
Canada
EMail: jf@jftremblay.comJack Chen
Time Warner Cable
13820 Sunrise Valley Drive
Herndon, VA 20171
USA
EMail: jack.chen@twcable.comTomasz Mrugalski
Internet Systems Consortium, Inc.
950 Charter St.
Redwood City, CA 94063
USA
Phone: +1 650 423 1345
EMail: tomasz.mrugalski@gmail.com📦 where this page comes from
- ietf: rfc6853 2013-02
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms