Subject: Re: [dhcwg] I-D Action: draft-ietf-dhc-dhcpv6-failover-requirements-00.txt

From: VithalPrasad Gaitonde <[email-masked]>
Date: Fri, 4 Nov 2011 13:59:45 +0530

Hi Tomasz, Kim,

Below are my comments on the DHCPv6 failover. Some of the comments may be
more pertinent to the design.

1.       Configuration synchronization had been left out of the purview of
the DHCP6 failover requirements document on the same lines as the DHCPv4
failover document. While the desire to keep the document simple is
understandable, configuration synchronization is a critical element of a
functional failover so that an administrator can manage the failover
subnet(s) as one logical unit instead of having to make identical changes
on 2 different servers.

        It will be good to call this out as a requirement in the document.

2.       There is a scenario where the DHCP server may be configured to
serve clients on one network adapter and communicate with partner server
(server-2-server traffic) on a different network adapter. In this scenario,
if the server loses connectivity on the network adapter used to communicate
with the clients because of network adapter (hardware) failure, there is no
intimation of the loss of service to the partner in the DHCPv4 failover
protocol. Since the servers are able to communicate with each other, the
partner remains ignorant of the loss of service to clients. This scenario
needs to be addressed to ensure high availability in case of network
adapter failure.

3.       In the partner down scenario, when both servers operate in partner
down, there is a chance of duplicate addresses on the network. This leads
to a potential conflict (unresponsive) state when they re-establish
contact. The duplicate address issue can be postponed to a large extent by
the servers giving new leases from your own pool before giving new leases
from partner’s pool.

4.       In case of hot standby (Active-Passive) model, while majority of
addresses are owned by the primary server, secondary server will need a
portion of addresses to serve new clients while operating in
communication-interrupted state as also in partner down state before it can
take over the entire address pool (expiry of MCLT). The concept of a
percentage of IP address pool reserved for the secondary for handing out
new leases during failover needs to be captured in the information model of
the protocol.

5.       Unlike many other IETF documents,  the DHCPv4 failover document
did not clearly callout the information model in the document. IMHO, the
DHCPv6 document should call out the information model which should be
designed to cater to both the high availability as well as failover
monitoring aspects.

Thanks,
Prasad

On Mon, Oct 24, 2011 at 10:20 PM, <[email-masked]> wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Dynamic Host Configuration
> Working Group of the IETF.
>
>        Title           : DHCPv6 Failover Requirements
>        Author(s)       : Tomasz Mrugalski
>                          Kim Kinnear
>        Filename        : draft-ietf-dhc-dhcpv6-failover-requirements-00.txt
>        Pages           : 19
>        Date            : 2011-10-18
>
>   The DHCPv6 protocol, defined in [RFC3315] allows for multiple servers
>   to operate on a single network, however it does not define any way to
>   decide which server responds to which client queries.  Some sites are
>   interested in running multiple servers in such a way as to provide
>   increased availability in case of server failure.  In order for this
>   to work reliably, the cooperating primary and secondary servers must
>   maintain a consistent database of the lease information.  [RFC3315]
>   allows for but does not define any redundancy or failover mechanisms.
>   This document outlines requirements for DHCPv6 failover, enumerates
>   related problems, and discusses the proposed scope of work to be
>   conducted.  This document does not define a DHCPv6 failover protocol.
>
>
> A URL for this Internet-Draft is:
>
> http://www.ietf.org/internet-drafts/draft-ietf-dhc-dhcpv6-failover-requirements-00.txt
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> This Internet-Draft can be retrieved at:
>
> ftp://ftp.ietf.org/internet-drafts/draft-ietf-dhc-dhcpv6-failover-requirements-00.txt
> _______________________________________________
> dhcwg mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dhcwg
>

---

From: Ted Lemon <[email-masked]>
Date: Fri, 4 Nov 2011 12:47:06 +0000

On Nov 4, 2011, at 1:29 AM, "VithalPrasad Gaitonde" <[email-masked]> wrote:
> Configuration synchronization had been left out of the purview of the DHCP6 failover requirements document on the same lines as the DHCPv4 failover document. While the desire to keep the document simple is understandable, configuration synchronization is a critical element of a functional failover so that an administrator can manage the failover subnet(s) as one logical unit instead of having to make identical changes on 2 different servers.

This is an open-ended problem, since different servers have very different config data models.  We declared this out of scope for DHCPv4, and I think that was the right decision.   I think it still is the right decision for DHCPv6.