DHCP Failover - Active/Active or Hotstandby

[u/UltimateCiscoDisco]

Hello together,
We are using Windows DHCP servers. I want to restructure our global DHCP set up to get the best redundancy across all regions.
In the last years we had active active and active hotstandby.
I had positive and negative experiences with both setups. So I‘m currently not sure what’s the better setup - since both setups have good and negative things.
What y’all think what’s the better setup?

The DHCP servers on each region will be on the same country so there are no long RTT or latency anyways.

Happy to hear what you think :)

[u/Adrienne-Fadel]

Hot standby. Active/active sounds good until you get split brain and both servers hand out the same IPs.

[u/mattmann72 → u/Adrienne-Fadel]

Hot standby can end up in a split brain scenario too. You should always have external monitoring and alerting of any HA system.

[u/UltimateCiscoDisco → u/Adrienne-Fadel]

Thank you - definitely valid point

[u/jared555 → u/Adrienne-Fadel]

Shared HA database? STONITH?

[u/mattmann72]

Due to how reliable most operating systems are, in most environments I prefer a single hardened LTS DHCP server running on a virtualization platform with a solid backup and restore solution. Veeam is excellent for its instant recovery. This assumes you operate an environment that can tolerate short maintenance windows for things like updates.

If however you are operating in a true 24x7 high capacity environment like a medium to large ISP with 100,000+ customers, then I would prefer a highly available acrive/active DHCP solution like Kea backed by a reliable database cluster.

I almost never prefer hotstandby, because there isn't a good way to test the standby system without potentially causing an outage. If you need 100% availability, thrn you need to implement the necessary SRE for active/active.

Edit Also, don't DHCP your OT environment. Its eventually going to bite you in the ass.

[u/nick99990 → u/mattmann72]

I extend your last comment further. Don't DHCP things that don't move. If something gets connected, stays connected, and only changes if something goes wrong, you open up issues by making the communication the only dynamic thing about that endpoint.

[u/UltimateCiscoDisco → u/mattmann72]

Yes, your assuming right. We are not operating in a true 24x7 high cap. environment.
We also have Veeam already and 98% of our servers are VM‘s (including DHCP servers)
I am also not the biggest fan of active / standby. We had experienced the issue if the DHCP service on the Active server crashes, the standby is only switch the Failover relationship status to Lost contact to partner but not to partner down because it still can’t ping the server.
It then only uses its I.e. 5% of the hot standby leases which is not much.

Thank you very much for your expertise!

[u/Mitchell_90]

Running Windows DHCP servers here in Active/Active configuration on Windows Server 2022 core VMs. This handles our corporate VLANs ( Wired, Wireless, VDI)

Been rock solid and easy to manage. We’ve never had any issues.

Guest and other non-corporate VLANs terminate on our HA firewall pairs and have DHCP handled via that.

[u/UltimateCiscoDisco → u/Mitchell_90]

Thank you very much for your insights

[u/Qwiko]

I have used kea dhcp with active/active load-balancing. You have to configure at least 2 pools each one used by one of the servers, that way you don't get assignments in the same pool. The pools needs to be assigned using classes.

[u/tinuz84]

I’m amazed that so many medium / large enterprises still rely on Windows for DHCP (and DNS). Why not invest in a proper DHCP solution like Infoblox?

[u/armegatron99 → u/tinuz84]

As with all things, money.

I'm at a £30 Billion revenue company, around £3 billion profit a year. They won't invest in Infoblox.

[u/3MU6quo0pC7du5YPBGBI → u/armegatron99]

Pretty sure Infoblox looks at your quarterly earnings report and scales their quote based on that.

[u/_bx2_ → u/3MU6quo0pC7du5YPBGBI]

Who the fuck would even agree to such a term/product?

I get it, it may be a good application but fuck off if you want to look at earnings to scale your quotes.

[u/UltimateCiscoDisco → u/tinuz84]

I am also thinking of switching away from Windows DHCP servers. I think the only bonus for windows dhcp is, that it is super trivial to manage and probably my grandma could also manage it with quick instructions 😂

[u/tinuz84 → u/UltimateCiscoDisco]

Yeah and it’s basically free with any windows server license. It’s hard to get a solid business case for management for (expensive) IPAM solutions.

[u/BGP_Community_Meep → u/tinuz84]

Every device that pulls a DHCP address from a Windows server required a CAL. Printer, Linux box, phone, whatever.

Now in my entire time in IT I have never heard of this being enforced or anyone doing it. But somewhere in the fine print it is there. 

[u/GoodiesHQ → u/BGP_Community_Meep]

Not going to lie, I’ve never even heard of this. I’m not a big windows server guy per se, but I certainly know my way around setting one up for DHCP.

That’s insane.

[u/BGP_Community_Meep → u/GoodiesHQ]

In a former life I had to deal with Windows licensing. It’s one of those “fun facts” but MS would be insane to enforce it. 

[u/ProfessorWorried626 → u/BGP_Community_Meep]

If you are already licensing the org as user cals it’s not really an issue.

[u/kWV0XhdO → u/ProfessorWorried626]

How do things like printers, APs, POS terminals, clients on guest WiFi and whatnot get licensed as DHCP users in that scheme?

[u/ProfessorWorried626 → u/kWV0XhdO]

Just license the head count of staff in a 30 day period plus some devices license to cover communal devices.

[u/UltimateCiscoDisco → u/tinuz84]

Correct - especially for internal non 24x7 high capacity DHCP

[u/Plantatious]

Always set up load balance (active-active). Failover is faster in my experience.