DHC Load Balancing Algorithm for DHCPv6

This document is intended to extend the algorithm described in DHC Load Balancing Algorithm to apply to DHCPv6 traffic. Most of the terminology and procedures are identical to the ones specified in RFC 3074. As a short summary: servers which are participating in load balancing calculate hash values for the Service Transaction ID (STID) based on client-specific values (the client DUID for DHCPv6, the Client ID or CHADDR field for DHCPv4) for each incoming UDP packet. This hash is then used to select a hash bucket. Servers are assigned to service particular buckets. Load balancing is not the same as failover, as load balancing is not attempting to address any redundancy concerns. Load balancing does not attempt to address the issues of configuration or data synchronization between DHCPv6 servers. However, load balancing may be desirable in a failover set of servers in order to reduce the load on the servers in normal operations (see Section 5.3 of ), and certain desirable behaviors can occur if load balancing is aware that data synchronization is occurring.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.

The requirements for DHCPv6 are substantially the same as for DHCPv4, replacing DHCPDISCOVER with SOLICIT, DHCPREQUEST with REQUEST, CONFIRM, RENEW, or REBIND (as appropriate), etc.

A DHCPv6 server performing this load balancing will operate in substantially the same manner as if it were a DHCPv4 server load balancing an incoming DHCPv4/BOOTP packet with the following differences. Load balancing only applies to incoming UDP DHCPv6 messages that servers would normally process: SOLICIT, REQUEST, CONFIRM, RENEW, REBIND, RELEASE, DECLINE, INFORMATION-REQUEST, and RECONFIGURE-REQUEST. RELAY-FORWARDs are processed based on the content of the most encapsulated packet (ie: the above listed message types). Future message types will have to be considered as they are proposed as to how they may be load balanced. LEASEQUERY messages with a query based on IP SHOULD NOT have load balancing applied to them. The Client DUID that is supplied in a LEASEQUERY message identifies the requestor, and not an actual client device. This could result in the server which answered the client device deciding that it should not answer the requestor. LEASEQUERY messages with a query based on Client ID SHOULD have load balancing applied to them, using the Client DUID contained in the OPTION_LQ_QUERY option for the STID. DHCPV4-QUERY messages SHOULD NOT be load balanced, but should be subject to DHCPv4 load balncing, if the server supports it. ADVERTISE, REPLY, RELAY-REPL, LEASEQUERY-REPLY, LEASEQUERY-DONE, LEASEQUERY-DATA, and RECONFIGURE-REPLY are messages which should not be received by a DHCPv6 server and thus are not considered in this document.

Messages which contain a Server Identifier to direct that message to a specific server SHOULD be processed as if load balancing were not in play, with the exception of RENEWs.

A DHCPv6 server receiving a RENEW with the server's Server Identifier specified MAY choose to ignore the request if the load balancing algorithm decides that this server should not process this message. Let us assume the following sequence of events: There is a pair of DHCPv6 servers that are known to be exchanging lease information with each other The first server fails and is no longer servicing DHCPv6 clients Some number of DHCPv6 clients are bound to the second DHCPv6 server (whether by performing a SOLCIT-ADVERTISE-REQUEST-REPLY sequence, or by REBINDing to the second server) The first server is restored to service and is able to service DHCPv6 clients At this point, a disproportionate set of DHCPv6 clients are now bound to the second DHCPv6 server. If the second DHCPv6 server is permitted to ignore the RENEW even though the Server Identifier would indicate that it should respond, then the clients which should be answered by the first server will get no response to the RENEW that contains the second server's Server Identifier and will perform the normal retry mechanisms. At some point the client will transition into the REBIND state and will attempt to REBIND. That REBIND will not have a Server Identifier and will be received by both DHCPv6 servers. Since the servers were exchanging lease information, the first DHCPv6 server would have sufficient information to be able to REPLY to the client to extend the lease and those clients would now be bound to the first DHCPv6 server again. Over time this would result in the DHCPv6 population being rebalanced.

A DHCPv6 server receiving a RENEW with the server's Server Identifier specified SHOULD be processed as if load balancing were not in play. If the server ignored these RENEWs, the requesting device would eventually transition to REBIND, and the other servers may not have any lease information to answer the REBIND with, forcing the client to eventually drop its lease and start again from SOLICIT.

DHCPv6 servers MUST use the client's DUID in its entirety as the STID. This is different than RFC 3074 which limited the STID to 16 bytes. An INFORMATION-REQUEST may have no client DUID in the message. Calculate the hash as if a 0-length DUID were supplied, effectively assigning those messages to hash bucket 0. A LEASEQUERY based on Client ID MUST use the Client ID contained in the OPTION_LQ_QUERY option.

A DHCPv6 server providing the capability of Delayed Service SHOULD use the value in the OPTION_ELAPSED_TIME wherever RFC 3074 makes reference to the secs field.

Thanks to Bernie Volz, Steve Gonczi, Ted Lemon, and Rob Stevens as this document heavily borrows from their previous work on RFC 3074, as well as Bernie and Tomek Mrugalski's additional comments during the discussions.

This memo includes no request to IANA.

This proposal in and by itself provides no security, nor does it impact existing security. Servers using this algorithm are responsible for ensuring that if the contents of the HBA are transmitted over the network as part of the process of configuring any server, that message be secured against tampering, since tampering with the HBA could result in denial of service for some or all clients.