How do you make DHCP highly available?
Show the answer
Say this first
Two servers that can each answer for every scope, and every relay pointing at both. The choices are split scopes (each server owns part of the range, often 80/20), or a failover pair that shares lease state: Windows Server DHCP failover in load-balance or hot-standby mode, or ISC Kea with its HA hook. Whichever I choose, every SVI gets a helper address for each server.
Go deeper
Split scope
Both servers hold the same subnet with non-overlapping ranges. No sync, simple to run. Each part must cover demand on its own if the other server is down, and reservations must exist on both.
Failover with shared state
- Windows Server (2012 and later): two partners replicate leases. Load-balance mode shares the pool (50/50 by default). Hot-standby keeps a reserve on the standby (5 percent by default). The maximum client lead time (MCLT, 1 hour by default) bounds how far one partner can extend a lease beyond what the other knows.
- ISC Kea: the high availability hook supports load-balancing, hot-standby and passive-backup modes, with the partners sending lease updates to each other.
- ISC dhcpd: has a failover protocol between two peers, but ISC has ended maintenance of dhcpd and points users to Kea.
Branches
A branch that depends on central DHCP over the WAN loses new leases when the WAN fails. Existing
clients keep their addresses until expiry. A long lease or a small local IOS DHCP server covers that.
The IOS server has no failover of its own, so give it ip dhcp database so a reload keeps bindings.
They will ask next
The WAN to the data centre DHCP servers is down for six hours. Who breaks?
New devices, and every client whose lease expires during those six hours. Everyone else keeps working. With 1-day leases a fair share of clients will expire in that window; with 8-day leases almost nobody does.
Is adding a second ip helper-address enough?
Only if the second server actually has the scopes and either shares state or holds its own split of the range. A helper pointing at a server with no matching scope just gets ignored.
Traps
- Overlapping split-scope ranges. Two servers can then lease the same address to two clients.
- Forgetting reservations on the second server. Printers and phones with reservations get a random address during a failover.