ISC➞Kea migration

[chemlud]

Hello again,

currently I'm underway moving my static leases from ISC to KEA (**sigh**, so much lifetime lost on absolutely unproductive work...) and found this here:

https://forum.opnsense.org/index.php?topic=48854.0

I have static ARP enabled on many interfaces, so that only reserved MAC-IPs can talk to the sense. What will happen with these static ARP configurations when I disable ISC and enable KEA in the future? Will the "static ARP" on the interface persist?

Guess this still is a show-stopper for KEA, as it doesn't have this feature, or?

PS: Also found and read this here:

https://forum.opnsense.org/index.php?topic=49029.0

But the "discussion" ended nowhere in this thread, too.

Any help highly appreciated!

[Monviech (Cedrik)]

staticarp
https://github.com/opnsense/core/pull/11026
Its not a feature of KEA, its just an interface flag.


Dont know why you loose lifetime. Reservations are export from isc and import to kea via csv, both available in the gui.

[chemlud]

Have to spent time selecting an option, DNSmasq, or Kea, then ....

Would be interesting to know, if this new feature in the pull request is in the current version and if yes: Where to find it? Individual interface?

[Monviech (Cedrik)]

Since the pull request is open its not yet in any version, not even in development.

This will take some more time.

[chemlud]

Ok, thanks. So what is correct way to avoid loosing access to interfaces while moving from ISC to KEA, when static ARP was enabled in ISC?

If I read the above thread correct it is not sufficient to disable static ARP in ISC to "reset" the interface ot non-static ARP.

[Monviech (Cedrik)]

I think there were some fixes that remove the staticarp flag after a reboot if ISC plugin is not installed. But better plan having administrative access anyway. I wouldnt do this remotely to be honest.

[chemlud]

So basically we have here a critical parameter which can be set from the GUI, but not be reversed?

What ist the fall-back, if I can't reach the opnsense anymore after switiching to Kea?

What commands do I have enter in the console to make static ARP go away on the infterface level?

[Monviech (Cedrik)]

I mean it can be reversed by deconfiguring it from ISC...

But some forgot about it.

From the shell just use ifconfig igc1 -staticarp if I remember right. If not check the ifconfig man page.

Also I personally think staticarp on a firewall is pretty useless, L2 features should be handled by a switch or AP. A router is not a switch...?

[chemlud]

I and apparently some others used it as a feature to limit access in some subnets. So: Not useless. Nothing is perfect. But it worked.

And there is at least one other BSD-based firewall solution offering "static ARP" option in the GUI for KEA Dhcp. Just saying.


The first thread I linked stated that disabling static ARP in ISC was NOT enough to remove the flag on interface level.

Is there an option in the GUI to see the equivalent of ifconfig <iface> to check the flags? Or only in the console? :-)

[Monviech (Cedrik)]

Interfaces -> Overview should show the flags. The detail command (magnifying glass).

Also the linked thread is old, its already fixed, deinstall ISC or disable it and after a reboot the flag is gone:
https://github.com/opnsense/core/commit/05abe1367b