From ISC DHCP to KEA DHCP#

Rinse Kloek (Kloek Internetdiensten)

• Why: ISC DHCP went EOL in 2022 — this is a forced migration every remaining ISC shop must make, told with a real 4-year production track record and, crucially, a sharp automation postmortem. IPAM/address-management is a core PM interest and this is one of the best-credentialled migration stories around.
• What: Why migrate (EOL, no modern API, reboots needed for changes, no Option-82 lease binding for modem swaps) and what KEA gives you: database-backed leases/hosts/subnets (CSV/PostgreSQL/MySQL), a hooks/plugin mechanism (Flex-ID, RADIUS, legal logging), a REST API with 200+ commands, HA with heartbeat and outage detection, multi-threading, and the Stork dashboard. The Delta Fiber production context: 5 DHCP clusters across ~260 routing areas (~30 servers), IPv4 pools split CGNAT/public/fixed, provisioned via Nautobot + a DHCP manager + Ansible. A notable anti-fragility move: lease times raised from 30 minutes to 24 hours (renew at 12h) — the platform now survives a 12-hour DHCP outage for existing clients and carries lower steady-state load.
• How: Migration executed crawl/walk/run/fly — start with the easiest service (VoIP/IPTV) in pre-production, hardest last (Internet IPv4 with its 3 pool types), migrating existing leases for customer friendliness. Monitoring via Grafana (pool usage, DHCP packet anomalies, migration status) and Elasticsearch for deep dives. The postmortem is the highlight: a Friday Nautobot permission change made provisioning receive an empty dataset, and at 2:00 AM Saturday it deleted all subnets; monitoring caught it at 4:00, fixed by 10:00. The 12-hour renew timers halved the blast radius. Lessons: separate DB backend + small config is very manageable, KEA stable over 4 years, "modern DHCP is the whole ecosystem, not just the software," and — implicit — automation that consumes a SOT must validate for empty inputs.
• Where applicable: ISP/access-network specifics (Option 82, modem swaps, CGNAT pools) are Delta-Fiber-shaped, but the migration methodology, the lease-time resilience argument, and the empty-dataset automation failure are universally transferable. The Flex-ID hook (any DHCP option as client identifier) is the key feature enabling modem swaps that ISC couldn't do.