DockerでKea DHCPを構築。CiscoとArubaに同時にOption43が渡せるようになった。

firewall-cmd --add-service=dhcp --zone=public --permanent
firewall-cmd --reload

mkdir -p /opt/docker/dhcp
cd /opt/docker/dhcp

FROM centos:centos7
ENV TZ='Asia/Tokyo'
RUN ln -sf /usr/share/zoneinfo/Asia/Tokyo /etc/localtime ; \
    yum -y update ; yum -y install epel-release rsyslog ; \
    curl -1sLf \
      'https://dl.cloudsmith.io/public/isc/kea-1-6/cfg/setup/bash.rpm.sh' \
    | bash ; \
    yum -y update ; yum -y install isc-kea ; systemctl enable kea-dhcp4
COPY rsyslog.conf /etc/rsyslog.conf
COPY kea-dhcp4.conf /etc/kea/
CMD [ "/usr/sbin/init" ]

{
"Dhcp4": {

  # リース時間などの調整
  "renew-timer": 9000,
  "rebind-timer": 18000,
  "valid-lifetime": 36000,

  # IFの設定。ホストのIF表記に合わせる必要があります。
  "interfaces-config": {
      "interfaces": [ "ens192" ]
  },

  # デフォルトのまま
  "control-socket": {
    "socket-type": "unix",
    "socket-name": "/tmp/kea-dhcp4-ctrl.sock"
  },

  # ファイル名や形式がいろいろあるみたいですが、デフォルトのままでもOK。
  "lease-database": {
      "type": "memfile",
      "persist": true,
      "name": "/var/lib/kea/dhcp4.leases"
  },

  # アクセスポイントのOption43のための定義セクションです。
  # CiscoとArubaでコントローラが２種類なら、このままでOK
  "option-def": [
    {
      "name":  "Cisco_vWLC",
      "code":  241,
      "space": "vendor-encapsulated-options-space",
      "type":  "ipv4-address",
      "array": true
    },
    {
      "name":  "Aruba_MC",
      "code":  43,
      "type":  "ipv4-address"
    }
  ],

  # DHCPでとりに行く際の VCI(vendor-class-identifier) を参照して、コントローラを振り分けています。
  # もし、「古いAPは古いWLCに接続」などあれば、適宜 "test": "substring～～" の箇所を工夫してください。
  # CiscoのVCIは以下が参考になります。
  # https://www.cisco.com/c/ja_jp/support/docs/wireless-mobility/wireless-lan-wlan/97066-dhcp-option-43-00.html#anc5 
  "client-classes": [

    # Cisco APで始まるものは、10.254.10.201/202 に接続させにいきます。
    {
      "name": "CiscoAP",
      "test": "substring(option[60].hex,0,8) == 'Cisco AP'",
      "option-data": [
        {
          "name":       "Cisco_vWLC",
          "code":       241,
          "space":      "vendor-encapsulated-options-space",
          "csv-format": true,
          "data":       "10.254.10.201,10.254.10.202"
        },
        {
          "name": "vendor-encapsulated-options"
        }

      ]
    },

    # ArubaAPで始まるものは、10.254.10.201/202 に接続させにいきます。
    # ArubaAPのVCIは ArubaAP で共通のようです。以下参照
    # https://www.arubanetworks.com/techdocs/ArubaOS_80_Web_Help/Content/ArubaFrameStyles/DHCP_Option_43/Windows_Based_DHCP_Serve.htm
    {
      "name": "ArubaAP",
      "test": "substring(option[60].hex,0,7) == 'ArubaAP'",
      "option-data": [
        {
          "name":  "Aruba_MC",
          "code":  43,
          "data":  "10.254.10.206"
        },
        {
          "name":  "vendor-class-identifier",
          "data":  "ArubaAP"
        }
      ]
    }

  ],

  # DNS関連の設定
  "option-data": [
    {
      "name": "domain-name-servers",
      "data": "10.254.10.241"
    },
    {
      "name": "domain-name",
      "data": "prosper2.net"
    },
    {
      "name": "domain-search",
      "data": "prosper2.net"
    }
  ],

  # ここからサブネットの情報を記載していきます。
  "subnet4": [
    {
      "subnet": "10.1.20.0/24",
      "pools": [ { "pool": "10.1.20.33 - 10.1.20.62" } ],
      "option-data": [
        {
          "name": "routers",
          "data": "10.1.20.1"
        }
      ]
    },
    {
      "subnet": "10.1.22.0/24",
      "pools": [ { "pool": "10.1.22.33 - 10.1.22.230" } ],
      "option-data": [
        {
          "name": "routers",
          "data": "10.1.22.1"
        }
      ]
    }
  ],

  # ログはまだよく見ていませんが、とりあえずデフォルトでOKです。
  "loggers": [
    {
    "name": "kea-dhcp4",
    "output_options": [
      {
        "output": "/var/log/kea-dhcp4.log"
      }
    ],
    "severity": "INFO",
    "debuglevel": 0
    }
  ]
}

}

module(load="imfile")
input(type="imfile"
      file="/var/log/kea-dhcp4.log"
      tag="pseudolog_kea_dhcp4_log"
      facility="local0"
      severity="notice")
:syslogtag, isequal, "pseudolog_kea_dhcp4_log" @syslog:514

# docker build --force-rm -t infraserv:dhcp . -f ./dhcp.df ; \
  docker run --cap-add sys_admin --security-opt seccomp:unconfined  -v /sys/fs/cgroup:/sys/fs/cgroup:ro \
   --network host -it -d --name dhcp --hostname dhcp infraserv:dhcp

!interfaceへhelperアドレスを追加
Vlan2020
  ip helper-address 10.254.10.251
Vlan2022
  ip helper-address 10.254.10.251
end

（ ～ 省略 ～ ）
*Feb  9 03:13:55.035: Using SHA-2 signed certificate for image signing validation.
*Feb  9 03:13:55.327: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 10.1.20.34, mask 255.255.255.0, hostname AP5897.bd0b.bedc
（ ～ 省略 ～ ）
Translating "CISCO-CAPWAP-CONTROLLER.prosper2.net"...domain server (10.254.10.241)
*Feb  9 03:14:29.659: %CAPWAP-5-DHCP_OPTION_43: Controller address 10.254.10.201 obtained through DHCP
*Feb  9 03:14:29.659: %CAPWAP-5-DHCP_OPTION_43: Controller address 10.254.10.202 obtained through DHCP
*Feb  9 03:14:39.707: AP has SHA2 MIC certificate - Using SHA2 MIC certificate for DTLS.
*Feb  9 07:38:46.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.254.10.201 peer_port: 5246
*Feb  9 07:38:46.263: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 10.254.10.201 peer_port: 5246
*Feb  9 07:38:46.263: %CAPWAP-5-SENDJOIN: sending Join Request to 10.254.10.201
*Feb  9 07:38:51.263: %CAPWAP-5-SENDJOIN: sending Join Request to 10.254.10.201
*Feb  9 07:38:52.035: %CAPWAP-5-JOINEDCONTROLLER: AP has joined controller VMwlc01
（ ～ 省略 ～ ）