Hi Andy,
this is an interesting problem and I challenged myself to find a solution which works fully automated and doesn't have to change the configs by EEM. I just want to present the idea here; for implementing it into a productive environment I'd recommend some optimization (and testing of course).
1. All 4 IP helper will be configured
2. Tracking the reachability of the Main-DHCP servers with IP SLA and EOT (Enhanced Object Tracking):
ip sla monitor 1
type dhcp dest-ipaddr 172.16.1.1 source-ipaddr 192.168.0.1
ip sla monitor schedule 1 life forever start-time now
!
ip sla monitor 2
type dhcp dest-ipaddr 172.16.2.2 source-ipaddr 192.168.0.1
ip sla monitor schedule 2 life forever start-time now
!
track 1 rtr 1
track 2 rtr 2
!
track 12 list boolean and
object 1 not
object 2 not
!
So the track object 12 comes up if DHCP-1 (172.16.1.1) and DHCP-2 (172.16.2.2) are out of service.
We now could use object 12 (with an inverse boolean logic in this case) for conditional (tracked) hostroutes for the DR DHCP servers pointing to interface Null0 but this would affect all types of traffic to the servers, not only DHCP traffic. So we need PBR (Policy Based Routing) as well.
3. PBR (Example for DHCP server 3 at DR site):
access-list 103 permit udp any host 172.16.3.3 eq bootps
!
route-map DHCP-DR permit 100
match ip address 103
set ip next-hop verify-availability 172.16.3.3 10 track 12
set interface Null0
4. Apply the route-map to the interfaces with the IP helpers and for locally sourced traffic (relay agent):
ip local policy route-map DHCP-DR
!
interface VLAN xxx
ip policy route-map DHCP-DR
So DHCP-traffic to server 3 is policy routed. If DHCP server 1 or 2 are in service, DHCP traffic to server 3 is send to interface Null0; in other words: It's discarded. If DHCP server 1 and 2 fail, DHCP traffic to server 3 is send to the normal next-hop IP address. This part was tricky because tracking is only possible for numeric next-hops of adjacent routers. But fortunately the "set ip next-hop" clause has a higher preference as "set interface" and that's why I could use the two set-statements.
IP: s=192.168.0.1 (local), d=172.16.3.3 (Null0), len 328, policy routed UDP src=67, dst=67
IP: local to Null0 172.16.3.3
%TRACKING-5-STATE: 1 rtr 1 state Up->Down
%TRACKING-5-STATE: 12 list boolean and Down->Up
IP: s=192.168.0.1 (local), d=172.16.3.3, len 330, policy match UDP src=67, dst=67
IP: s=192.168.0.1 (local), d=172.16.3.3 (Serial0/2), len 330, policy routed UDP src=67, dst=67
#show route-map
route-map DHCP-DR, permit, sequence 100
Match clauses:
ip address (access-lists): 103
Set clauses:
ip next-hop verify-availability 172.16.3.3 10 track 12 [up]
interface Null0
Policy routing matches: 15 packets, 4794 bytes
As you can see, it works as required (at least in a lab environment).
I have to admit that it's somewhat cumbersome, unfortunately the tracking-option in PBR is not as flexible as I tought when the idea came into my mind. I'm curious if somebody finds a better way.
Hope that helps
Rolf
