High Availability for IPsec VPN Platforms: ClusterIP Evaluation

Daniel Palomares (1) , Daniel Migault (1) , Wolfgang Velasquez (1) , Maryline Laurent (2, 3)

1 Orange Labs [Issy les Moulineaux]
2 SAMOVAR - Services répartis, Architectures, MOdélisation, Validation, Administration des Réseaux
3 CNRS - Centre National de la Recherche Scientifique

To manage the huge demand on traffic, the Internet Service Providers (ISP) are offloading its mobile data from Radio Access Networks (RAN) to Wireless Access Networks (WLAN). While these RANs are considered trusted networks, WLANs need to build a similar trusted zone in order to offer the same security level and Quality of Service (QoS) to End-Users (EU). Although IPsec is widely implemented to create trusted environments through untrusted networks, the industry is increasingly interested in providing IPsec-based services with High Availability (HA) features in order to ensure reliability, QoS and security. This paper concentrates on how to build a cluster of IPsec SGs based on ClusterIP. We describe the main issues to overcome HA within IPsec. Then, we measure how HA may affect the EU experience, and provide recommendations on how to deploy ClusterIP. Finally, our tests over an HTTP connection showed that ClusterIP allows fast recovering during a failure.

Mots clés: IPsec Clustering; ClusterIP; Security Gateway; Handover; Fast IPsec recovering

Domaines: Réseaux et télécommunications [cs.NI]

Daniel Palomares, Daniel Migault, Wolfgang Velasquez, Maryline Laurent. High Availability for IPsec VPN Platforms: ClusterIP Evaluation. 8th International Conference on Availability, Reliability and Security (ARES 2013), Sep 2013, Regensburg, Germany. pp.1. ⟨hal-00863418⟩