Hi,
I have almost the same list of questions as Yoav’s list. But main question is - how are you going to ensure that load balancer delivers ESP packets to the same cluster node where IKE messages that create this ESP SA were delivered? In other words, load balancer must deliver ESP packets to the node that can decrypt them, i.e. to the node that has appropriate keys, i.e. to the node that created this ESP SA, i.e. to the node IKE SA messages that created that ESP SA were delivered, and this messages definitely had different UDP ports. If balancer doesn’t know anything about IKE/IPsec and looks only on UDP ports, then how the above requirement is met? On the other hand, if you spread ESP keys over all cluster nodes, then why do you bother to care that load balancer delivers all ESP SA packets to the same node? Regards, Valery. From: IPsec [mailto:[email protected]] On Behalf Of Yoav Nir Sent: Tuesday, November 01, 2016 10:31 AM To: Xuxiaohu Cc: [email protected] Subject: Re: [IPsec] New Version Notification for draft-xu-ipsecme-esp-in-udp-lb-00.txt Hi, Xiaohu A few comments. Actually, they’re more like questions. 1. How are IPsec SAs mapped to UDP pseudo-connections? Is it a 1:1 mapping between SPI and source port? 2. If now, how do you deal with the packet reordering that the load balancer will do? IPsec requires ordered or nearly-ordered delivery. 3. How is this negotiated? In IKE? Prior agreement? 4. Why do we need a new port? What goes wrong if the packets go to port 4500? Thanks Yoav On 1 Nov 2016, at 3:45, Xuxiaohu <[email protected]> wrote: Hi all, Any comments and suggestions are welcome. Best regards, Xiaohu -----邮件原件----- 发件人: [email protected] [mailto:[email protected]] 发送时间: 2016年10月31日 19:15 收件人: Xuxiaohu; zhangdacheng; Xialiang (Frank) 主题: New Version Notification for draft-xu-ipsecme-esp-in-udp-lb-00.txt A new version of I-D, draft-xu-ipsecme-esp-in-udp-lb-00.txt has been successfully submitted by Liang Xia and posted to the IETF repository. Name: draft-xu-ipsecme-esp-in-udp-lb Revision: 00 Title: Encapsulating IPsec ESP in UDP for Load-balancing Document date: 2016-10-31 Group: Individual Submission Pages: 7 URL: https://www.ietf.org/internet-drafts/draft-xu-ipsecme-esp-in-udp-lb-00.txt Status: https://datatracker.ietf.org/doc/draft-xu-ipsecme-esp-in-udp-lb/ Htmlized: https://tools.ietf.org/html/draft-xu-ipsecme-esp-in-udp-lb-00 Abstract: IPsec Virtual Private Network (VPN) is widely used by enterprises to interconnect their geographical dispersed branch office locations across IP Wide Area Network (WAN). To fully utilize the bandwidth available in IP WAN, load balancing of traffic between different IPsec VPN sites over Equal Cost Multi-Path (ECMP) and/or Link Aggregation Group (LAG) within IP WAN is attractive to those enterprises deploying IPsec VPN solutions. This document defines a method to encapsulate IPsec Encapsulating Security Payload (ESP) packets inside UDP packets for improving load-balancing of IPsec tunneled traffic. In addition, this encapsulation is also applicable to some special multi-tenant data center network environment where the overlay tunnels need to be secured. Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org. The IETF Secretariat _______________________________________________ IPsec mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipsec
_______________________________________________ IPsec mailing list [email protected] https://www.ietf.org/mailman/listinfo/ipsec
