An IPsec seamless switching mechanism with high availability and scalability by extending IKEv2 protocol
Yu Liang, Shijie Jia, Changgiao Xu, Jianfeng Guan, Deyun Gao · 2011
IPsec as a very popular security protocol solves the increasing problems of network security. The IPsec-gateway cluster as a solution of large-scale IPsec implement improves the availability of IPsec-gateway. The traditional IPsec-gateway cluster needs to use a large number of hardware resources to keep availability of IPsec-gateway. However, the low utilization rate of resources restricts the scalability of IPsec-gateway cluster. In this paper, we propose a new IPsec-gateway cluster mechanism by improving and extending IKEv2 protocol. Meanwhile, we design a standby IPsec-gateway Selection Algorithm (GWSA), a distributed and switch SA policy (DSAP), ESP packets synchronous and retransmission policy. This mechanism can deploy IPsec-gateways in different network segments and prevent ESP packets loss when IPsec-gateway performs switching. Through simulation, we show that the above mechanism can improve the availability and scalability of IPsec-gateway cluster.