Subject: [Ipsec] is there any idea on ipsec HA?

From: Wade <[email-masked]>
Date: Sat, 31 Dec 2005 00:33:07 +0800

hello,

     The Ipsec high availability is one of requirement of people. Usually we
use two security gateways, one acting as a master and another acting as a
standby SG.
     I got a question on the packet sequence number,  should the master SG
send every packet to standby SG? The sequence number is used by anti-reply,
if we don't bakeup it, when the master SG is halt for some reason the remote
peer won't accept the packet which received from the backup SG because the
packet SN won't pass the anti-reply checking mechanism. But to backup every
packet is impossible, it's take too much throughput..

     If we don't want to disable the anti-replay,  is there any advice to
solve this problem?

Thanks

Huide
_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec