Subject: Re: [IPsec] IPsec HA problem statement

From: Paul Hoffman <[email-masked]>
Date: Sun, 2 May 2010 19:12:42 -0700

At 5:27 PM +0300 4/26/10, Yaron Sheffer wrote:
>There has been very little follow-on discussion on this draft, just a
>few mails related to one proposed solution. So if you've read the draft
>and think it's complete and good to go into WGLC, let us all know. If
>some things are still missing, tell us which. Different vendors have
>different views, and Yoav's problem statement may not cover them all.

...and there was no response to Yaron's plea.

Have we lost steam? Is the draft really ready to go?

--Paul Hoffman, Director
--VPN Consortium

---

From: Yoav Nir <[email-masked]>
Date: Mon, 3 May 2010 13:22:34 +0300

Well, this draft is kind of a smorgasbord of issues, so once the issue that bothers you is in there, you're not that interested any more. 

I would like to post another draft with section 3.7 that I posted on the list on 25-Apr, and unless anyone has another issue that's not addressed, I think we should proceed.

It's important for such a draft to get input from as many vendors and open source implementers as possible. As far as vendors are concerned, we have heard from Check Point and Cisco, and also from Safenet and Acme Packet.

Based on marketing materials and wikis, I can see that at least Fortinet, Juniper, Sonicwall and strongSwan support clusters in their products (strongSwan's wiki even links to our draft), but no developer from any of those projects and products has spoken up yet. It's possible that all the issues they've encountered are the same as the ones that are already listed in the draft, but it would still be great if we had heard it from them. 

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Hoffman
Sent: Monday, May 03, 2010 5:13 AM
To: Yaron Sheffer; ipsec
Subject: Re: [IPsec] IPsec HA problem statement

--Paul Hoffman, Director
--VPN Consortium
_______________________________________________
IPsec mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ipsec

Scanned by Check Point Total Security Gateway.

---

From: Yoav Nir <[email-masked]>
Date: Mon, 3 May 2010 13:23:41 +0300

Based on marketing materials and wikis, I can see that at least Fortinet, Juniper, Sonicwall and strongSwan support clusters in their products (strongSwan's wiki(*) even links to our draft), but no developer from any of those projects and products has spoken up yet. It's possible that all the issues they've encountered are the same as the ones that are already listed in the draft, but it would still be great if we had heard it from them. 

Yoav
---------
(*)http://wiki.strongswan.org/wiki/1/HighAvailability

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Hoffman
Sent: Monday, May 03, 2010 5:13 AM
To: Yaron Sheffer; ipsec
Subject: Re: [IPsec] IPsec HA problem statement

--Paul Hoffman, Director
--VPN Consortium

---

From: Yoav Nir <[email-masked]>
Date: Mon, 3 May 2010 13:24:47 +0300

Sorry for the dual post. Some mail client problem.

---

From: Martin Willi <[email-masked]>
Date: Wed, 12 May 2010 09:45:43 +0200

Hi Yoav,

> I have noticed that StrongSwan is [not] implementing clustering.

Starting with the recently released 4.4.0, we provide an experimental
clustering feature. Using the terms from the draft, it is a "Tight
Completely Transparent Load Sharing Cluster".
Most work has been done before the HA discussion started on the list,
more details are available at [1].

> Have you had a chance to read it?  

Yes. 

> If so, I would very much appreciate it, if you could send a short
> review to the list. 

The terminology is very useful. I used the term "node" for a single box
in the cluster, but "member" is even better.

For "Outbound SA Counters", we use an approach to "count, but not
encrypt" the packets on the passive members. And our "Inbound SA
Counters" are updated by verifying a packet from time to time. This
approach has some requirements to the cluster setup and some problems
not trivial to handle. So I'm not sure if we should mention it in the
draft.

> Mainly, they want to know if the document is ready, or whether there
> are some issues that are not yet covered there.

I think the draft is good to go. It provides a good overview and states
the problems that need to be addressed. 

Best regards
Martin

[1]http://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability