High Availabilty for VPNs

ALTERNATIVE PATH

Author(s):

IPSec prevents many of the clever tricks high-availability products employ. We’ll show you a solution that provides transparent backup for IPSec connections.

System administrators often want a network connection system that switches transparently to a backup if the primary connection goes down. But if you use a VPN with IPsec to protect your traffic en route through the Internet, the backup line needs some special attention. The reason for this attention is that IPsec [1] [2] requires consistent IP addresses at the endpoints of a tunnel, so when the network switches to a different tunnel, the IP addresses must switch to the new endpoints or else existing connections will be terminated. The Border Gateway Protocol (BGP [3]) offers a reliable means of maintaining a highly-available pool of IP addresses with a number of providers. Unfortunately, provider service agreements often prevent admins from using BGP for an existing Internet connection.

Read full article as PDF:

High_Availability_VPN.pdf (481.82 kB)

Related content

  • Pacemaker

    When a cluster node fails, the Pacemaker high-availability tool launches the services on another node. A lesser known feature is Pacemaker’s ability to put failed services back on their feet in the cluster manager.

  • CLUSTERIP

    Iptables gives admins the ability to set up clusters and distribute the load. But what about failover?

  • ARP Spoofing

    Any user on a LAN can sniff and manipulate local traffic. ARP spoofing and poisoning techniques give an attacker an easy way in.

  • Security Lessons

    Moving data to and from Linux systems under the radar.

  • Cross-Platform VPN Connections

    Linux clients sometimes need a little help to connect to Windows VPN servers.

comments powered by Disqus

Direct Download

Read full article as PDF:

High_Availability_VPN.pdf (481.82 kB)

News