IPsec Session Recovery via Reverse Policy Lookup After IP Migration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In data storage architectures, IPsec sessions are disrupted when an IP address is migrated from one node to another, leading to dropped encrypted packets due to the inability to deliver cleanup notifications reliably, resulting in traffic interruption until the next IPsec renegotiation, which can take hours.
Innovation Solution
Implementing an IPsec session recovery mechanism that initiates and establishes new IKE SA and IPsec SA between the client and the migrated node by performing a reverse IPsec policy lookup using inbound ESP packets to reestablish secure communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IP address migration is performed in data storage architecture, then system flexibility and load balancing are improved, but IPsec session continuity deteriorates causing packet drops and traffic interruption
Solution Approach 1:
The system performs preliminary actions by establishing a new IKE SA and IPsec SA before the old session expires. When an IP address migrates to a new node, the new node proactively initiates a new security association establishment process using the client's IP address and port information, ensuring that a valid security pathway exists before the old one becomes invalid.
Solution Approach 2:
The new node acts as an intermediary that receives the migrated IP address and initiates the security association re-establishment process. It uses the port information from the old session as a mediator to identify and contact the client, facilitating the creation of new IKE and IPsec SAs that bridge the old and new session states.
2Loss of information
If cleanup notification messages are sent upon IPsec session termination, then session state synchronization is improved, but delivery reliability deteriorates when IP address migration occurs
Solution Approach 1:
Instead of the traditional approach where the terminating node sends a cleanup notification to the client, this system inverts the approach by having the new node (receiving the migrated IP address) actively initiate the security association establishment. This reverse approach ensures that session state synchronization is achieved through positive establishment rather than negative notification, eliminating delivery reliability issues.
3Reliability
If IPsec renegotiation is performed after session disruption, then security association validity is restored, but traffic interruption time increases
Solution Approach 1:
The system performs preliminary action by immediately initiating the IKE SA and IPsec SA establishment process as soon as IP address migration is detected, rather than waiting for the old session to expire or for a periodic renegotiation cycle. This reduces traffic interruption time by starting the recovery process at the earliest possible moment.
Solution Approach 2:
The system implements feedback by monitoring the validity of existing IPsec sessions and detecting when they become invalid due to IP address migration. This feedback triggers the automated re-establishment process, ensuring that security association validity is restored promptly in response to actual session disruption conditions.
Data Source
AI summary
A system is described. The system includes a processing resource and a non-transitory computer-readable medium, coupled to the processing resource, having stored therein instructions that when executed by the processing resource cause the processing resource to detect an unrecognized Internet Protocol Security (IPsec) packet associated with an IP address at a first node within a cluster, retrieve one or more selector fields from the IPsec packet, query of a security policy database to determine whether a destination IP address included in the one or more retrieved selector fields matches one or more matching outbound IPsec policies associated with a destination IP address, determine whether a matching outbound IPsec policy includes an IPsec policy associated with the destination address entry and establish the first IPsec SA communication session between the first node and the client based on the outbound IPsec policy.