IPsec Tunnel Workload Management via ESP TFC Packets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Internet Key Exchange (IKE) network devices face issues with Dead Peer Detection (DPD) causing resource overloads and IPsec tunnel flapping due to delayed message exchanges, leading to inefficient resource management and increased processing burdens.
Innovation Solution
Implementing a method where the network device generates and sends encapsulating security payload (ESP) packets with traffic flow confidentiality (TFC) payload data through the IPsec tunnel to maintain connectivity and reduce DPD message exchanges, thereby managing workload thresholds and disabling DPD when overloaded to conserve resources.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Dead Peer Detection (DPD) is continuously performed to detect dead IKE peers, then peer status monitoring is improved, but device workload and processing burden increase significantly
Solution Approach 1:
The system uses existing ESP traffic flow confidentiality packets to simultaneously perform tunnel maintenance and peer liveness detection. The ESP packets, which are already being transmitted for data confidentiality purposes, are repurposed to serve the dual function of keeping the tunnel alive and detecting peer status, eliminating the need for separate DPD message exchanges and reducing overall device workload.
2Reliability
If DPD messages are exchanged frequently to ensure tunnel stability, then tunnel reliability is improved, but resource consumption and processing overhead increase
Solution Approach 1:
The ESP packets with traffic flow confidentiality payload data serve multiple functions simultaneously: they maintain the IPsec tunnel by providing encrypted data transmission, and they act as keep-alive signals for peer detection. This multi-functionality eliminates the need for separate DPD messages, reducing resource consumption while maintaining tunnel stability.
3Measurement precision
If the device monitors and responds to every DPD request to maintain accurate peer detection, then detection accuracy is improved, but processing time and resource usage increase
Solution Approach 1:
Instead of periodic DPD message exchanges, the system maintains continuous tunnel activity through ESP packet transmission. The encrypted data packets are sent continuously or periodically as needed for normal operation, providing ongoing peer detection without requiring separate DPD request-response cycles, thereby reducing processing time while maintaining detection accuracy.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A network device identifies an Internet Protocol Security (IPsec) tunnel that connects the network device to a remote device and determines that dead peer detection (DPD) is enabled at the network device. The network device receives a first DPD request message from the remote device via the IPsec tunnel, and sends a first DPD response message to the remote device via the IPsec tunnel. The network device determines that a workload of the network device satisfies a threshold amount, and sends one or more encapsulating security payload (ESP) packets that include traffic flow confidentiality (TFC) payload data to the remote device via the IPsec tunnel. The network device determines that the workload of the network device does not satisfy the threshold amount. The network device receives a second DPD request message from the remote device and sends a second DPD response message to the remote device via the IPsec tunnel.