High Availability for IPsec VPN Platforms: ClusterIP Evaluation

Abstract

To manage the huge demand on traffic, the Internet Service Providers (ISP) are offloading its mobile data from Radio Access Networks (RAN) to Wireless Access Networks (WLAN). While these RANs are considered trusted networks, WLANs need to build a similar trusted zone in order to offer the same security level and Quality of Service (QoS) to End-Users (EU). Although IPsec is widely implemented to create trusted environments through untrusted networks, the industry is increasingly interested in providing IPsec-based services with High Availability (HA) features in order to ensure reliability, QoS and security. Even though IPsec is not originally well suited to provide HA features, some mechanisms like VRRP or ClusterIP can work together with IPsec in order to offer HA capabilities. ClusterIP is actually used by strongSwan (an open source IPsecbased VPN solution) to build a cluster of IPsec Security Gateways (SG) offering HA features.This paper concentrates on how to build a cluster of IPsec SGs based on ClusterIP. We describe the main issues to overcome HA within IPsec. Then, we measure how HA may affect the EU experience, and provide recommendations on how to deploy ClusterIP. Finally, our tests over an HTTP connection showed that ClusterIP allows fast recovering during a failure.

Secure IPsec based offload architectures for mobile data

“…Similarly to anyWLAN, OAA may easily take advantage of a centralized architecture to optimize offload bandwidth with path prediction and prefetching. In addition, Security Gateways are mature and multiple mechanisms have been designed to scale the load and clustering solutions are proposed by multiple vendors[29,32,33,39].…”