Re: [IPsec] Issue #177. (was: HA/LS terminology)

Yoav Nir <> Wed, 24 March 2010 02:24 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 7B37E3A67E1 for <>; Tue, 23 Mar 2010 19:24:32 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -0.415
X-Spam-Status: No, score=-0.415 tagged_above=-999 required=5 tests=[AWL=0.196, BAYES_20=-0.74, DNS_FROM_OPENWHOIS=1.13, RCVD_IN_DNSWL_LOW=-1]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id D-HoEKwxZh4J for <>; Tue, 23 Mar 2010 19:24:31 -0700 (PDT)
Received: from ( []) by (Postfix) with ESMTP id DB6253A672E for <>; Tue, 23 Mar 2010 19:24:30 -0700 (PDT)
Received: from ( []) by (8.12.10+Sun/8.12.10) with ESMTP id o2O2OWsd026790; Wed, 24 Mar 2010 04:24:32 +0200 (IST)
X-CheckPoint: {4BA97726-0-1211DC2-2FFFF}
Received: from ([]) by ([]) with mapi; Wed, 24 Mar 2010 04:24:53 +0200
From: Yoav Nir <>
To: Dan Harkins <>
Date: Wed, 24 Mar 2010 04:24:30 +0200
Thread-Topic: [IPsec] Issue #177. (was: HA/LS terminology)
Thread-Index: AcrK+S+wAUq31EkTQ26Nyy/cyY/g9A==
Message-ID: <>
References: <> <> <> <> <> <> <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: Rodney Van Meter <>, "" <>, Melinda Shore <>
Subject: Re: [IPsec] Issue #177. (was: HA/LS terminology)
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: Discussion of IPsec protocols <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 24 Mar 2010 02:24:32 -0000

On Mar 23, 2010, at 6:05 PM, Dan Harkins wrote:

>  Hi,
>  "hot standby" implies a box sitting ("hot") twiddling its thumbs doing
> little but waiting for another box to fail ("standby"). It's the VRRP
> model.

And that's exactly what I want to describe. Well, not twiddling its thumbs. The standby is synchronizing state with the active member, but it's not doing any IKE or IPsec

>  There is a HA model which supports dynamic load balancing as well as
> active session failover. Nodes in such a cluster are not "standby". They
> each have loads that they can shed and add to based upon some heuristic.
> A neat attribute of such a system is that an IPsec SA can be established
> on node A, move to node B after a while, and come back to A some time
> later without any actual node failure. State moves around to keep the
> cluster balanced.

Failure is just used as an example of why a certain SA failed over to another member. It is by no means the only reason. Still, what you are describing is a model that provides both high-availability and load balancing, and that is the reason we're moving away from calling the first model "high availability".

>  I would very much prefer "session failover" to "hot standby" and a
> mild preference of "load balancing" over "load sharing". An HA model
> doing VRRP could be termed "session failover" but the HA model described
> above really can't be called "hot standby". And load can be shared but
> just sharing a load can result in a mis-balanced cluster if sessions on
> one node terminate naturally and it sits doing little while another node
> whose sessions haven't terminated is huffing-and-puffing. Balancing can
> imply sharing but not vice versa.

"Session failover" sounds to me more like a description of an event than a type of cluster.

>  regards,
>  Dan.