Enterprise Implementation

High Availability

When an IPsec gateway fails, the remote peer is not notified of the failure. Dead Peer Detection can help in this regard, but ideally we want a backup system that will take over the IPsec (and probably other duties as well). Since all IPsec tunnels are bound to either DNS host names or IP addresses, if we keep the old IP address (now known as the Service Address), taking over the tunnels is simple.

The solution is to use two systems, a primary and a backup. During regular operation, all traffic passes through the primary server. In the event of any network card/system failure, the backup server takes over the IP address(es) and starts up Openswan to renegotiate the tunnels and keep traffic flowing.

Heartbeat, from the Linux-HA-Project, is required for this. Heartbeat takes care of taking over the IP addresses, and will stop or start services as needed. You can add Zebra or Quagga to the heartbeat configuration if you need to take care of any dynamic routing.

Heartbeat

Heartbeat is the basic heartbeat subsystem from the Linux-HA project. It will run service scripts (using service <name> start) when it starts up, and when a system changes state (that is, from being a backup to a primary). It will also perform IP address takeover using gratuitous ARP. It works correctly for two-node configurations, and probably larger configurations.

Heartbeat is based on resources, and an IP address is a resource just as services (ipsec, named, xinetd) are resources. When the decision is made to change state, for example from backup mode to primary mode, each of the resources is acquired, and a notification is sent out to the other nodes in the HA cluster.

Heartbeat uses a protocol based on UDP (or a serial line, though this is not a very common setup) to send keepalives and notifications to other nodes in the cluster. These keepalives may also be MD5 or SHA1 hashed for security, to prevent a rogue node from taking over resources, though this security measure can be disabled if a dedicated network segment or crossover cable is used.

The master node, which has all the shared services for the cluster, will be monitoring the services as well. If at any time there is a problem with a service, it will shut that service down on the master and transfer it to a slave node that is still working. If a backup node detects that the master has gone down, it will attempt to acquire all resources, by taking over the IP addresses and starting all the services listed in the config file.

After installing Heartbeat, you can add Openswan in quite quickly. Simply add the ipsec resource to the resources in your /etc/ha.d/haresources configuration file:

#We have 2 IP addresses to takeover, the outside (206.1.1.1) and inside (192.168.1.1)

#And 1 service (ipsec) to takeover

VPNGW1 206.1.1.1 192.168.0.1 ipsec

Next, configure Openswan. If you are using KLIPS, you will need to tell Openswan to bind ipsec0 to the aliased interface, for example eth0:0. This is done in the config setup section of

the ipsec.conf file:

262