HP-UX IPSec and MC/ServiceGuard

Introduction

Each package can have one or more unique package addresses. A package address is a relocatable IP address that is dynamically assigned to the cluster node on which the package is currently running. In Figure 8-1,the package pkgA is currently running on Node1, and its relocatable package address, 15.98.98.98, is assigned to an interface on Node1. The package clients connect to or access the packages using the package addresses.

If Node1 fails or a resource on Node1 fails, pkgA can fail over to another node in the cluster, such as Node2. The address for pkgA, 15.98.98.98, will be re-assigned to an interface on Node2. The package clients can continue to access pkgA using address 15.98.98.98.

Using HP-UX IPSec with MC/ServiceGuard

HP-UX IPSec can provide the following functions when used with

MC/ServiceGuard:

•HP-UX IPSec can secure MC/ServiceGuard network traffic.

•HP-UX IPSec is compatible with redundant network interfaces. If MC/ServiceGuard fails over from a primary interface to a standby interface, HP-UX IPSec will continue operating and use the standby interface with no change in the operation of the Security Associations (SAs).

•HP-UX IPSec includes a monitor script,

/var/adm/ipsec/ipsec_status.sh, that an MC/ServiceGuard package can use as a package service to monitor HP-UX IPSec. You can configure the package to fail or fail over if HP-UX IPSec is unavailable.

Package Clients Not Using HP-UX IPSec A.01.07 or Later

If a package fails over to an adoptive node and a package client had IPSec SAs established with the original package node, the adoptive node will send INITIAL-CONTACT notify messages to the package client. In this situation, the intention of the INITIAL-CONTACT notify message is to notify the package client that it should delete existing SA information for the package address, and establish new SAs as needed.

238

Chapter 8