HP-UX IPSec version A.02.00 Administrator's Guide

HP-UX IPSec and MC/ServiceGuard
Introduction
Chapter 8238
Each package can have one or more unique package addresses. A
package address is a relocatable IP address that is dynamically assigned
to the cluster node on which the package is currently running. In
Figure 8-1, the package pkgA is currently running on Node1, and its
relocatable package address, 15.98.98.98, is assigned to an interface on
Node1. The package clients connect to or access the packages using the
package addresses.
If Node1 fails or a resource on Node1 fails, pkgA can fail over to another
node in the cluster, such as Node2. The address for pkgA, 15.98.98.98, will
be re-assigned to an interface on Node2. The package clients can continue
to access pkgA using address 15.98.98.98.
Using HP-UX IPSec with MC/ServiceGuard
HP-UX IPSec can provide the following functions when used with
MC/ServiceGuard:
• HP-UX IPSec can secure MC/ServiceGuard network traffic.
• HP-UX IPSec is compatible with redundant network interfaces. If
MC/ServiceGuard fails over from a primary interface to a standby
interface, HP-UX IPSec will continue operating and use the standby
interface with no change in the operation of the Security Associations
(SAs).
• HP-UX IPSec includes a monitor script,
/var/adm/ipsec/ipsec_status.sh, that an MC/ServiceGuard
package can use as a package service to monitor HP-UX IPSec. You
can configure the package to fail or fail over if HP-UX IPSec is
unavailable.
Package Clients Not Using HP-UX IPSec A.01.07 or Later
If a package fails over to an adoptive node and a package client had
IPSec SAs established with the original package node, the adoptive node
will send INITIAL-CONTACT notify messages to the package client. In
this situation, the intention of the INITIAL-CONTACT notify message is
to notify the package client that it should delete existing SA information
for the package address, and establish new SAs as needed.