HP-UX IPSec version A.02.01 Administrator's Guide

HP-UX IPSec and Serviceguard
Introduction
Appendix G328
Each package can have one or more unique package addresses. A
package address is a relocatable IP address that is dynamically assigned
to the cluster node on which the package is currently running. In
Figure G-1, the package pkgA is currently running on Node1, and its
relocatable package address, 15.98.98.98, is assigned to an interface on
Node1. The package clients connect to or access the packages using the
package addresses.
If Node1 fails or a resource on Node1 fails, pkgA can fail over to another
node in the cluster, such as Node2. The address for pkgA, 15.98.98.98,
will be re-assigned to an interface on Node2. The package clients can
continue to access pkgA using address 15.98.98.98.
Using HP-UX IPSec with Serviceguard
HP-UX IPSec can provide the following functions when used with
Serviceguard:
• HP-UX IPSec can secure Serviceguard network traffic. If a package
fails over to an adoptive node and package clients are using HP-UX
IPSec A.01.07 or later, the package clients will automatically
establish IPsec SAs with the adoptive node as needed, without
operator intervention.
• HP-UX IPSec is compatible with redundant network interfaces. If
Serviceguard fails over from a primary interface to a standby
interface, HP-UX IPSec will continue operating and use the standby
interface with no change in the operation of the Security Associations
(SAs).
• HP-UX IPSec includes a monitor script,
/var/adm/ipsec/ipsec_status.sh, that an Serviceguard package
can use as a package service to monitor HP-UX IPSec. You can
configure the package to fail or fail over if HP-UX IPSec is
unavailable.
Package Clients Not Using HP-UX IPSec A.01.07 or Later
If a package fails over to an adoptive node and a package client had IPsec
SAs established with the original package node, the adoptive node will
send INITIAL-CONTACT notify messages to the package client. In this
situation, the intention of the INITIAL-CONTACT notify message is to
notify the package client that it should delete existing SA information for
the package address, and establish new SAs as needed.