<html><head></head><body lang="en-GB" style="background-color: rgb(255, 255, 255); line-height: initial;"> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Sadly I don't have direct tutorial in this case. After I sent reply for last time about high availability documentation of strongswan I made research about if it is possible to manipulate over Layer 4 directly in linux kernel and I found several interesting things about how to route and high availability in layer 4 stack. </div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">http://www.keepalived.org/</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">http://backreference.org/2013/04/03/firewall-ha-with-conntrackd-and-keepalived/</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">https://lwn.net/Articles/108078/</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">https://www.bggofurther.com/2015/02/how-to-setup-an-ipsec-tunnel-with-strongswan-with-high-availability-on-linux/</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Unfortunately I never had a chance to test high availability in strongswan due to lack of hardware but if I would do it I would configure public ip address to multicast mac to deliver packets to all hosts, synchronisation of iptables firewall with conntrackd, layer 4 (including ah, esp, and udp 500, 4500 connections) synchronisation with keepalived, and synchronisation of ipsec SAs using strongswan high availability plugin. The only thing lacks here is to see documentation of stronswan ha plugin and I think it is better to contact with strongswan development team directly to get it.</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Or alternatively you might forget about synchronisation of ipsec SAs like in:</div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="line-height: initial;">https://www.bggofurther.com/2015/02/how-to-setup-an-ipsec-tunnel-with-strongswan-with-high-availability-on-linux/</span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="line-height: initial;">And rely on client reconnection (most android clients try to re-establish connection in case of service restarts).</span></div><div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><span style="line-height: initial;">If you find solution to synchronise ipsec SA or you encounter with additional failures or successes I will be happy to know it (for me it is also interesting).</span></div> <div style="width: 100%; font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);"><br></div> <div style="font-size: initial; font-family: Calibri, 'Slate Pro', sans-serif, sans-serif; color: rgb(31, 73, 125); text-align: initial; background-color: rgb(255, 255, 255);">Anvar Kuchkartaev <br>anvar@anvartay.com </div> <table width="100%" style="background-color:white;border-spacing:0px;"> <tbody><tr><td colspan="2" style="font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"> <div style="border-style: solid none none; border-top-color: rgb(181, 196, 223); border-top-width: 1pt; padding: 3pt 0in 0in; font-family: Tahoma, 'BB Alpha Sans', 'Slate Pro'; font-size: 10pt;"> <div><b>From: </b>Houman</div><div><b>Sent: </b>viernes, 17 de noviembre de 2017 10:11 p.m.</div><div><b>To: </b>Anvar Kuchkartaev</div><div><b>Cc: </b>users@lists.strongswan.org</div><div><b>Subject: </b>Re: [strongSwan] Can StrongSwan be loadbalanced?</div></div></td></tr></tbody></table><div style="border-style: solid none none; border-top-color: rgb(186, 188, 209); border-top-width: 1pt; font-size: initial; text-align: initial; background-color: rgb(255, 255, 255);"></div><br><div id="_originalContent" style=""><div dir="ltr">Thanks Anvar,<div><br></div><div>I was very excited about the link <a href="https://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability">https://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability</a> that you shared earlier.</div><div>Unfortunately, it doesn't do a good job of explaining how two StrongSwan servers have to be set up to work in collaboration, in order to share the traffic and take over if one of them fails.</div><div><br></div><div>Do you happen to know a step by step tutorial? I haven't found anything on google.</div><div><br></div><div>Thanks,</div><div><br></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Nov 13, 2017 at 4:36 PM, Anvar Kuchkartaev <span dir="ltr"><<a href="mailto:anvar@anvartay.com" target="_blank">anvar@anvartay.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="en-GB" style="background-color:rgb(255,255,255);line-height:initial"> <div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">50 and 51 there are protocol identifiers not port numbers. They are not tcp and not udp they are different transport layer protocols (the same layer resides tcp and udp). Protocol 50 is protocol ESP (Encapsulating Security Payload), protocol 51 is AH (Authentication Header). </div><div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)"><a href="https://en.m.wikipedia.org/wiki/List_of_IP_protocol_numbers" target="_blank">https://en.m.wikipedia.org/<wbr>wiki/List_of_IP_protocol_<wbr>numbers</a></div><div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)"><br></div><div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)">You might be interested following articles:</div><div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)"><a href="http://www.linuxvirtualserver.org/software/ipvs.html" target="_blank">http://www.<wbr>linuxvirtualserver.org/<wbr>software/ipvs.html</a></div><div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)"><a href="https://wiki.strongswan.org/projects/strongswan/wiki/HighAvailability" target="_blank">https://wiki.strongswan.org/<wbr>projects/strongswan/wiki/<wbr>HighAvailability</a><span class="HOEnZb"><font color="#888888"><span style="font-size:initial;text-align:initial;line-height:initial"><br></span></font></span></div><span class="HOEnZb"><font color="#888888"><div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)"><br></div><div style="width:100%;font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)"><span style="font-size:initial;text-align:initial;line-height:initial">Anvar Kuchkartaev </span></div><div style="font-size:initial;font-family:Calibri,'Slate Pro',sans-serif,sans-serif;color:rgb(31,73,125);text-align:initial;background-color:rgb(255,255,255)"><a href="mailto:anvar@anvartay.com" target="_blank">anvar@anvartay.com</a> </div> <table width="100%" style="background-color:white;border-spacing:0px"> <tbody><tr><td colspan="2" style="font-size:initial;text-align:initial;background-color:rgb(255,255,255)"> <div style="border-style:solid none none;border-top-color:rgb(181,196,223);border-top-width:1pt;padding:3pt 0in 0in;font-family:Tahoma,'BB Alpha Sans','Slate Pro';font-size:10pt"> <div><b>From: </b>Houman</div><div><b>Sent: </b>lunes, 13 de noviembre de 2017 04:19 p.m.</div><div><b>To: </b><a href="mailto:users@lists.strongswan.org" target="_blank">users@lists.strongswan.org</a></div><div><b>Subject: </b>[strongSwan] Can StrongSwan be loadbalanced?</div></div></td></tr></tbody></table></font></span><div><div class="h5"><div style="border-style:solid none none;border-top-color:rgb(186,188,209);border-top-width:1pt;font-size:initial;text-align:initial;background-color:rgb(255,255,255)"></div><br><div id="m_-1174597626852895845_originalContent"><div dir="ltr">Hello,<div><br></div><div>I have made quite a bit of research on how to load balance StrongSwan, however, I get contradicting messages.</div><div><br></div><div>e.g. from my understanding, StrongSwan (IKEv2) works over UDP and not TCP. Hence Aws load balancer is out of the question. But so is HAProxy !!!</div><div><br></div><div>But I discovered that latest NGINX 1.10+ supports UDP load balancing and it was easy to set it up.</div><div><br></div><div>I am currently listening to ports 500 and 4500 and it doesn't quite work. I have raised an issue here: <a href="https://wiki.strongswan.org/issues/2464" target="_blank">https://wiki.strongswan.<wbr>org/issues/2464</a></div><div><br></div><div>Do I need to listen to port 50 and 51 as well?</div><div><br></div><div>Any tips or advice for me, please?</div><div>Many Thanks,</div><div>Houman</div><div><br></div><div><br></div></div>
<br></div></div></div></div>
</blockquote></div><br></div>
<br><!--end of _originalContent --></div><br></body></html>