[strongSwan] DNS LoadBalancing and Failover

[Michael Schwartzkopff]

Am 16.09.2018 um 09:34 schrieb Markus P. Beckhaus:
> Dear all,
>
> we are thinking about using a DNS Load-Balancer to distribute a huge count of strongswan clients to multiple VPN gatweways. Also, the DNS Load-Balancer should detect the failure of VPN gateways and remove them from the DNS responses, thus poviding a kind of availability and failover.
>
> Here is the challenge:
> If the strongswan clients detects the failure of a connection (e.g. DPD), it must send a new DNS request to retrieve a list of still available gateways and reconnect to one of them.
>
> From what I have read, I believe strongswan only does the DNS resolution of the peer only once, when it reads the connection configuration.
>
> Does anyone have an idea, how solve the described requirement. Naturally, any alternative proposals to address this load distribution and failover requirements are welcome.
>
> Best Regards
> --
> Markus
>

hi,


we implemented a kind of such solution.


We had all VPN server in one or two datacenters that were close to each
other. So need for a geographic distribution of the clients.

DNS also was our first idea, but for some reasons we finally chose a
wrapper solution fot the client config.


DNS also should be possible and finally be superior solution. But you
really want to implement DNSsec. You also could distribute keys or
certificates of the servers in DNS. Thus the need to install (and
update) the server authority on the clients is solved.


After all, this should work quite well.


Mit freundlichen Grüßen,

-- 

[*] sys4 AG
 
https://sys4.de, +49 (89) 30 90 46 64
Schleißheimer Straße 26/MG,80333 München
 
Sitz der Gesellschaft: München, Amtsgericht München: HRB 199263
Vorstand: Patrick Ben Koetter, Marc Schiffbauer, Wolfgang Stief
Aufsichtsratsvorsitzender: Florian Kirstein


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 213 bytes
Desc: OpenPGP digital signature
URL: <http://lists.strongswan.org/pipermail/users/attachments/20180916/bcd6389c/attachment.sig>