RFC 6027

Title Block 🎀

Okay bestie, this one's RFC 6027, called IPsec Cluster Problem Statement 💖. It was written by Y. Nir from Check Point, dated October 2010, and it's filed as Informational 🌸. Informational means it's published for information, not as an Internet Standard. The title block doesn't list anything it obsoletes or updates ✨. Its ISSN is 2070-1721.

Abstract

So this doc lays out the terminology, the problem statement, and the requirements for running IKE and IPsec on clusters 🧚. It also calls out the gaps in existing standards and how they're implemented, which need filling so peers can work with clusters from different vendors 💅. Once everyone agrees on the terms, the problem, and the requirements, IETF working groups can actually start building IPsec/IKEv2 mechanisms that make cluster implementations easier 🔥.

Status of This Memo

This document is not an Internet Standards Track specification 🙈. It's published for informational purposes, so it's not a standard, just vibes and good info 🫶.

This document is a product of the Internet Engineering Task Force (IETF) 🌈. It represents the consensus of the IETF community, it went through public review, and the Internet Engineering Steering Group (IESG) approved it for publication ✨. Not every IESG-approved document is a candidate for any level of Internet Standard, so check Section 2 of RFC 5741 if you want the details 👑.

Want the current status, any errata, or a way to give feedback? Head to http://www.rfc-editor.org/info/rfc6027 🦋.

Copyright Notice

Copyright (c) 2010 IETF Trust and the persons identified as the document authors 💜. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as they stood on the publication date 📜. Please actually read these, because they spell out your rights and restrictions for this document 🙈. Code Components pulled out of this document must include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 💅.

Table of Contents

   1. Introduction ....................................................3
      1.1. Conventions Used in This Document ..........................3
   2. Terminology .....................................................3
   3. The Problem Statement ...........................................5
      3.1. Scope ......................................................5
      3.2. A Lot of Long-Lived State ..................................6
      3.3. IKE Counters ...............................................6
      3.4. Outbound SA Counters .......................................6
      3.5. Inbound SA Counters ........................................7
      3.6. Missing Synch Messages .....................................8
      3.7. Simultaneous Use of IKE and IPsec SAs by Different
           Members ....................................................8
           3.7.1. Outbound SAs Using Counter Modes ....................9
      3.8. Different IP Addresses for IKE and IPsec ..................10
      3.9. Allocation of SPIs ........................................10
   4. Security Considerations ........................................10
   5. Acknowledgements ...............................................11
   6. References .....................................................11
      6.1. Normative References ......................................11
      6.2. Informative References ....................................11

1. Introduction 🌸

Okay so IKEv2, which is described in [RFC5996], and IPsec, described in [RFC4301] and other docs, let you set up VPNs between different sites and also from VPN clients into protected networks 💖.

VPNs are getting more and more important to the orgs that deploy them, so people want IPsec solutions that scale better and go down less 🔥. One way to do that is to use more than one physical gateway, either to share the load or to back each other up, which forms a "cluster" (see Section 2) ✨. People have wanted this kind of thing before for other critical bits of infrastructure, like DHCP and DNS servers, Web servers, databases, and more 🧚.

IKE and IPsec are honestly less clustering-friendly than those other protocols 🙈. Why? They store more state, and that state is more volatile 💅. Section 2 defines the terminology used in this document and in the solution docs that come later 🎀.

Generally speaking, running IKE and IPsec in a cluster means synchronizing so much information between the members that it gets impractical 😭. The other option is to synchronize less, but then failover turns into a long, intense recovery phase, and that kills the scalability and availability promises clusters are supposed to deliver 💀. Section 3 goes into the details 🦋.

1.1. Conventions Used in This Document 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] ✨.

2. Terminology 💜

"Single Gateway" is an implementation of IKE and IPsec that enforces a certain policy, as described in [RFC4301] 🔥.

"Cluster" is a set of two or more gateways that implement the same security policy and protect the same domain 👑. Clusters exist for two reasons: high availability through redundancy, and scalability through load sharing 🫶.

"Member" is one gateway in a cluster 🌈.

"Availability" measures how well a system can do the service it was designed for 🎀. It's measured as the percentage of the time the service is available, out of the time it's supposed to be available 🦋. People sometimes say "nines" instead of percentages, so 3 "nines" means 99.9% availability, 4 "nines" means 99.99% availability, and so on 💅.

"High Availability" is a property of a system, not a configuration type 🧚. A system has high availability if its expected down time is low 🌸. You can get high availability in a bunch of ways, and clustering is one of them 💖. Every cluster described in this document achieves high availability ✨. What "high" means depends on the application, but it's usually 4 to 6 "nines", which works out to at most 0.5-50 minutes of down time per year in a system that's supposed to be available all the time 😭.

"Fault Tolerance" is a property related to high availability 🔥. A system with fault tolerance keeps its service available even when a specified set of fault conditions happens 🙈. In clusters, we expect the system to keep service available when one or more of the cluster members fails 💅.

"Completely Transparent Cluster" is a cluster where a fault never shows up to the peers 👑.

"Partially Transparent Cluster" is a cluster where a fault might show up to the peers 🌈.

"Hot Standby Cluster", or "HS Cluster", is a cluster where only one of the members is active at any given time 🫶. That active member is also called the "active" member, and the others are called "standbys" 🎀. The Virtual Router Redundancy Protocol (VRRP) ([RFC5798]) is one way to build one of these 🦋.

"Load Sharing Cluster", or "LS Cluster", is a cluster where more than one member may be active at the same time 💜. People often say "load balancing" too, but that suggests the load is actually balanced between the members, and that's not a requirement 🧚.

"Failover" is when one member takes over some load from another member 🌸. In a hot standby cluster, this happens when a standby becomes active because the former active member failed, or because an administrator said so 💖. In a load sharing cluster, it usually happens because one of the members failed ✨. Certain load-balancing technologies can also move a particular load, like all the flows tied to one particular child Security Association (SA), from one member to another to even things out, even with no failures at all 🔥.

"Tight Cluster" is a cluster where all the members share one IP address 😭. This can be done with configured interfaces and specialized protocols or hardware, like VRRP, or with multicast addresses 💀. Either way, peers only need to be configured with one IP address in the Peer Authentication Database 🙈.

"Loose Cluster" is a cluster where each member has its own IP address 🦋. Peers find the right member using something like DNS queries or the IKEv2 redirect mechanism ([RFC5685]) 💅. In some cases, a member's IP address(es) might get handed over to another member at failover 👑.

"Synch Channel" is a communications channel among the cluster members, used to transfer state information 🌈. It might or might not be IP based, it might or might not be encrypted, and it might work over short or long distances 🫶. The security and physical characteristics of this channel are out of scope for this document 🎀, but it is a requirement that its use be minimized for scalability 🦋.

3. The Problem Statement 🔥

This section starts by scoping the problem, then lists each issue that comes up when you set up a cluster of IPsec VPN gateways 💜.

3.1. Scope 🧚

This document won't try to describe the problems of setting up a generic cluster 🌸. It only covers problems related to the IKE/IPsec protocols 💖.

Synchronizing policy between cluster members is out of scope ✨, because it's an administrative issue that isn't specific to clusters or to IPsec 🔥.

The interesting scenario here is VPN, whether inter-domain or remote access 👑. Host-to-host transport mode isn't expected to benefit from this work 🙈.

We don't fully describe the problems of the communication channel between cluster members (the Synch Channel) 😭, and we don't plan to specify anything in that space later 💀. To be specific, mixed-vendor clusters are out of scope 🫶.

The problem statement anticipates possible protocol-level solutions between IKE/IPsec peers, aimed at improving the availability and/or performance of VPN clusters 🌈. Ideally, one vendor's IPsec endpoint should be able to work with another vendor's cluster 🎀.

3.2. A Lot of Long-Lived State 💅

IKE and IPsec carry a LOT of long-lived state 🦋:

• IKE SAs last for minutes, hours, or days, and carry keys and other information 💜. Some gateways may carry thousands to hundreds of thousands of IKE SAs 😭.
• IPsec SAs last for minutes or hours, and carry keys, selectors, and other information 🧚. Some gateways may carry hundreds of thousands of these IPsec SAs 🔥.
• SPD (Security Policy Database) cache entries 🌸. The SPD itself doesn't change, but the SPD cache changes on the fly because of narrowing 💖. Entries last at least as long as the SAD (Security Association Database) entries, and they tend to last even longer than that ✨.

A naive cluster implementation would have no synchronized state, so a failover would look a lot like a rebooted gateway 💀. [RFC5723] describes how new IKE and IPsec SAs can be recreated in that situation 👑.

3.3. IKE Counters ✨

okay so we can dodge the first problem from Section 3.2 by syncing states 🔄. whenever an SA gets created, we push that new state to every other member. the tricky part? these states aren't just long lived, they're also constantly changing 💅

IKE has message counters 🔢. a peer MUST NOT process message n until it has already processed message n-1. skipping message IDs is not allowed 🙅‍♀️. so a newly active member needs to know the last message IDs it received AND transmitted.

one option is to sync the IKE message counter info after every single IKE exchange 📨. that way the new active member knows what it's allowed to process and which message IDs to use on IKE requests, so the peers actually accept them 🫶. this could be fine in some cases, but it might be way too much work when there are a lot of SAs 😩. it also never recovers from the missing synch message problem from Section 3.6, which is a whole mess 💀.

3.4. Outbound SA Counters 🎀

ESP and AH have an optional anti-replay feature 🛡️, where every protected packet carries a counter number. reusing counter numbers counts as an attack 🚨, so the newly active member MUST NOT use a replay counter number that's already been used. the peer will drop those packets as duplicates and/or warn about an attack.

syncing IKE message counters might be doable, but syncing the IPsec packet counters for every single packet is basically never feasible 😭. so we have to assume that, at least for IPsec, the replay counter won't be up to date on the new active member, and it might repeat a counter 🙈.

a possible fix is to sync the replay counter info not for every packet, but only at regular intervals, like every 10,000 packets or every 0.5 seconds ⏱️. after a failover, the new active member advances the outbound IPsec SA counters by 10,000 packets 🚀. to the peer, this looks like up to 10,000 packets got lost, but that should be fine, since neither ESP nor AH guarantees reliable delivery 🌸.

3.5. Inbound SA Counters 😤

this one is an even tougher issue: syncing packet counters for inbound IPsec SAs 🥲. if a packet shows up at a newly active member, there's no way to tell whether it's a replay 🕵️‍♀️. periodic syncing doesn't fix this at all. say we sync every 10,000 packets, and the last sync before failover had the counter at 170,000. it's probable, though not certain, that packet 180,000 hasn't been processed yet 🤔. but if packet 175,000 arrives at the new active member, it has no way of knowing whether that packet was already processed 😵. the sync does stop really old packets, like counter 165,000, from getting through 🧱. ignoring every counter below 180,000 won't work either, because that's up to 10,000 dropped packets, and that would be super noticeable 🙃.

the easiest fix is to learn the replay counter from the incoming traffic 📥. this is allowed by the standards, since replay counter verification is an optional feature (see Section 3.2 in [RFC4301]) ✅. you could even argue it's relatively secure 🔐, because normal non-attack traffic resets the counters to where they should be. so an attacker has to deal with a super narrow attack window AND time the attack to a failover event 🎯. unless the attacker can actually cause the failover, that's very hard to pull off. BUT, it should be noted that even though this solution is acceptable as far as RFC 4301 goes, whether it's acceptable is a matter of policy 📋.

another possible fix for the inbound IPsec SA problem is to rekey all child SAs after a failover 🔑. whether that's feasible depends on the implementation and the configuration ⚙️.

3.6. Missing Synch Messages 💔

the synch channel is very likely not infallible 🙅‍♀️. before failover is detected, some synchronization messages might have been missed 😬. for example, the active member might have created a new child SA using message n 🆕. the new info (the entry in the SAD and the update to the IKE SA's counters) gets sent on the synch channel 📡. still, with every possible technology, that update can get missed before the failover happens 💀.

this is a bad situation because the IKE SA is doomed ☠️. the newly active member has two problems:

• it doesn't have the new IPsec SA pair 😱. it will drop all incoming packets protected with that SA. this could be fixed by sending some DELETEs and INVALID_SPI notifications, if it weren't for the other problem 🙄.
• the counters for the IKE SA show that only request n-1 has been sent 🔢. the next request gets message ID n, but the peer will reject it 🚫. after enough retransmissions and rejections, the whole IKE SA, along with all its associated IPsec SAs, gets dropped 🫠.

this scenario might be rare enough that, on a configuration with thousands of IKE SAs, it's acceptable for a few of them to get recreated from scratch or through session resumption techniques 🌈. BUT detecting this can take a long time (several minutes) 😩, and that kind of defeats the whole point of making a cluster in the first place 💅.

3.7. Simultaneous Use of IKE and IPsec SAs by Different Members 👯‍♀️

for load sharing clusters, all active members might need to use the same SAs, both IKE and IPsec 🔁. this is an even bigger problem than with hot standby clusters, because consecutive packets might need to be sent by different members to the same peer gateway 😵‍💫.

the IKE SA issue is up to the implementation 🛠️. it's possible to build some locking mechanism over the synch channel, or to have one member "own" the IKE SA and manage the child SAs for all the other members 👑. for IPsec, the solutions fall into two broad categories 🗂️.

the first is the "sticky" category 📌, where all communications with a single peer, or all communications involving a certain SPD cache entry, go through one peer. in this case, all packets matching a particular SA go through the same member, so the replay counter doesn't need syncing at all 🙌. inbound processing is a "sticky" issue (no pun intended 😉), because packets have to be processed by the correct member based on the peer and the Security Parameter Index (SPI). most load balancers can't match SPIs to the correct member unless stickiness covers all traffic with a particular peer 🧐. another downside of sticky solutions is that the load tends not to spread evenly, especially if one SA covers a big chunk of IPsec traffic 📉.

the second is the "duplicate" category 👯, where the child SA is duplicated for each pair of IPsec SAs for each active member. different packets for the same peer go through different members and get protected using different SAs with the same selectors that match the same SPD cache entries 🔀. this has some shortcomings 😬:

• it requires multiple parallel SAs, which the peer has no use for 🙃. Section 2.8 of [RFC5996] specifically allows this, but some implementations might have a policy against long-term maintenance of redundant SAs 📜.
• different packets belonging to the same flow might be protected by different SAs, which could seem "weird" to the peer gateway 🤨, especially if it's integrated with deep-inspection middleware like a firewall 🧱. it isn't known whether this will cause problems with current gateways 🤷‍♀️. it's also impossible to mandate against this, because the definition of "flow" varies from one implementation to another 🌀.
• reply packets may arrive with an IPsec SA that doesn't match the one used for the outgoing packets 📬. they might also arrive at a different member 🏃‍♀️. this problem is beyond the scope of this document and should be solved by the application, perhaps by forwarding misdirected packets to the correct gateway for deep inspection 🔍.

3.7.1. Outbound SAs Using Counter Modes 🔢

for SAs using counter mode ciphers, like Counter Mode (CTR) ([RFC3686]) or Galois/Counter Mode (GCM) ([RFC4106]), there's yet another complication 🧩. the initial vector for these modes MUST NOT be repeated 🚫, and senders use methods like counters or linear feedback shift registers (LFSRs) to make sure of that. for an SA shared between more than one active member, or one that fails over from one member to another, the cluster members need to make sure they don't generate the same initial vector 🔐. see [COUNTER_MODES] for a discussion of this problem in another context 📖.

3.8. Different IP Addresses for IKE and IPsec 🌐

in lots of implementations, there are separate IP addresses for the cluster and for each member 🏠. packets protected by tunnel mode child SAs get encapsulated in IP headers with the cluster IP address, but IKE packets come from a specific member and carry that member's IP address 📍. this might be done so IPsec traffic bypasses the load balancer for better scalability 🚀. to the peer, this looks weird, because the usual thing is for IPsec packets to come from the same IP address as the IKE packets 🤨. unmodified peers may drop such packets 🗑️.

one obvious fix is to use some fancy capability of the IKE host so that IKE packets also come out of the cluster IP address ✨. this can be done through NAT or by assigning multiple addresses to interfaces 🪄. but it's not possible for every implementation, and it won't reduce load on the balancer 😕.

[ARORA] discusses this problem in greater depth and proposes another solution that does involve protocol changes 📚.

3.9. Allocation of SPIs 🆔

the SPI for each child SA, and for each IKE SA, MUST be unique relative to the peer of the SA 🔑. so in a cluster, each cluster member MUST generate SPIs in a way that avoids collisions with the other cluster members' SPI values 💅. how cluster members achieve this is a local matter and outside the scope of this document 🤫.

4. Security Considerations 🔐😱

implementations running on clusters MUST be as secure as implementations running on single gateways 🛡️. in other words, no extension or interpretation used to allow operation in a cluster may enable attacks that aren't possible on single gateways 🚫.

also, you have to think carefully about the synching requirements of any protocol extension, so it doesn't open a door for denial-of-service attacks on the cluster 🌋.

as mentioned in Section 3.5, letting an inbound child SA fail over to another member effectively disables replay counter protection for a short time 😳. the threat is arguably low, but whether that's acceptable is a policy decision 📋.

Section 3.7 describes the problem of the two directions of a flow being protected by two SAs that aren't part of a matched pair, or that aren't even processed by the same cluster member 🔄. this isn't a security problem as far as IPsec is concerned, because IPsec only has policy at the IP, protocol, and port level 🧾. BUT many IPsec implementations are integrated with stateful firewalls, which need to see both sides of a flow 👀. those implementations may have to forward packets to other members so the firewall can properly inspect the traffic 🔍✨.

5. Acknowledgements 🫶

Okay bestie, this doc is literally a group project 💖 It's the collective work of so many people from the IPsecME working group, so everyone who helped out is iconic ✨

The editor especially wants to shout out these legends, listed alphabetically 👑:

• Jitender Arora
• Jean-Michel Combes
• Dan Harkins
• David Harrington
• Steve Kent
• Tero Kivinen
• Alexey Melnikov
• Yaron Sheffer
• Melinda Shore
• Rodney Van Meter

6. References 📚

6.1. Normative References 💜

These are the ones you need to actually read, no cap 🤓

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC4301]  Kent, S. and K. Seo, "Security Architecture for the
           Internet Protocol", RFC 4301, December 2005.

[RFC5996]  Kaufman, C., Hoffman, P., Nir, Y., and P. Eronen,
           "Internet Key Exchange Protocol Version 2 (IKEv2)",
           September 2010.

6.2. Informative References 🦋

These are the extra reads if you're curious and want to go down a rabbit hole 🧚

[ARORA]    Arora, J. and P. Kumar, "Alternate Tunnel Addresses for
           IKEv2", Work in Progress, April 2010.

[COUNTER_MODES]
           McGrew, D. and B. Weis, "Using Counter Modes with
           Encapsulating Security Payload (ESP) and Authentication
           Header (AH) to Protect Group Traffic", Work in Progress,
           March 2010.

[RFC3686]  Housley, R., "Using Advanced Encryption Standard (AES)
           Counter Mode", RFC 3686, January 2009.

[RFC4106]  Viega, J. and D. McGrew, "The Use of Galois/Counter Mode
           (GCM) in IPsec Encapsulating Security Payload (ESP)",
           RFC 4106, June 2005.

[RFC5685]  Devarapalli, V. and K. Weniger, "Redirect Mechanism for
           IKEv2", RFC 5685, November 2009.

[RFC5723]  Sheffer, Y. and H. Tschofenig, "IKEv2 Session Resumption",
           RFC 5723, January 2010.

[RFC5798]  Nadas, S., "Virtual Router Redundancy Protocol (VRRP)",
           RFC 5798, March 2010.

Author's Address 🎀

Yoav Nir Check Point Software Technologies Ltd. 5 Hasolelim st. Tel Aviv 67897 Israel

EMail: ynir@checkpoint.com 💅