OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
NFR Wizards Archives: RE: Hardware vs. Software firewall reliab

RE: Hardware vs. Software firewall reliability

Bill Stout (Bill.StoutAristaSoft.com)
Mon, 13 Sep 1999 14:02:37 -0700

I suspect the answers are vendor-specific here.

So why would a VPN not fail over? Current sessions should break, but should
be no more interruption than temporary packet loss on the Internet.

Rather than start a new VPN on failover, why not have two VPNs predefined
and ready to accept connections once the IP address is failed over?

Bill Stout

 -----Original Message-----
From: Ryan Russell [mailto:Ryan.Russellsybase.com]
Sent: Saturday, September 11, 1999 3:07 PM
To: Aaron D. Turner
Cc: Joe Ippolito; Franck Veysset; firewall-wizardsnfr.net
Subject: RE: Hardware vs. Software firewall reliability

>I thought the problem with H/A and VPN is only one of the firewalls
>can have the VPN "certificate". When the primary fails and the
>secondary takes over the remote site aborts the VPN because the
>secondary has the wrong cert. The fix is to manually update the
>certificates (or perhaps via a script).
>
>Beacuse, by default, FW-1 allows any established connection through,
>the state table of the secondary shouldn't become an issue. If FW-1
>didn't allow that, all established connections would drop when the
>secondary took over.

... And "established " only applies to TCP, and the VPN doesn't
run over TCP. It runs over IP in IP. The problem is that FW-1's
state sharing code always seems to lag behind the new features,
so you get things like the VPN state not being shared even though it's
been around for awhile.

                         Ryan

My Recipe - 20% Indonesian, 40% Dutch, 30% French, 10% Other. American born
and damn proud of it.

Indonesia - Replaced Dutch rule with a brutal Dictatorship in the name of
'Freedom'. I pray justice for their acts in East Timor will be just as
brutal on them, and as surgical as possible.

This archive was generated by hypermail 2.0b3 on Tue Sep 14 1999 - 20:58:58 CDT