database logo graphic

RFC 6311

"Protocol Support for High Availability of IKEv2/IPsec", July 2011

Canonical URL:
This document is also available in this non-normative format: PDF.
R. Singh, Ed.
G. Kalyani
Y. Nir
Y. Sheffer
D. Zhang
ipsecme (sec)

Cite this RFC: TXT  |  XML


Other actions: Find Errata (if any)  |  Submit Errata  |  Find IPR Disclosures from the IETF


The IPsec protocol suite is widely used for business-critical network traffic. In order to make IPsec deployments highly available, more scalable, and failure-resistant, they are often implemented as IPsec High Availability (HA) clusters. However, there are many issues in IPsec HA clustering, and in particular in Internet Key Exchange Protocol version 2 (IKEv2) clustering. An earlier document, "IPsec Cluster Problem Statement", enumerates the issues encountered in the IKEv2/IPsec HA cluster environment. This document resolves these issues with the least possible change to the protocol. This document defines an extension to the IKEv2 protocol to solve the main issues of "IPsec Cluster Problem Statement" in the commonly deployed hot standby cluster, and provides implementation advice for other issues. The main issues solved are the synchronization of IKEv2 Message ID counters, and of IPsec replay counters. [STANDARDS-TRACK]

For the definition of Status, see RFC 2026.

For the definition of Stream, see RFC 4844.

Go to the RFC Editor Homepage.