On Mon, May 21, 2012 at 12:17 PM, Trent W. Buck <trentbuck(a)gmail.com> wrote:
Richard Andrews wrote:
I'm load testing a kernel mode IPsec setup.
When IKE SAs renegotiate
one or two IP packets get sent on the default route but after the
tunnel is back up the TCP connection remains stuck on the default
route by-passing xfrm policy until the TCP connection closes from
Ping is not affected the same way. It uses the tunnel as soon as a new
child SA is up (even while TCP is broken).
The next TCP connection uses the tunnel immediately.
Random not-very-good thoughts:
- presumably ICMP works because it's connectionless. Confirm by
testing if UDP also does the Right Thing.
TCP also does the right thing provided it does not terminate on the
gateway. IP forwarding works as expected, which is good as this is the
main requirement. I think it must be the linux TCP stack binding the
connection to a path based on where the first packet goes.
- RPF? During transition, perhaps RPF is dropping a
of the TCP conversation. Test by turning off RPF.
Interesting idea. I can try, but I expect RPF to be connectionless as
it operates at layer 3.
- likewise test w/ minimal or no firewall, policy
Yup. All off. It's a test system so I can turn off everything.
tcpdump on all hosts you have access to