TechPrufer
Sign inGet started

Blogs›IBM›Live Kernel Updates with IPsec Tunnels

Live Kernel Updates with IPsec Tunnels

Live Kernel Updates with IPsec Tunnels

1
posts
2024

This post introduces a new capability for IBM AIX 7.3 TL3 and later, allowing live kernel updates to be performed while maintaining active Internet Protocol Security (IPsec) tunnels. This is achieved through a new `ipsec_auto_migrate` attribute in the live update configuration, which automates the disabling and re-enabling of IPsec subsystems during the update process. The post details the changes in live kernel update stages, configuration steps, and outlines limitations such as a brief window of unencrypted traffic and the re-establishment of fresh tunnels.

2024

Perform live kernel updates with active Internet Protocol Security (IPsec) tunnels

12/16/2024

Introduces the `ipsec_auto_migrate` attribute for IBM AIX live kernel updates, enabling the system to automatically manage IPsec tunnels and daemons during the update process. This feature, available in AIX 7.3 TL3 and later, addresses the previous limitation where active IPsec tunnels would cause live kernel updates to fail. The post details the mechanism of disabling IPsec on the source LPAR and re-enabling it on the surrogate LPAR, along with configuration instructions and a discussion of associated risks and limitations.