TechPrufer
Get started
IBM
IBM logoIBM · Feature trail

Live Kernel Updates with IPsec Tunnels

1 post · Dec 2024

What this trail covers

Live kernel updates for IBM AIX now support active IPsec tunnels through the `ipsec_auto_migrate` option, automating the disabling and re-enabling of the IPsec subsystem during updates to maintain data-in-flight protection. This feature is available for AIX 7.3 TL3 and later versions, supporting IKEv2, but introduces a brief window where traffic may be unencrypted and does not preserve tunnel states.

All IBM trails
  1. Perform live kernel updates with active Internet Protocol Security (IPsec) tunnelsIntroduced the `ipsec_auto_migrate` option in the `lvupdate.data` file for IBM AIX Live Update. When set to 'yes', this option automates the disabling and re-enabling of the IPsec subsystem (tunnels and daemons) during live kernel updates. This allows for live kernel updates to succeed even with active IPsec tunnels, addressing a previous limitation where such updates would fail. The feature supports IKEv2 and is available on AIX 7.3 TL3 and later. Acknowledged risks include a brief window of unencrypted traffic and the non-preservation of tunnel states, requiring fresh tunnel establishment.