Perform live kernel updates with active Internet Protocol Security (IPsec) tunnels
Dec 16, 2024Madan Chukka, Mansi Jaiswal
Summary
Introduced the `ipsec_auto_migrate` option in the `lvupdate.data` file for IBM AIX Live Update. When set to 'yes', this option automates the disabling and re-enabling of the IPsec subsystem (tunnels and daemons) during live kernel updates. This allows for live kernel updates to succeed even with active IPsec tunnels, addressing a previous limitation where such updates would fail. The feature supports IKEv2 and is available on AIX 7.3 TL3 and later. Acknowledged risks include a brief window of unencrypted traffic and the non-preservation of tunnel states, requiring fresh tunnel establishment.