IBM

Perform live kernel updates with active Internet Protocol Security (IPsec) tunnels

Dec 16, 2024Madan Chukka, Mansi Jaiswal
Perform live kernel updates with active Internet Protocol Security (IPsec) tunnels
SummaryAI, from the source post

Introduced the `ipsec_auto_migrate` option in the `lvupdate.data` file for IBM AIX Live Update. When set to 'yes', this option automates the disabling and re-enabling of the IPsec subsystem (tunnels and daemons) during live kernel updates. This allows for live kernel updates to succeed even with active IPsec tunnels, addressing a previous limitation where such updates would fail. The feature supports IKEv2 and is available on AIX 7.3 TL3 and later. Acknowledged risks include a brief window of unencrypted traffic and the non-preservation of tunnel states, requiring fresh tunnel establishment.