降低叢集架構式IPSec閘道之封包失序現象

Abstract

儘管計算能力與可靠度的提昇能夠提供叢集架構式IPSec閘道相當程度的改善，然而此種架構之IPSec閘道會產生一種封包失序的現象。此種現象導因於叢集式的系統架構與IPSec中防封包重送機制（Anti-Replay Window）的衝突，進而影響叢集架構式IPSec閘道的整體效能。在這篇論文中，我們針對兩種可能的叢集式IPSec閘道系統架構進行研究，並對其所造成的封包失序現象加以分析。根據這些分析，我們對這兩種架構設計實驗並模擬其產生的現象。實驗的結果能夠提供我們調整在叢集架構式IPSec閘道中防封包重送機制（Anti-Replay Window），進而降低封包失序所帶來的影響。

Despite the improvements of both computing power and reliability brought by clustered IPSec gateways, the overall network throughput can be affected by a side effect called packet out-of-order syndrome on the gateways. The syndrome results from the conflict between the clustered architecture and anti-replay window mechanism of IPSec protocol. In this thesis, we analyze the packet out-of-order syndrome on two possible system architectures of clustered IPSec gateway solutions. Based on the analysis, simulations are performed on the two clustered architectures. The results of the simulations can help reducing the out-of-order syndrome by properly adjusting the anti-replay window size on the IPSec gateway.