IPsec/NAT-T and IKE together with Highest Random Weight Consistency

 


IPsec/NAT-T and IKE together with Highest Random Weight Consistency #

General Properties #

In some cases initial IKE traffic (UDP port 500) needs to be consistently directed to the same IPsec gateway where lateron all further NAT-T traffic is continued (embedding IKE and ESP).

This example shows how to load-balance IPsec/NAT-T together with IKE while providing IP-based conistency with Highest Random Weight rendezvous hashing.

  • The parameter set hrwserver 0 excludes the server information for the highest random weight computation.
  • The target setting tlink 100 in target 500 inherits the health-checks of target 100 and
    instructs method hrw to treat target 500 as target 100 for the weight computation.
  • The same applies for target 101 and target 501.
  • The overall effect is, that UDP port 500 and 4500 are linked together and each individual source IP address is associated by HRW to exactly one destination IPsec gateway (as long as both are operational and up in this example).

Node A # 

//        configuration taken Fri Sep 18 20:35:26 2026
//        BalanceNG 7.573 (created 2026/09/17)
hostname  u31
modules   vrrp,arp,ping,hc,master,slb,rnat
set       {
          hrwserver 0
          rnatslbenable 1
          vrrppreempt 1
          vrrppreemptts 10
}         
interface 1 {
          name bond0.100
          access raw
          threads 4
          trackval 20
}         
interface 2 {
          name bond0.200
          access raw
          threads 4
}         
register  interfaces 1,2
enable    interfaces 1,2
vrrp      {
          vrid 254
          priority 254
          network 2
          tracking enable
}         
network   1 {
          name "Server Network"
          addr 10.17.0.0
          mask 255.255.0.0
          real 10.17.11.2
          virt 10.17.11.1
          interface 1
}         
network   2 {
          name "Target Network"
          addr 10.16.0.0
          mask 255.255.0.0
          real 10.16.11.2
          virt 10.16.11.1
          syncpeer 10.16.11.3
          interface 2
}         
register  networks 1,2
enable    networks 1,2
gateway   {
          ipaddr 10.17.3.1
          arp 3,8
          ping 4,13
}         
server    100 {
          ipaddr 10.17.11.100
          port 4500
          protocol udp
          sessionid src+port
          method hrw
          targets 100,101
}         
server    500 {
          ipaddr 10.17.11.100
          port 500
          protocol udp
          sessionid src+port
          method hrw
          targets 500,501
}         
register  server 100,500
enable    server 100,501
target    100 {
          ipaddr 10.16.11.100
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
target    101 {
          ipaddr 10.16.11.101
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
target    500 {
          ipaddr 10.16.11.100
          port 500
          protocol udp
          tlink 100
          sessionid dst+port
}
target    501 {
          ipaddr 10.16.11.101
          port 500
          protocol udp
          tlink 101
          sessionid dst+port
}
register  targets 100,101,500,501
enable    targets 100,101,500,501
rnat      {
          ::ffff:10.16.11.100 ::ffff:10.17.11.100
          ::ffff:10.16.11.101 ::ffff:10.17.11.100
}
//        end of configuration

Node B # 

//        configuration taken Fri Sep 18 20:33:29 2026
//        BalanceNG 7.573 (created 2026/09/17)
hostname  u30
modules   vrrp,arp,ping,hc,master,slb,rnat
set       {
          hrwserver 0
          rnatslbenable 1
          vrrppreempt 1
          vrrppreemptts 10
}         
interface 1 {
          name bond0.100
          access raw
          threads 4
          trackval 20
}         
interface 2 {
          name bond0.200
          access raw
          threads 4
}         
register  interfaces 1,2
enable    interfaces 1,2
vrrp      {
          vrid 254
          priority 254
          network 2
          tracking enable
}         
network   1 {
          name "Server Network"
          addr 10.17.0.0
          mask 255.255.0.0
          real 10.17.11.3
          virt 10.17.11.1
          interface 1
}         
network   2 {
          name "Target Network"
          addr 10.16.0.0
          mask 255.255.0.0
          real 10.16.11.3
          virt 10.16.11.1
          syncpeer 10.16.11.2
          interface 2
}         
register  networks 1,2
enable    networks 1,2
gateway   {
          ipaddr 10.17.3.1
          arp 3,8
          ping 4,13
}         
server    100 {
          ipaddr 10.17.11.100
          port 4500
          protocol udp
          sessionid src+port
          method hrw
          targets 100,101
}         
server    500 {
          ipaddr 10.17.11.100
          port 500
          protocol udp
          sessionid src+port
          method hrw
          targets 500,501
}         
register  server 100,500
enable    server 100,501
target    100 {
          ipaddr 10.16.11.100
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
target    101 {
          ipaddr 10.16.11.101
          port 4500
          protocol udp
          arp 2,5
          sessionid dst+port
}
target    500 {
          ipaddr 10.16.11.100
          port 500
          protocol udp
          tlink 100
          sessionid dst+port
}
target    501 {
          ipaddr 10.16.11.101
          port 500
          protocol udp
          tlink 101
          sessionid dst+port
}
register  targets 100,101,500,501
enable    targets 100,101,500,501
rnat      {
          ::ffff:10.16.11.100 ::ffff:10.17.11.100
          ::ffff:10.16.11.101 ::ffff:10.17.11.100
}
//        end of configuration