Seamless switchover for anti-replay connections in multiple network processor systems
Various exemplary embodiments relate to a method, network node, and non-transitory machine-readable storage medium including one or more of the following: receiving, at the network device, an ownership indication that a first network processor is currently serving an anti-replay connection; and in response to receiving the ownership indication, effecting a presetting in a second network processor of a current sequence number (SN) for the anti-replay connection to a first value that is greater than or equal to a re-key threshold value, wherein the network device includes at least one of the first network processor and the second network processor wherein the re-key threshold value is a value beyond which an SN triggers re-keying of the anti-replay connection, and wherein the second network processor utilizes the current sequence number upon beginning to serve the anti-replay connection.
1. A method performed by a network device for performing switchover of an anti-replay connection, the method comprising:
receiving, at the network device, an ownership indication that a first network processor is currently serving the anti-replay connection; and
in response to receiving the ownership indication, effecting a presetting in a second network processor of a current sequence number (SN) for the anti-replay connection to a first value that is greater than or equal to a re-key threshold value, wherein the network device comprises at least one of the first network processor and the second network processor, the re-key threshold value is a value beyond which an SN triggers re-keying of the anti-replay connection, and the second network processor utilizes the current SN upon beginning to serve the anti-replay connection.
2. The method of claim 1 , wherein the second network processor is part of a different network device from the network device and the step of effecting the presetting in the second network processor of the current SN comprises:
communicating with the different network device via a control link to indicate that SN presetting is to be performed.
3. The method of claim 1 , further comprising:
receiving a further ownership indication that the second network processor is currently serving the anti-replay connection; and
in response to receiving the further ownership indication, effecting a presetting in a third network processor of the current SN for the anti-replay connection to a second value that is greater than the first value.
4. The method of claim 3 , wherein a difference between the re-key threshold value and the first value is the same as a difference between the first value and the second value.
5. The method of claim 1 , further comprising:
selecting a difference between the re-key threshold value and the first value to provide the first network processor with a predetermined amount of time of serving the anti-replay connection after reaching the re-key threshold value and before reaching the first value, wherein the predetermined amount of time is at least ten seconds.
6. The method of claim 1 , further comprising:
receiving an indication that the second network processor has transmitted a message for the anti-replay connection having an SN greater than or equal to the re-key threshold value;
in response to receiving the indication that the second network processor has transmitted the message for the anti-replay connection having the SN greater than or equal to the re-key threshold value, effecting re-keying of the anti-replay connection with at least one downstream device.
7. The method of claim 1 , wherein at least one of the network device and a downstream device at an opposite end of the anti-replay connection is a host device.
8. A network device for performing switchover of an anti-replay connection, the network device comprising:
a control plane processor configured to receive an ownership indication that a first network processor is currently serving the anti-replay connection, and, in response to receiving the ownership indication, effect a presetting in a second network processor of a current sequence number (SN) for the anti-replay connection to a first value that is greater than or equal to a re-key threshold value, wherein the re-key threshold value is a value beyond which an SN triggers re-keying of the anti-replay connection, and the second network processor utilizes the current SN upon beginning to serve the anti-replay connection; and
at least one of the first network processor and the second network processor.
9. The network device of claim 8 , wherein the second network processor is part of a different network device from the network device and, in effecting a presetting in the second network processor of the current SN, the control plane processor is configured to communicate with the different network device via a control link to indicate that SN presetting is to be performed.
10. The network device of claim 8 , wherein the control plane processor is configured to receive a further ownership indication that the second network processor is currently serving the anti-replay connection, and in response to receiving the further ownership indication, effect a presetting in a third network processor of a current SN for the anti-replay connection to a second value that is greater than the first value.
11. The network device of claim 10 , wherein a difference between the re-key threshold value and the first value is the same as a difference between the first value and the second value.
12. The network device of claim 8 , wherein the difference between the re-key threshold value and the first value is selected to provide the first network processor with a predetermined amount of time of serving the anti-replay connection after reaching the re-key threshold value and before reaching the first value, and the predetermined amount of time is at least ten seconds.
13. The network device of claim 8 , wherein the control plane processor is configured to receive an indication that the second network processor has transmitted a message for the anti-replay connection having an SN greater than or equal to the re-key threshold value, and in response to receiving the indication that the second network processor has transmitted the message for the anti-replay connection having the SN greater than or equal to the re-key threshold value, effect re-keying of the anti-replay connection with at least one downstream device.
14. A non-transitory machine-readable storage medium encoded with instructions for execution by a network device for performing switchover of an anti-replay connection, the non-transitory machine-readable storage medium comprising:
instructions for receiving, at the network device, an ownership indication that a first network processor is currently serving the anti-replay connection; and
instructions for, in response to receiving the ownership indication, effecting a presetting in a second network processor of a current sequence number (SN) for the anti-replay connection to a first value that is greater than or equal to a re-key threshold value, wherein the network device comprises at least one of the first network processor and the second network processor, the re-key threshold value is a value beyond which an SN triggers re-keying of the anti-replay connection, and the second network processor utilizes the current SN upon beginning to serve the anti-replay connection.
15. The non-transitory machine-readable storage medium of claim 14 , wherein the second network processor is part of a different network device from the network device and the instructions for effecting the presetting in the second network processor of the current sequence number (SN) comprise:
instructions for communicating with the different network device via a control link to indicate that SN presetting is to be performed.
16. The non-transitory machine-readable storage medium of claim 14 , further comprising:
instructions for receiving a further ownership indication that the second network processor is currently serving the anti-replay connection; and
instructions for, in response to receiving the further ownership indication, effecting a presetting in a third network processor of the current sequence number (SN) for the anti-replay connection to a second value that is greater than the first value.
17. The non-transitory machine-readable storage medium of claim 16 , wherein a difference between the re-key threshold value and the first value is the same as a difference between the first value and the second value.
18. The non-transitory machine-readable storage medium of claim 14 , wherein the difference between the re-key threshold value and the first value is selected to provide the first network processor with a predetermined amount of time of serving the anti-replay connection after reaching the re-key threshold value and before reaching the first value, and the predetermined amount of time is at least ten seconds.
19. The non-transitory machine-readable storage medium of claim 14 , further comprising:
instructions for receiving an indication that the second network processor has transmitted a message for the anti-replay connection having an SN greater than or equal to the re-key threshold value;
instructions for, in response to receiving the indication that the second network processor has transmitted the message for the anti-replay connection having the SN greater than or equal to the re-key threshold value, effecting re-keying of the anti-replay connection with at least one downstream device.
20. The non-transitory machine-readable storage medium of claim 14 , wherein at least one of the network device and a downstream device at an opposite end of the anti-replay connection is a host device.