Abstract: A method, system, and program product are provided. A plurality of recovery groups is defined on each transmission control protocol/internet protocol (TCP/IP) stack in a cluster of servers. The recovery group includes a service, one or more IP addresses associated with the service, a trigger condition, and a recovery action. Each of the recovery groups is monitored for an occurrence of the trigger condition associated with the service. In response to detecting the trigger condition, a backup TCP/IP stack is notified to automatically perform the recovery action defined for a failing recovery group on an owning TCP/IP stack. Only the failing recovery group is recovered and the remaining recovery groups execute uninterrupted.

Abstract: A method, system, and program product are provided. A plurality of recovery groups is defined on each transmission control protocol/internet protocol (TCP/IP) stack in a cluster of servers. The recovery group includes a service, one or more IP addresses associated with the service, a trigger condition, and a recovery action. Each of the recovery groups is monitored for an occurrence of the trigger condition associated with the service. In response to detecting the trigger condition, a backup TCP/IP stack is notified to automatically perform the recovery action defined for a failing recovery group on an owning TCP/IP stack. Only the failing recovery group is recovered and the remaining recovery groups execute uninterrupted.

Abstract: Preventing duplicate sources in a network that uses network address port translation on an established connection. In response to receiving an inbound packet at a destination host, input values are obtained therefrom and used to consult a mapping. If no match is found, a translation is performed, whereby a determination is made as to whether or not a port number is available within a range of port numbers that comply with a security association governing the connection. If so, an available port number is assigned to the connection, thereby avoiding a possibility of a duplicate source. If a port number is not available, the packet is rejected.

Abstract: Preventing duplicate sources on a protocol connection that uses network addresses, protocols and port numbers to identify connections that include port number translation. In response to an inbound IPsec packet from a remote source client, a determination is made as to whether or not a port number is available within a range of port numbers that comply with a security association governing the connection. If so, an available port number is assigned to the connection, thereby avoiding a possibility of a duplicate source. If a port number is not available, the packet is rejected.

Abstract: Preventing duplicate sources on a protocol connection that uses network addresses, protocols and port numbers to identify connections that include port number translation. In response to an inbound IPsec packet from a remote source client, a determination is made as to whether or not a port number is available within a range of port numbers that comply with a security association governing the connection. If so, an available port number is assigned to the connection, thereby avoiding a possibility of a duplicate source. If a port number is not available, the packet is rejected.

Abstract: The invention determines if a security association (SA) extends end-to-end between a source node originating a connection and a destination node. In such a case, there will be no ambiguities in routing due to network address translation, and the SA is allowed. In the preferred embodiment, both end nodes of a security connection test themselves and the remote node for gateway status to determine if any ambiguities might exist in network routing due to the presence of a network address translator.

Abstract: Preventing duplicate sources on a protocol connection that uses network addresses, protocols and port numbers to identify source applications that are served by a NAPT. If an arriving packet encapsulates an encrypted packet and has passed through an NAPT en route to the destination host, the encapsulated packet is decrypted to obtain an original source port number and original packet protocol from the decrypted packet. A source port mapping table (SPMT) is searched for an association between the NAPT source address, the original source port, and the original packet protocol associated with the NAPT source address and port number. If an incorrect association is found, the packet is rejected as representing an illegal duplicate source; that is, a second packet from a different host served by a NAPT that is USING the same SOURCE port and protocol.