Executing multiple virtual private network (VPN) endpoints associated with an endpoint pool address

A method, comprising:

• receiving a first set of data packets that (a) is addressed to a particular address and (b) corresponds to a first Virtual Private Network (VPN) session assigned to a first VPN endpoint of a plurality of VPN endpoints associated with the particular address;
• directing the first set of data packets to the first VPN endpoint based on a first assignment of the first VPN session to the first VPN endpoint, the first VPN endpoint decapsulating the first set of data packets;
• determining that a session transfer criterion is satisfied;
• responsive to detecting that the session transfer criterion is satisfied, re-assigning the first VPN session to obtain a second assignment of the first VPN session to a second VPN endpoint of the plurality of VPN endpoints associated with the particular address;
• receiving a second set of data packets that (a) is addressed to the particular address and (b) corresponds to the first VPN session;
• directing the second set of data packets to the second VPN endpoint based on the second assignment of the first VPN session to the second VPN endpoint, the second VPN endpoint decapsulating the second set of data packets;
• receiving a third set of data packets that (a) is addressed to the particular address and (b) does not correspond to any existing VPN session;
• determining a third assignment of a new VPN session associated with the third set of data packets to a third VPN endpoint of the plurality of VPN endpoints associated with the particular address;
• directing the third set of data packets to the third VPN endpoint based on the third assignment of the new VPN session to the third VPN endpoint;
• wherein the method is performed by at least one device including a hardware processor.

A system, comprising:

• at least one device including a hardware processor;
• and
• the system being configured to perform operations comprising:
• receiving a first set of data packets that (a) is addressed to a particular address and (b) corresponds to a first Virtual Private Network (VPN) session assigned to a first VPN endpoint of a plurality of VPN endpoints associated with the particular address;
• directing the first set of data packets to the first VPN endpoint based on a first assignment of the first VPN session to the first VPN endpoint, the first VPN endpoint decapsulating the first set of data packets;
• determining that a session transfer criterion is satisfied;
• responsive to detecting that the session transfer criterion is satisfied, re-assigning the first VPN session to obtain a second assignment of the first VPN session to a second VPN endpoint of the plurality of VPN endpoints associated with the particular address;
• receiving a second set of data packets that (a) is addressed to the particular address and (b) corresponds to the first VPN session;
• directing the second set of data packets to the second VPN endpoint based on the second assignment of the first VPN session to the second VPN endpoint, the second VPN endpoint decapsulating the second set of data packets;
• receiving a third set of data packets that (a) is addressed to the particular address and (b) does not correspond to any existing VPN session;
• determining a third assignment of a new VPN session associated with the third set of data packets to a third VPN endpoint of the plurality of VPN endpoints associated with the particular address;
• directing the third set of data packets to the third VPN endpoint based on the third assignment of the new VPN session to the third VPN endpoint.

A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, cause performance of operations comprising:

• receiving a first set of data packets that (a) is addressed to a particular address and (b) corresponds to a first Virtual Private Network (VPN) session assigned to a first VPN endpoint of a plurality of VPN endpoints associated with the particular address;
• directing the first set of data packets to the first VPN endpoint based on a first assignment of the first VPN session to the first VPN endpoint, the first VPN endpoint decapsulating the first set of data packets;
• determining that a session transfer criterion is satisfied;
• responsive to detecting that the session transfer criterion is satisfied, re-assigning the first VPN session to obtain a second assignment of the first VPN session to a second VPN endpoint of the plurality of VPN endpoints associated with the particular address;
• wherein re-assigning the first VPN session to obtain the second assignment of the first VPN session to the second VPN endpoint of the plurality of VPN endpoints associated with the particular address comprises:
• removing storage of a first association between the first VPN endpoint and a session identifier of the first VPN session;
• storing a second association between the second VPN endpoint and the session identifier of the first VPN session;
• receiving a second set of data packets that (a) is addressed to the particular address and (b) corresponds to the first VPN session;
• directing the second set of data packets to the second VPN endpoint based on the second assignment of the first VPN session to the second VPN endpoint, the second VPN endpoint decapsulating the second set of data packets.