Security association and location mapping decoupling in overlay networks

A method comprising:

• sending, via a network, a first map request message from a source network device to a mapping network device to determine a mapping between a destination network device and a destination endpoint device and a security association between the source network device and the destination network device;
• receiving, at the source network device, a response message comprising data indicative of the mapping between the destination network device and the destination endpoint device, and data indicative of the security association between the source network device and the destination network device;
• storing, at the source network device, the data indicative of the mapping between the destination network device and the destination endpoint device, and the data indicative of the security association between the source network device and the destination network device;
• updating the data indicative of the mapping between the destination network device and the destination endpoint device after a first duration;
• and
• updating the data indicative of the security association between the source network device and the destination network device after a second duration different than the first duration.

An apparatus comprising:

• a memory;
• a network interface configured to transmit and receive data over a network, and a processor coupled to the network interface, wherein the processor is configured to:
• send, via the network interface, a first map request message from the apparatus to a mapping network device to determine a mapping between a destination network device and a destination endpoint device and a security association between the apparatus and the destination network device;
• receive, via the network interface, a response message comprising data indicative of the mapping between the destination network device and the destination endpoint device, and data indicative of the security association between the apparatus and the destination network device;
• store, in the memory, the data indicative of the mapping between the destination network device and the destination endpoint device, and the data indicative of the security association between the apparatus and the destination network device;
• update the data indicative of the mapping between the destination network device and the destination endpoint device after a first duration;
• and
• update the data indicative of the security association between the apparatus and the destination network device after a second duration different than the first duration.