Per session link load balancing of IPSec tunnels over multiple uplinks to same IPSec gateway
AssigneeFortinet, Inc.
InventorKun Yu
Life of this patent
Estimating the term…
Abstract
A first data packet can be forwarded to a virtual SDWAN interface which has multiple IPSec tunnels as members, each of which is disposed over a different uplink, wherein the multiple IPSec tunnels each connect to the remote SDWAN controller. Load balancing of the particular session is performed relative to other sessions by selecting one of the multiple uplinks for transmission to the remote SDWAN controller. Phase 2 of IPSec is set up for the particular session by updating an IPSec phase 2 table with the selected uplink associated with the particular session, to direct subsequent packets of the same session.
Claims11
A method in a local Software-Defined Wide Area Network (SDWAN) controller for load balancing on a data communication network, on a per-session basis, between multiple uplinks for Internet Protocol Security (IPSec) tunnels to a remote SDWAN controller with a dynamic selector, the method comprising:
- receiving a first data packet from a particular session of a client as a source, having a destination behind the remote SDWAN controller;
- forwarding the first data packet to a virtual SDWAN interface which has multiple IPSec tunnels as members, each of which is disposed over a different uplink, wherein the multiple IPSec tunnels each connect to the remote SDWAN controller;
- performing load balancing of the particular session relative to other sessions by selecting one of the multiple uplinks for transmission to the remote SDWAN controller, including receiving network conditions concerning the multiple uplinks;
- setting up phase 2 of IPSec for the particular session by updating an IPSec phase 2 table with the selected uplink associated with the particular session, including initiating authentication of the local SDWAN server with the remote SDWAN server;
- and
- responsive to receiving subsequent data packets of the particular session, referring to the IPSec phase 2 table and forwarding the subsequent data packets of the particular session to the selected IPSec tunnel.
A non-transitory computer-readable medium in a local Software-Defined Wide Area Network (SDWAN) SDWAN controller storing instructions that, when executed by a processor, perform a computer-implemented method for load balancing on a data communication network, on a per-session basis, between multiple uplinks for Internet Protocol Security (IPSec) IPSec tunnels to a remote SDWAN controller with a dynamic selector, the method comprising:
- receiving a first data packet from a particular session of a client as a source, having a destination behind the remote SDWAN controller;
- forwarding the first data packet to a virtual SDWAN interface which has multiple IPSec tunnels as members, each of which is disposed over a different uplink, wherein the multiple IPSec tunnels each connect to the remote SDWAN controller;
- performing load balancing of the particular session relative to other sessions by selecting one of the multiple uplinks for transmission to the remote SDWAN controller, including receiving network conditions concerning the multiple uplinks;
- setting up phase 2 of IPSec for the particular session by updating an IPSec phase 2 table with the selected uplink associated with the particular session, including initiating authentication of the local SDWAN server with the remote SDWAN server;
- and
- responsive to receiving subsequent data packets of the particular session, referring to the IPSec phase 2 table and forwarding the subsequent data packets of the particular session to the selected IPSec tunnel threshold.
A local Software-Defined Wide Area Network (SDWAN) SDWAN controller to load balancing on a data communication network, on a per-session basis, between multiple uplinks for Internet Protocol Security (IPSec) IPSec tunnels to a remote SDWAN controller with a dynamic selector, the local SDWAN controller comprising:
- a processor;
- a network interface communicatively coupled to the processor and to the hybrid wireless network;
- and
- a memory, communicatively coupled to the processor and storing:
- a load balancing controller to receive a first data packet from a particular session of a client as a source, having a destination behind the remote SDWAN controller;
- an uplink interface having multiple IPSec tunnels as members, each of which is disposed over a different uplink, wherein the multiple IPSec tunnels each connect to the remote SDWAN controller;
- an uplink selector to perform load balancing of the particular session relative to other sessions by selecting one of the multiple uplinks for transmission to the remote SDWAN controller, including receiving network conditions concerning the multiple uplinks;
- wherein the uplink selector sets up phase 2 of IPSec for the particular session by updating an IPSec phase 2 table with the selected uplink associated with the particular session, including initiating authentication of the local SDWAN server with the remote SDWAN server;
- wherein responsive to receiving subsequent data packets of the particular session, the load balancing controller refers to the IPSec phase 2 table and forwarding the subsequent data packets of the particular session to the selected IPSec tunnel at the uplink interface.
Dependencies are inferred from the claim text.