Back to results
US 2010/0306572 A1Published application
Apparatus and method to facilitate high availability in secure network transport
OwnerAlexandro Salvarani, Tiberiu Grigoriuinventors
Life of this patent
Estimating the term…
Abstract
Embodiments described herein are effective to detect, repair and recover automatically IPSec tunnels due to failures of transport gear (L2/L3 switches) as well as the IPsec gateway components. Load balance is also an integral part of the approach. When a failure is repaired, the architecture in various embodiments will re-establish load balance and high availability automatically at L2 and L3 and preserve security during the switch-over and recovery process.
Claims12
A method to facilitate high availability in secure network transport comprising:
- sending initial uplink traffic from a network node to a first security gateway via a first IPsec tunnel;
- monitoring the first IPsec tunnel between the network node and the first security gateway;
- monitoring an alternate IPsec tunnel between the network node and a second security gateway;
- detecting a failure of the first IPsec tunnel;
- performing, in response to detecting the failure, a route update;
- routing subsequent uplink traffic to the second security gateway via the alternate IPsec tunnel;
- detecting a reestablished IPsec tunnel between the first security gateway and the network node;
- performing, in response to detecting the reestablished IPsec tunnel, a route update;
- sending additional uplink traffic to the first security gateway via the reestablished IPsec tunnel.
6 more elements
A method to facilitate high availability in secure network transport comprising:
- sending initial downlink traffic from a first security gateway to a network node via a first IPsec tunnel;
- detecting a failure of the first IPsec tunnel;
- performing, in response to detecting the failure, a route update;
- routing subsequent downlink traffic for the network node to a second security gateway;
- detecting a reestablished IPsec tunnel between the first security gateway and the network node;
- performing, in response to detecting the reestablished IPsec tunnel, a route update;
- sending additional downlink traffic to the network node via the reestablished IPsec tunnel.
4 more elements
A network node comprising:
- a network interface adapted to send and receive messaging using at least one communication protocol;
- a processing unit, communicatively coupled to the network interface,
- adapted to send, via the network interface, initial uplink traffic to a first security gateway via a first IPsec tunnel,
- adapted to monitor an alternate IPsec tunnel between the network node and a second security gateway,
- adapted to detect a failure of the first IPsec tunnel,
- adapted to perform, in response to detecting the failure, a route update,
- adapted to route subsequent uplink traffic to the second security gateway via the alternate IPsec tunnel,
- adapted to detect a reestablished IPsec tunnel between the first security gateway and the network node,
- adapted to perform, in response to detecting the reestablished IPsec tunnel, a route update, and
- adapted to send, via the network interface, additional uplink traffic to the first security gateway via the reestablished IPsec tunnel.
7 more elements
A security gateway comprising:
- a network interface adapted to send and receive messaging using at least one communication protocol;
- a processing unit, communicatively coupled to the network interface,
- adapted to send, via the network interface, initial downlink traffic to a network node via a first IPsec tunnel,
- adapted to detect a failure of the first IPsec tunnel,
- adapted to perform, in response to detecting the failure, a route update,
- adapted to route subsequent downlink traffic for the network node to a second security gateway,
- adapted to detect a reestablished IPsec tunnel between the security gateway and the network node,
- adapted to perform, in response to detecting the reestablished IPsec tunnel, a route update, and
- adapted to send, via the network interface, additional downlink traffic to the network node via the reestablished IPsec tunnel.
6 more elements
Dependencies are inferred from the claim text.