Virtual private network dead peer detection
AssigneeDell Software Inc.
InventorsZhong Chen, Aravind Thangavelu, Dong Xiang, Yanjun Yang
Life of this patent
Estimating the term…
Abstract
Methods and systems are provided for detecting dead tunnels associated with a VPN. An indicator of a tunnel capability, for example, a DPD vendor ID, is received from a peer through a VPN connection. The tunnel capability is associated with one or more phase II tunnels associated with the VPN. Traffic generated by the peer is detected, and if traffic is detected at a tunnel, the tunnel is presumed to be alive. When no traffic is detected in a tunnel, a DPD packet exchange with the tunnel is initiated. A determination is made, based on the packet exchange, whether the tunnel is alive.
Claims20
A method for managing internet protocol (IP) tunnels, the method comprising:
- sending a request from a first server to establish a virtual private network (VPN) connection over a communication network to a second server;
- exchanging information between the first server and the second server according to an internet key exchange protocol;
- identifying that the second server supports a phase II tunnel within the VPN connection;
- exchanging one or more data packets between the first server and the second server over the phase II tunnel;
- identifying that a packet of the one or more packets has failed;
- and
- identifying that the phase II tunnel is dead based on identifying the failed packet.
A non-transitory computer readable storage medium having embodied thereon a program executable by a processor for performing a method for managing internet protocol (IP) tunnels, the method comprising:
- sending a request to establish a virtual private network (VPN) connection;
- exchanging information with a server according to an internet key exchange protocol;
- identifying that the server supports a phase II tunnel within the VPN connection;
- exchanging one or more data packets with the server over the phase II tunnel;
- identifying that a packet of the one or more packets has failed;
- and
- identifying that the phase II tunnel is dead based on identifying the failed packet.
An apparatus for managing internet protocol (IP) tunnels, the apparatus comprising:
- a network communication interface that:
- sends a request to establish a virtual private network (VPN) connection with a server;
- exchanges information regarding the VPN connection;
- a memory;
- and
- a processor, wherein the processor executing instructions out of the memory:
- identifies the server supports a phase II tunnel within the VPN connection, wherein one or more data packets are exchanged with the server over the phase II tunnel,
- identifies that a packet of the one or more packets has failed, and
- identifies that the phase II tunnel is dead based on identifying the failed packet.
Dependencies are inferred from the claim text.