Efficient encryption and decryption of duplicate packets communicated via a virtual private network

A network device, comprising:

• one or more memories;
• and
• one or more processors to:
• receive a decryption key for packet decryption associated with a virtual private network (VPN), wherein the decryption key is associated with an encryption key that is used by a plurality of network devices of the VPN for packet encryption;
• receive, from a transmitting network device, a packet via a tunnel, of a plurality of tunnels between the network device and the transmitting network device, wherein the packet includes a first outer internet protocol (IP) header, a Generic Routing Encapsulation (GRE) header, a second outer IP header, an Encapsulating Security Payload (ESP) header associated with an encryption of an inner packet of the packet, and the inner packet, wherein the inner packet is encapsulated by the ESP header, the ESP header is encapsulated by the second outer IP header, the second outer IP header is encapsulated by the GRE header, and the GRE header is encapsulated by the first outer IP header;
• decapsulate the packet to remove the first outer IP header and the GRE header from the packet to identify:
• an ESP timestamp associated with the ESP header, and
• a virtual source address of a virtual tunnel endpoint of the tunnel at the transmitting network device;
• decrypt the packet to identify the inner packet;
• and
• perform, based on the ESP timestamp, an action associated with the inner packet.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors of a network device, cause the one or more processors to:
• receive an encryption key for packet encryption associated with a virtual private network (VPN), wherein the encryption key is associated with a decryption key that is used by a plurality of network devices of the VPN for packet decryption;
• encrypt, using the key, a packet to create an encrypted packet, wherein the encrypted packet includes an outer internet protocol (IP) header that includes a virtual source address that identifies a virtual tunnel endpoint of the network device and a first virtual destination address that identifies a virtual tunnel endpoint of a first receiving network device;
• duplicate the encrypted packet to create a plurality of encrypted packets that includes a first set of encrypted packets that is associated with the first receiving network device and a second set of encrypted packets that is to be associated with a second receiving network device;
• modify the second set of encrypted packets by replacing the first virtual destination address in the second set of the plurality of encrypted packets with a second virtual destination address that identifies a virtual tunnel endpoint of the second receiving network device;
• encapsulate, based on a tunneling protocol, the first set of encrypted packets and the second set of encrypted packets to create a plurality of encapsulated encrypted packets;
• and
• send, based on the first virtual destination address and the second virtual destination address, individual encapsulated encrypted packets of the plurality of encapsulated encrypted packets to the first receiving network device or the second receiving network device.