# US 8,572,721 B2 · Methods and systems for routing packets in a VPN-client-to-VPN-client connection via an SSL/VPN network appliance > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,572,721 B2 - Document ID: US8572721B2 - Status: Granted - Kind: B2 - Application number: 11/462,174 - Filed: 2006-08-03 - Published: 2008-02-07 - Granted: 2013-10-29 - Earliest claimed: 2006-08-03 - Assignees: Citrix Systems, Inc. - Applicants: Arkesh Kumar; James Harris; Ajay Soni - Inventors: Arkesh Kumar; James Harris; Ajay Soni - Web page: https://patentgrep.com/patent/US8572721B2 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In a method and system for routing packets between clients, a packet is received from a first client connected to a secure sockets layer virtual private network (an SSL/VPN) network appliance. An identification is made, responsive to an inspection of the received packet, of i) a type of connection required for transmission of the received packet to a destination address identified by the received packet and ii) a second client connected via an SSL/VPN connection to the SSL/VPN network appliance and associated with the identified destination address. A request is made for establishment by the second client of a connection of the identified type within the SSL/VPN connection. The received packet is transmitted to the second client via the established connection of the identified type. ## Claims ### Claim 1 A method for routing packets between clients, the method comprising: (a) receiving, by a device intermediary to a plurality of clients each connected to the device via a secure sockets layer virtual private network (SSL VPN) connection, a packet from a first client agent of a first client via a first SSL VPN connection with the device; (b) identifying, by the device responsive to an inspection of the received packet, i) a type of transport layer connection required for transmission of the received packet to a destination address identified by the received packet and ii) a second client connected via a second SSL VPN connection to the device and associated with the identified destination address; and (c) requesting establishment, by a second client agent executing on the second client, of the transport layer connection of the identified type within the second SSL VPN connection, the second client agent establishing a transport layer connection with a second application executing on the second client; and (d) transmitting, by the device, the received packet to the second client via the established transport layer connection of the identified type, the received packet forwarded to the second application executing on the second client via the transport layer connection established between the second application and the second client agent. ### Claim 2 (depends on 1) The method of claim 1, wherein step (a) further comprises receiving, by the device, the packet via a first transport layer connection within the first SSL VPN connection. ### Claim 3 (depends on 1) The method of claim 1, wherein step (b) further comprises inspecting, by the device, the received packet. ### Claim 4 (depends on 1) The method of claim 1, wherein step (b) further comprises identifying, responsive to the inspection of the received packet, a type of transport layer connection comprising a TCP connection. ### Claim 5 (depends on 1) The method of claim 1, wherein step (b) further comprises identifying, responsive to the inspection of the received packet, a type of transport layer connection comprising a UDP connection. ### Claim 6 (depends on 1) The method of claim 1, wherein step (c) further comprises requesting, by the device, establishment by the second client of a transport layer connection of the identified type. ### Claim 7 (depends on 1) The method of claim 1, wherein step (c) comprises requesting establishment by the second client of a transport layer connection of the identified type between the second client and the device. ### Claim 8 (depends on 1) The method of claim 1, wherein step (c) further comprises establishing, by the second client, a transport layer connection of the identified type. ### Claim 9 A device for routing packets between clients each connected to the device via a secure sockets layer virtual private network (SSL VPN) connection, comprising i. a receiver receiving a packet from a first client agent of a first client over a first SSL VPN connection with the device, ii. a packet inspector identifying, responsive to an inspection of the received packet, 1)a type of transport layer connection required for transmission of the received packet to a destination address identified by the received packet and 2) a second client connected via a second SSL VPN connection to the device and associated with the identified destination address, and iii. a transceiver receiving a request from a second client agent executing on the second client for establishment of a transport layer connection of the identified type and transmitting the received packet to the second client over the requested transport layer connection, the second client agent establishing a transport layer connection with an application executing on the second client and forwarding the received packet to the application. ### Claim 10 A system for routing packets between clients, the system comprising: a first client of a plurality of clients, transmitting a packet; a second client of the plurality of clients; and a device intermediary to the plurality of clients and connected to each client via a secure sockets layer virtual private network (SSL VPN) connection, the device comprising i. a receiver receiving the packet from a first client agent of the first client over a first SSL VPN connection, ii. a packet inspector identifying, responsive to an inspection of the received packet, 1) a type of transport layer connection required for transmission of the received packet to a destination address identified by the received packet and 2) the second client, the second client connected via a second SSL VPN connection to the device and associated with the identified destination address, and iii. a transceiver receiving a request from a second client agent executing on the second client for establishment by the second client of a transport layer connection of the identified type and transmitting the received packet to the second client over the requested transport layer connection, the second client agent establishing a transport layer connection with an application executing on the second client and forwarding the received packet to the application. ### Claim 11 (depends on 10) The system of claim 10, wherein the first client establishes the first SSL VPN connection to the device. ### Claim 12 (depends on 10) The system of claim 10, wherein the first client transmits the packet to the device over the first SSL VPN connection. ### Claim 13 (depends on 10) The system of claim 10, wherein the second client agent establishes a transport layer connection via an SSL VPN connection to the device. ### Claim 14 (depends on 10) The system of claim 10, wherein the second client further comprises an association with the destination address identified by the received packet. ### Claim 15 (depends on 10) The system of claim 10, wherein the second client agent establishes a transport layer connection of the identified type between the second client and the device. ### Claim 16 (depends on 10) The system of claim 10, wherein the second client agent establishes a transport layer connection of the identified type within an SSL VPN connection to the device. ### Claim 17 A method for routing packets between clients, the method comprising: (a) establishing, by a first client from a first network, a first secure sockets layer virtual private network (SSL VPN) connection to a second network via a device, the device intermediary to a plurality of clients each connected to the device via a SSL VPN connection; (b) establishing, by a second client agent of a second client from a third network, a second SSL VPN connection to the second network via the device; (c) receiving, by the device, a request from the first client via the first SSL VPN connection to connect to the second client on the second network; (d) identifying, by the device responsive to an inspection of the received packet, i) a type of transport layer connection required for transmission of the received packet to a destination address identified by the received packet and ii) the second client on the second network associated with the identified destination address; (e) requesting establishment, by a second client agent executing on the second client, of the transport layer connection of the identified type via the second SSL VPN connection, the second client agent establishing a transport layer connection with a second application executing on the second client; and (f) transmitting, by the device, the received packet to the second client via the established transport layer connection of the identified type, the received packet forwarded to the second application executing on the second client via the transport layer connection established between the second application and the second client agent.