IP Library Granted Patent US 12,665,881
Granted Patent B2
US 12,665,881 · App. 18/227,158 · Granted Jun 23, 2026

Load balancing secure network traffic

Inventors: Pankaj Bhagra (Fremont, CA); Aniket Ghule (San Jose, CA); Srinivasan Komandoor Santhanam (Sunnyvale, CA); Arivu Mani Ramasamy (San Jose, CA)
Assignee: Palo Alto Networks, Inc.
H04L63/029H04L43/062H04L63/0272H04L63/0428H04L63/164
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,665,881
App. No.
18/227,158
Granted
Jun 23, 2026
Kind
B2
Abstract

Techniques for load balancing secure network traffic are disclosed. A system, process, and/or computer program product for load balancing secure network traffic includes monitoring network traffic for each of a plurality of branches for an enterprise network, and performing load balancing for the plurality of monitored branches to a plurality of security processing nodes (SPNs) executing in a cloud-based security service using a network load balancer (NLB) in communication with a plurality of Network Processing Nodes (NPNs), the plurality of monitored branches being distributed to the plurality of SPNs via a plurality of tunnels.

Claims (42)

1 . A system, comprising:

a processor configured to:

monitor network traffic for each of a plurality of branches for an enterprise network;

split a first network traffic of one branch of the plurality of branches into a plurality of network segments, comprising:

determine that the first network traffic of the one branch exceeds traffic capacity of at least one security processing node (SPN) of a plurality of SPNs; and

in response to a determination that the first network traffic of the one branch exceeds the traffic capacity of the at least one security processing node (SPN), split a prefix associated with the one branch into a plurality of smaller prefixes, comprising:

determine that the prefix has a subnet mask of 255.255.255.255; and

in response to a determination that the prefix has the subnet mask of 255.255.255.255, omit splitting the prefix; and

perform load balancing for the plurality of monitored branches to the plurality of SPNs executing in a cloud-based security service using a network load balancer (NLB) in communication with a plurality of Network Processing Nodes (NPNs), wherein the plurality of monitored branches are distributed to the plurality of SPNs via a plurality of tunnels; and

a memory coupled to the processor and configured to provide the processor with instructions.

2 . The system of claim 1 , wherein the network traffic includes a secure networking protocol.

3 . The system of claim 2 , wherein the secure networking protocol corresponds to an IPSec Protocol.

4 . The system of claim 1 , wherein the plurality of NPNs support multi-tenant.

5 . The system of claim 1 , wherein the plurality of NPNs perform decryption to obtain tunnel contents associated with at least one tunnel of the plurality of tunnels.

6 . The system of claim 1 , wherein the plurality of NPNs are highly available.

7 . The system of claim 1 , wherein the plurality of NPNs perform traffic steering.

8 . The system of claim 1 , wherein the plurality of NPNs aggregate bandwidth from a branch.

9 . The system of claim 1 , wherein the NLB communicates with any one of the plurality of NPNs.

10 . A method, comprising:

monitoring, using a processor, network traffic for each of a plurality of branches for an enterprise network;

splitting a first network traffic of one branch of the plurality of branches into a plurality of network segments, comprising:

determining that the first network traffic of the one branch exceeds traffic capacity of at least one security processing node (SPN) of a plurality of SPNs; and

in response to a determination that the first network traffic of the one branch exceeds the traffic capacity of the at least one security processing node (SPN), splitting a prefix associated with the one branch into a plurality of smaller prefixes, comprising:

determining that the prefix has a subnet mask of 255.255.255.255; and

in response to a determination that the prefix has the subnet mask of 255.255.255.255, omitting splitting the prefix; and

performing, using the processor, load balancing for the plurality of monitored branches to the plurality of SPNs executing in a cloud-based security service using a network load balancer (NLB) in communication with a plurality of Network Processing Nodes (NPNs), wherein the plurality of monitored branches are distributed to the plurality of SPNs via a plurality of tunnels.

11 . The method of claim 10 , wherein the network traffic includes a secure networking protocol.

12 . The method of claim 11 , wherein the secure networking protocol corresponds to an IPSec Protocol.

13 . The method of claim 10 , wherein the plurality of NPNs support multi-tenant.

14 . The method of claim 10 , wherein the plurality of NPNs perform decryption to obtain tunnel contents associated with at least one tunnel of the plurality of tunnels.

15 . The method of claim 10 , wherein the plurality of NPNs are highly available.

16 . The method of claim 10 , wherein the plurality of NPNs perform traffic steering.

17 . The method of claim 10 , wherein the plurality of NPNs aggregate bandwidth from a branch.

18 . The method of claim 10 , wherein the NLB communicates with any one of the plurality of NPNs.

19 . A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:

monitoring network traffic for each of a plurality of branches for an enterprise network;

splitting a first network traffic of one branch of the plurality of branches into a plurality of network segments, comprising:

determining that the first network traffic of the one branch exceeds traffic capacity of at least one security processing node (SPN) of a plurality of SPNs; and

in response to a determination that the first network traffic of the one branch exceeds the traffic capacity of the at least one security processing node (SPN), splitting a prefix associated with the one branch into a plurality of smaller prefixes, comprising:

determining that the prefix has a subnet mask of 255.255.255.255; and

in response to a determination that the prefix has the subnet mask of 255.255.255.255, omitting splitting the prefix; and

performing load balancing for the plurality of monitored branches to the plurality of SPNs executing in a cloud-based security service using a network load balancer (NLB) in communication with a plurality of Network Processing Nodes (NPNs), wherein the plurality of monitored branches are distributed to the plurality of SPNs via a plurality of tunnels.