Method for load-balancing IPsec traffic

1. A method, comprising:

at a control module, allocating a respective range of at least one IPsec traffic parameter to each of a plurality of IPsec processing units to define thereby an allocation of IPsec traffic among the plurality of IPsec processing units, wherein the IPsec processing units are configured to use the same gateway address;

at the control module, forwarding toward a load balancer a mapping list indicative of the respective range of the at least one IPsec traffic parameter allocated to each of the plurality of IPsec processing units available to receive IPsec traffic via the load balancer; and

at the load balancer, examining incoming IPsec packets to identify therein IPsec traffic parameters, using the mapping list to determine a respective IPsec processing unit for each received IPsec packet, and forwarding each IPsec packet toward the determined respective IPsec processing unit.

2. The method of claim 1 , further comprising:

at the control module, forwarding toward each available IPsec processing unit a mapping list indicative of the respective range of the at least one IPsec traffic parameter allocated to the respective IPsec processing unit.

3. The method of claim 2 , further comprising:

at the control module, in response to receiving a new IPsec tunnel request, selecting an IPsec processing unit for supporting a requested new IPsec tunnel and forwarding the new IPsec tunnel request toward the selected IPsec processing unit.

4. The method of claim 3 , wherein the new IPsec tunnel request is configured to cause the selected IPsec processing unit to create a new IPsec tunnel using an IPsec traffic parameter within the range of IPsec traffic parameters allocated to the selected IPsec processing unit.

5. The method of claim 1 , wherein said allocation of IPsec traffic among the plurality of IPsec processing units is determined according to a random assignment allocation.

6. The method of claim 1 , wherein said allocation of IPsec traffic among the plurality of IPsec processing units is determined according to a round robin allocation.

7. The method of claim 1 , wherein said allocation of IPsec traffic among the plurality of IPsec processing units is determined according to a weighted round robin allocation.

8. The method of claim 3 , wherein said new IPsec tunnel request is received from said load balancer.

9. The method of claim 1 , wherein said control module adapts said mapping list in response to changes in a number of available IPsec processing units.

10. The method of claim 1 , wherein said control module adapts said mapping list in response to changes in type or capacity of available IPsec processing units.

11. The method of claim 1 , wherein said at least one IPsec traffic parameter includes a Security Parameter Index (SPI) associated with a received packet.

12. An apparatus, comprising:

a load balancer, for identifying at least one IPsec traffic parameter value within received IPsec client traffic and forwarding the received IPsec client traffic toward a plurality of IPsec processing units in accordance with said at least one identified IPsec parameter value, wherein each of the IPsec processing units is associated with a respective range of IPsec traffic parameter values, wherein the IPsec processing units are configured to use the same gateway address.

13. The apparatus of claim 12 , further comprising:

a control module, for allocating a respective range of IP sec traffic parameters to each of the plurality of IPsec processing units to define thereby an allocation of IPsec traffic among the plurality of IPsec processing units, and for generating a mapping list indicative of the range of IPsec traffic parameters allocated to each of the plurality of IPsec processing units available to receive IPsec traffic via the load balancer.

14. The apparatus of claim 12 , wherein said control module is configured to select an IPsec processing unit in response to a new IPsec tunnel request.

15. The apparatus of claim 12 , further comprising:

at least a portion of the plurality of IPsec processing units configured to receive IPsec client traffic from the load balancer in accordance with the mapping list.

16. The apparatus of claim 14 , wherein said apparatus comprises a gateway configured to support IPsec client traffic passing therethrough.

17. The apparatus of claim 16 , wherein said gateway includes a plurality of internal IPsec processing units and is configured to communicate with a plurality of external IPsec processing units.

18. The apparatus of claim 11 , wherein said load balancer is operatively coupled between IPsec client devices and said plurality of IPsec processing units in a network.

19. An apparatus including a processor and a memory, wherein the processor is configured for:

receiving a mapping list indicative of a respective range of at least one IPsec traffic parameter allocated to each of a plurality of IPsec processing units available to receive IPsec traffic, wherein the IPsec processing units are configured to use the same gateway address;

identifying said at least one IPsec traffic parameter value within received IPsec client traffic;

determining destination IPsec processing units using said mapping list and said at least one identified IPsec traffic parameter value; and

forwarding received IPsec client traffic toward IPsec processing units in accordance with said determination.

20. The apparatus of claim 19 , wherein the processor is further configured for adapting the mapping list in response to changes in a number of available IPsec processing units, type of available IPsec processing units, or capacity of available IPsec processing units.