Persistent data communication sessions across WAN
Instead of specifying actual transport layer IP addresses as a basis for a secure tunnel's security association, an approach described herein specifies virtual addresses. Then suitable network appliances intercept and modify packets in order to map between the virtual addresses and actual addresses. The virtual addresses satisfy IPsec or another authentication procedure that checks packets using the security association. The actual addresses are used by transport layer protocols. This overlay approach permits a session to failover from one network connection to another without requiring restoration of the session in a newly created secure tunnel after one of the network interfaces becomes unavailable, thereby obsoleting the security association based in part on the IP address of the now unavailable interface. This innovative approach also allows the use of parallel paths and the use of one-to-many or many-to-one path topologies, which would otherwise not be permitted.
1. A secure networking process comprising:
establishing a virtual private network (VPN) tunnel which has a security association which is specified with at least a source virtual IP address that is not an actual wide area network (WAN) interface address and which is also specified with at least a destination virtual IP address that is not an actual WAN interface address;
intercepting an outgoing packet that is directed from a source endpoint of the VPN tunnel toward a destination endpoint of the VPN tunnel;
modifying the outgoing packet by replacing an instance of the source virtual IP address in the outgoing packet with an actual address that is the IP address of an outgoing WAN interface at a local site, and modifying the outgoing packet by replacing an instance of the destination virtual IP address in the outgoing packet with an actual address that is the IP address of an incoming WAN interface at a remote site; and then
transmitting the modified outgoing packet through the outgoing WAN interface at the local site toward the incoming WAN interface at the remote site.
2. The process of claim 1 , further comprising:
intercepting the modified outgoing packet after it has reached the incoming WAN interface at the remote site;
modifying the intercepted packet by replacing the actual address of the incoming WAN interface with the destination virtual IP address and by replacing the actual address of the outgoing WAN interface with the source virtual IP address; and then
submitting the modified intercepted packet for an authentication that is based on the security association.
3. The process of claim 2 , wherein the submitting step submits the modified intercepted packet for an IPsec authentication.
4. The process of claim 2 , wherein the process maps the security association to pairs of actual WAN interface addresses that define at least two parallel paths between the local site and the remote site.
5. The process of claim 2 , wherein the process maps the security association to actual WAN interface addresses that define at least two paths between the local site and the remote site that share the same WAN interface at one site and do not share any WAN interface at the other site.
6. The process of claim 1 , further comprising a remote appliance at the remote site and a local appliance at the local site authenticating to one another before the local appliance performs the packet intercepting, packet modifying, and packet transmitting steps.
7. The process of claim 1 , further comprising a remote appliance at the remote site failing to authenticate itself to a local appliance at the local site, and then the local appliance terminating the VPN tunnel in response to the authentication failure.
8. The process of claim 1 , further comprising a local appliance at the local site performing at least one of the following to get the actual address that is the IP address of the outgoing WAN interface at the local site: load balancing or failing over.
9. The process of claim 1 , further comprising a local appliance at the local site participating in a multi-phase auto-configuration by executing at least a portion of an auto-configuration program.
10. A secure networking process comprising:
establishing a virtual private network (VPN) tunnel which has a security association which is specified with at least a source virtual IP address that is not an actual wide area network (WAN) interface address and which is also specified with at least a destination virtual IP address that is not an actual WAN interface address;
intercepting an outgoing packet that is directed from a source endpoint of the VPN tunnel toward a destination endpoint of the VPN tunnel;
performing at least one of the following to get an actual address that is an IP address of an outgoing WAN interface at a local site: load balancing, failing over, or another routing optimization;
modifying the outgoing packet by replacing an instance of the source virtual IP address in the outgoing packet with the actual address that is the IP address of the outgoing WAN interface at the local site, and modifying the outgoing packet by replacing an instance of the destination virtual IP address in the outgoing packet with an actual address that is the IP address of an incoming WAN interface at a remote site;
transmitting the modified outgoing packet through the outgoing WAN interface at the local site toward the incoming WAN interface at the remote site;
intercepting the modified outgoing packet after it has reached the incoming WAN interface at the remote site;
modifying the intercepted packet by replacing the actual address of the incoming WAN interface with the destination virtual IP address and by replacing the actual address of the outgoing WAN interface with the source virtual IP address; and
submitting the modified intercepted packet for an IPsec authentication that is based on the security association.
11. The process of claim 10 , wherein the process maps the security association to pairs of actual WAN interface addresses that define at least two parallel paths between the local site and the remote site.
12. The process of claim 10 , wherein the process maps the security association to actual WAN interface addresses that define at least two paths between the local site and the remote site that share the same WAN interface at one site and do not share any WAN interface at the other site.
13. The process of claim 10 , further comprising a remote appliance at the remote site and a local appliance at the local site authenticating to one another before the local appliance performs the packet intercepting, packet modifying, and packet transmitting steps.
14. The process of claim 10 , further comprising a remote appliance at the remote site failing to authenticate itself to a local appliance at the local site, and then the local appliance terminating the VPN tunnel in response to the authentication failure.
15. The process of claim 10 , further comprising a local appliance at the local site participating in a multi-phase auto-configuration by executing at least a portion of an auto-configuration program.
16. A network appliance comprising:
at least one wide area network (WAN) interface having an actual IP address, namely, an IP address which has been statically or dynamically assigned and has been or will be advertised across a network connection;
at least one local area network (LAN) interface;
a processor;
a memory in operable communication with the processor;
an overlay code residing in the memory which upon execution by the processor performs a secure networking process which intercepts a packet received at the LAN interface, maps two security associated addresses in the packet to actual addresses, one of the actual addresses being the WAN interface actual IP address, and modifies the packet to include the WAN interface actual IP address in place of a source address which is one of the security associated addresses in the packet; and
a transmitter code which transmits the modified packet out the WAN interface.
17. The network appliance of claim 16 , denoted here as a first network appliance, in combination with a second network appliance, the second network appliance comprising:
at least one WAN interface having an actual IP address;
at least one LAN interface;
a virtual private network (VPN) authentication module;
a processor;
a memory in operable communication with the processor;
an overlay code residing in the memory which upon execution by the processor performs a secure networking process which intercepts the modified packet after it is received at the second network appliance's WAN interface, maps actual addresses in the packet back to the security associated addresses using a table in the memory, thereby restoring the security associated addresses in the packet, and submits the packet with restored security associated addresses to the VPN authentication module for authentication prior to transmittal of the packet to the LAN interface.
18. The network appliance of claim 17 , wherein the table maps the security associated addresses to network connections between the first network appliance and the second network appliance, and the connections are parallel and do not share any WAN interface with one another.
19. The network appliance of claim 17 , wherein the table maps the security associated addresses to network connections between the first network appliance and the second network appliance, and the connections are not parallel and share at least one WAN interface with one another.
20. The network appliance of claim 16 , further comprising at least one of the following:
code which authenticates the network appliance to another network appliance;
code which terminates a tunnel connecting to the network appliance in response to another network appliance failing to authenticate to the network appliance; or
code which auto-configures the network appliance.