Performance improvement of IPSEC traffic using SA-groups and mixed-mode SAS
Some embodiments provide a method of load balancing data message flows across multiple secure connections. The method receives a data message having source and destination addresses formatted according to a first protocol. Based on the source and destination addresses, the method selects one of the multiple secure connections for the data message. Each of the secure connections handles a first set of connections formatted according to the first protocol and a second set of connections formatted according to a second protocol that is an alternative to the first protocol. The method securely encapsulates the data message and forwards the encapsulated data message onto a network. The encapsulation includes an identifier for the selected secure connection.
1 . A method comprising:
receiving a data message, the data message being associated with a first protocol and comprising an identifier;
determining a hash value based at least on the identifier;
performing a load balancing operation using at least the hash value to select a mixed-mode security association (SA), the mixed-mode SA being configured to operate according to the first protocol and a second protocol; and
encapsulating the data message using according to a network address format of the first protocol by the mixed-mode SA.
2 . The method of claim 1 , wherein the hash value is calculated using a five-tuple identifier associated with the data message.
3 . The method of claim 1 , wherein the first protocol comprises an IPv4 (Internet Protocol version 4) protocol or an IPv6 (version 6).
4 . The method of claim 1 , wherein the identifier comprises a security parameter index (SPI).
5 . The method of claim 1 , wherein further comprising identifying a plurality of mixed-mode SAs.
6 . The method of claim 1 , wherein the load balancing operation uses a set of attributes associated with the data message.
7 . The method of claim 1 , further comprising enabling the mixed-mode SA to be usable for encrypting data flows using the first protocol.
8 . The method of claim 1 , further comprising encrypting the data message according to the first protocol by the mixed-mode SA.
9 . The method of claim 1 , further comprising forwarding the encapsulated data message flow to a destination.
10 . The method of claim 1 , wherein the encapsulated data message comprises an outer destination address of a gateway device that assigns a processing core based at least on the mixed-mode SA.
11 . A non-transitory machine readable medium storing a program for execution by a set of processing units, the program comprising sets of instructions for:
receiving a data message, the data message being associated with a first protocol and comprising an identifier;
determining a hash value based at least on the identifier;
performing a load balancing operation using at least the hash value to select a mixed-mode security association (SA), the mixed-mode SA being configured to operate according to the first protocol and a second protocol; and
encapsulating the data message using according to a network address format of the first protocol by the mixed-mode SA.
12 . The non-transitory machine readable medium of claim 11 , wherein the hash value is calculated using a five-tuple identifier associated with the data message.
13 . The non-transitory machine readable medium of claim 11 , wherein the first protocol comprises an IPv4 (Internet Protocol version 4) protocol or an IPv6 (version 6).
14 . The non-transitory machine readable medium of claim 11 , wherein the identifier comprises a security parameter index (SPI).
15 . The non-transitory machine readable medium of claim 11 , wherein further comprising identifying a plurality of mixed-mode SAs.
16 . The non-transitory machine readable medium of claim 11 , wherein the load balancing operation uses a set of attributes associated with the data message.
17 . The non-transitory machine readable medium of claim 11 , wherein the encapsulated data message comprises an outer destination address of a gateway device that assigns a processing core based at least on the mixed-mode SA.
18 . The non-transitory machine readable medium of claim 11 , wherein the program comprising sets of instructions for enabling the mixed-mode SA to be usable for encrypting data flows using the first protocol.
19 . The non-transitory machine readable medium of claim 11 , encrypting the data message according to the first protocol by the mixed-mode SA.
20 . The non-transitory machine readable medium of claim 11 , forwarding the encapsulated data message flow to a destination.