Techniques for high availability of virtual private networks (VPN's)
Techniques for high availability of virtual private networks (VPN's) are provided. VPN gateways are organized as a virtual ring of VPN gateways. A client seeking to establish VPN communications with a destination resource is assigned one of the VPN gateways as a primary gateway and one VPN gateway as a secondary gateway. When a client's primary fails, the client seamless transitions to its designated secondary and the VPN gateways reconfigure themselves to account for the primary's failure.
1. A machine-implemented method, comprising:
receiving a request from a client to establish a virtual private network (VPN) connection;
authenticating the client;
connecting the client to a primary VPN gateway selected in a round robin fashion from a virtual ring of VPN gateways and providing connection information to the client for a secondary VPN gateway associated with the primary VPN gateway;
sending authentication information used to connect the client to the primary VPN gateway and sending the authentication information to the secondary VPN gateway, which is also part of the virtual ring, wherein the authentication information is used by the client and the secondary VPN gateway to connect to one another when the primary VPN gateway becomes unresponsive;
initializing the virtual ring of VPN gateways as a circular link list before the request is received; and
configuring each VPN gateway to act as secondary to another one of the VPN gateways that follows it in the link list, wherein a last VPN gateway in the link list uses a first VPN gateway identified in the linked list as the last VPN gateway's secondary, providing an Internet Protocol (IP) address and a Transmission Control Protocol (TCP) port of each VPN gateway to remaining ones of the VPN gateways, providing a status for each VPN gateway to the remaining ones of the VPN gateways, and making each particular secondary VPN gateway of each particular VPN gateway have a status value of current and the remaining ones of the VPN gateways have status values of unknown.
2. The method of claim 1 further comprising:
finding a third VPN gateway from the virtual ring to act as the secondary VPN gateway for the primary VPN gateway when the secondary VPN gateway becomes unresponsive;
providing additional connection information to the client for connecting to the third VPN gateway; and
sending the authentication information from the primary VPN gateway to the third VPN gateway to be used by the client and the third VPN gateway to connect to one another when the primary VPN gateway becomes unresponsive.
3. The method of claim 2 further comprising:
detecting that the secondary VPN gateway is responsive; and
re-establishing the secondary VPN gateway as being secondary to the primary VPN gateway by sending the authentication information for the connected client from the primary VPN gateway to the secondary VPN gateway.