Redistribution of VPN tunnels among VPN concentrators
Systems and methods are provided for redistributing virtual private network tunnels among a plurality of virtual private network concentrators. The method includes receiving, from each of the virtual private network concentrators, a respective utilization indicator; selecting a source one of the virtual private network concentrators according to the utilization indicators; selecting a destination one of the virtual private network concentrators according to the utilization indicators; selecting one of the virtual private network tunnels connected to the source one of the virtual private network concentrators; and transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators.
1. A system, comprising:
a hardware processor; and
a non-transitory machine-readable storage medium encoded with instructions executable by the hardware processor to perform a method for redistributing virtual private network tunnels among virtual private network concentrators in a cluster of the virtual private network concentrators, the method comprising:
receiving, from each of the virtual private network concentrators, a respective utilization indicator;
selecting a source one of the virtual private network concentrators according to the utilization indicators;
selecting a destination one of the virtual private network concentrators according to the utilization indicators;
receiving, from the source one of the virtual private network concentrators, a rekey time of the source one of the virtual private network concentrators;
selecting one of the virtual private network tunnels connected to the source one of the virtual private network concentrators; and
transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators according to the re-key time.
2. The system of claim 1 , wherein the selected one of the virtual private network tunnels connects the source one of the virtual private network concentrators to a virtual private network endpoint, and wherein transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators comprises:
tearing down the selected one of the virtual private network tunnels; and
sending, to the virtual private network endpoint, a network address of the destination one of the virtual private network concentrators.
3. The system of claim 1 , wherein selecting a source one of the virtual private network concentrators according to the utilization indicators comprises:
selecting the destination one of the virtual private network concentrators according to a round-robin ordering scheme of the virtual private network concentrators; and
reordering the virtual private network concentrators in the round-robin ordering scheme according to the utilization indicators.
4. The system of claim 1 , the method further comprising:
receiving, from a virtual private network tunnel endpoint, a request to create a virtual private network tunnel;
selecting one of the virtual private network concentrators according to the utilization indicators; and
sending, to the virtual private network tunnel endpoint, a network address of the selected virtual private network concentrator.
5. The system of claim 1 , the method further comprising:
receiving, from a virtual private network tunnel endpoint, a request to create a virtual private network tunnel;
selecting one of the virtual private network concentrators according to a round-robin ordering scheme; and
sending, to the virtual private network tunnel endpoint, a network address of the selected virtual private network concentrator.
6. The system of claim 1 , the method further comprising:
adding a new virtual private network concentrator to the plurality of the virtual private network concentrators.
7. A non-transitory machine-readable storage medium encoded with instructions executable by a hardware processor of a computing component, the machine-readable storage medium comprising instructions to cause the hardware processor to perform a method for redistributing virtual private network tunnels among virtual private network concentrators in a cluster of the virtual private network concentrators, the method comprising:
receiving, from each of the virtual private network concentrators, a respective utilization indicator;
selecting a source one of the virtual private network concentrators according to the utilization indicators;
selecting a destination one of the virtual private network concentrators according to the utilization indicators;
receiving, from the source one of the virtual private network concentrators, a rekey time of the source one of the virtual private network concentrators;
selecting one of the virtual private network tunnels connected to the source one of the virtual private network concentrators; and
transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators according to the re-key time.
8. The medium of claim 7 , wherein the selected one of the virtual private network tunnels connects the source one of the virtual private network concentrators to a virtual private network endpoint, and wherein transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators comprises:
tearing down the selected one of the virtual private network tunnels; and
sending, to the virtual private network endpoint, a network address of the destination one of the virtual private network concentrators.
9. The medium of claim 7 , wherein selecting a source one of the virtual private network concentrators according to the utilization indicators comprises:
selecting the destination one of the virtual private network concentrators according to a round-robin ordering scheme of the virtual private network concentrators; and
reordering the virtual private network concentrators in the round-robin ordering scheme according to the utilization indicators.
10. The medium of claim 7 , the method further comprising:
receiving, from a virtual private network tunnel endpoint, a request to create a virtual private network tunnel;
selecting one of the virtual private network concentrators according to the utilization indicators; and
sending, to the virtual private network tunnel endpoint, a network address of the selected virtual private network concentrator.
11. The medium of claim 7 , the method further comprising:
receiving, from a virtual private network tunnel endpoint, a request to create a virtual private network tunnel;
selecting one of the virtual private network concentrators according to a round-robin ordering scheme; and
sending, to the virtual private network tunnel endpoint, a network address of the selected virtual private network concentrator.
12. The medium of claim 7 , the method further comprising:
adding a new virtual private network concentrator to the plurality of the virtual private network concentrators.
13. A method for redistributing virtual private network tunnels among a plurality of virtual private network concentrators, the method comprising:
receiving, from each of the virtual private network concentrators, a respective utilization indicator;
selecting a source one of the virtual private network concentrators according to the utilization indicators;
selecting a destination one of the virtual private network concentrators according to the utilization indicators;
receiving, from the source one of the virtual private network concentrators, a rekey time of the source one of the virtual private network concentrators;
selecting one of the virtual private network tunnels connected to the source one of the virtual private network concentrators; and
transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators according to the re-key time.
14. The method of claim 13 , wherein the selected one of the virtual private network tunnels connects the source one of the virtual private network concentrators to a virtual private network endpoint, and wherein transferring the selected one of the virtual private network tunnels from the source one of the virtual private network concentrators to the destination one of the virtual private network concentrators comprises:
tearing down the selected one of the virtual private network tunnels; and
sending, to the virtual private network endpoint, a network address of the destination one of the virtual private network concentrators.
15. The method of claim 13 , wherein selecting a source one of the virtual private network concentrators according to the utilization indicators comprises:
selecting the destination one of the virtual private network concentrators according to a round-robin ordering scheme of the virtual private network concentrators; and
reordering the virtual private network concentrators in the round-robin ordering scheme according to the utilization indicators.
16. The method of claim 13 , the method further comprising:
receiving, from a virtual private network tunnel endpoint, a request to create a virtual private network tunnel;
selecting one of the virtual private network concentrators according to the utilization indicators; and
sending, to the virtual private network tunnel endpoint, a network address of the selected virtual private network concentrator.
17. The method of claim 13 , the method further comprising:
receiving, from a virtual private network tunnel endpoint, a request to create a virtual private network tunnel;
selecting one of the virtual private network concentrators according to a round-robin ordering scheme; and
sending, to the virtual private network tunnel endpoint, a network address of the selected virtual private network concentrator.