Granted Patent B2

US 12,432,144 · App. 18/603,530 · Granted Sep 30, 2025

Inventors: Shangwei Duan (Vancouver, CA); Wang Xi (Vancouver, CA); Dmitry Perets (Bologna, IT); Yong lin Han (Surrey, CA); Pin Yi Kuo (Burnaby, CA); Scott Parker (Coquitlam, CA)

Assignee: Fortinet, Inc.

H04L45/76H04L45/123

Abstract

Claims (32)

1. A computer-implemented method in a local spoke, implemented at least partially in hardware and on a data communication network, for global visibility of virtual private network (VPN) conditions for routing optimization, the method comprising:

configuring a local spoke with a hub that serves at least one remote spoke equipped with a plurality of IPSEC endpoint interfaces for routing traffic according to a routing table of the hub;

receiving a first routing path to the at least one remote spoke for dynamic VPN with a first IPSEC endpoint selected by the hub based on a Reply message without consideration of first link quality of the remote spoke relative to other available links;

establishing an auto discovery VPN (ADVPN) shortcut considering link quality comprising:

responsive to receiving an Offer message by the local spoke from the hub, sending a Query message to the hub that is directed to the at least one remote spoke;

receiving a Reply message by the local spoke from the hub forwarded from the at least one remote spoke, wherein the Reply message comprises available IPSEC endpoint interfaces along with link quality metrics for each of the available IPSEC interfaces;

responsive to the local spoke selecting a second IPSEC endpoint based on link quality, enabling an ADVPN negotiation process to update the selection at the remote spoke; and

transmitting data packets using a second routing path for dynamic VPN with a second IPSEC endpoint.

2. The method of claim 1 , wherein the Reply message comprises IPSEC endpoints from a plurality of remote spokes.

3. The method of claim 1 , wherein the link quality metrics of the Reply message include at least latency, packet loss and jitter.

4. The method of claim 1 , wherein the link quality metrics of the Reply message include at least service level agreement (SLA), bandwidth and mean opinion score (MOS).

5. The method of claim 1 , wherein the second IPSEC point is different from the first IPSEC point selected by the hub.

6. The method of claim 1 , wherein the second IPSEC point is the same from the first IPSEC point selected by the hub.

7. A non-transitory computer-readable medium in a local spoke, implemented at least partially in hardware and on a data communication network, for global visibility of virtual private network (VPN) conditions for routing optimization, the non-transitory computer-readable medium comprising:

configuring a local spoke with a hub that serves at least one remote spoke equipped with a plurality of IPSEC endpoint interfaces for routing traffic according to a routing table of the hub;

receiving a first routing path to the at least one remote spoke for dynamic VPN with a first IPSEC endpoint selected by the hub based on a Reply message without consideration of first link quality of the remote spoke relative to other available links;

establishing an auto discovery VPN (ADVPN) shortcut considering link quality comprising:

responsive to receiving an Offer message by the local spoke from the hub, sending a Query message to the hub that is directed to the at least one remote spoke;

receiving a Reply message by the local spoke from the hub forwarded from the at least one remote spoke, wherein the Reply message comprises available IPSEC endpoint interfaces along with link quality metrics for each of the available IPSEC interfaces;

responsive to the local spoke selecting a second IPSEC endpoint based on link quality, enabling an ADVPN negotiation process to update the selection at the remote spoke; and

transmitting data packets using a second routing path for dynamic VPN with a second IPSEC endpoint.

8. A local spoke for global visibility of virtual private network (VPN) conditions for routing optimization, the local spoke comprising:

a processor;

a network interface communicatively coupled to the processor and to a data communication network; and

a memory, communicatively coupled to the processor and storing:

a hub configuration module a local spoke with a hub that serves at least one remote spoke equipped with a plurality of IPSEC endpoint interfaces for routing traffic according to a routing table of the hub;

a route path module to receive a first routing path to the at least one remote spoke for dynamic VPN with a first IPSEC endpoint selected by the hub based on a Reply message without consideration of first link quality of the remote spoke relative to other available links; and

an auto discovery VPN (ADVPN) module to establish an ADVPN shortcut considering link quality to:

responsive to receiving an Offer message by the local spoke from the hub, send a Query message to the hub that is directed to the at least one remote spoke;

receive a Reply message by the local spoke from the hub forwarded from the at least one remote spoke, wherein the Reply message comprises available IPSEC endpoint interfaces along with link quality metrics for each of the available IPSEC interfaces; and

responsive to the local spoke selecting a second IPSEC endpoint based on link quality, enable an ADVPN negotiation process to update the selection at the remote spoke; and

transmitting data packets using a second routing path for dynamic VPN with a second IPSEC endpoint.

Assignments (1)

Continuity (2)

References Cited (25)