Abstract: Instead of specifying actual transport layer IP addresses as a basis for a secure tunnel's security association, an approach described herein specifies virtual addresses. Then suitable network appliances intercept and modify packets in order to map between the virtual addresses and actual addresses. The virtual addresses satisfy IPsec or another authentication procedure that checks packets using the security association. The actual addresses are used by transport layer protocols. This overlay approach permits a session to failover from one network connection to another without requiring restoration of the session in a newly created secure tunnel after one of the network interfaces becomes unavailable, thereby obsoleting the security association based in part on the IP address of the now unavailable interface. This innovative approach also allows the use of parallel paths and the use of one-to-many or many-to-one path topologies, which would otherwise not be permitted.

Abstract: Tools and technologies geographically extend local area networks by transparently inserting transmission of encapsulated local area network frames over wide area network connections. Some devices receive frames from a switch or other physically addressed device using layer 2 protocols, encapsulate them, and send them over a wide area network to a similar remote device which decapsulates the frames and forwards them using layer 2 protocols. Load balancing, quality of service, compression, encryption, and other packet processing may be performed on the encapsulated packets.

Abstract: Tools and technologies geographically extend local area networks by transparently inserting transmission of encapsulated local area network frames over wide area network connections. Some devices receive frames from a switch or other physically addressed device using layer 2 protocols, encapsulate them, and send them over a wide area network to a similar remote device which decapsulates the frames and forwards them using layer 2 protocols. Load balancing, quality of service, compression, encryption, and other packet processing may be performed on the encapsulated packets.

Abstract: Failover controllers help maintain user-perceived continuous connectivity for users of a geographically dispersed flat network when part of that network becomes unavailable, even though flat network packets are not WAN-routable. One such controller has local and remote flat network ports, at least one WAN port, and failover capability to WAN(s) utilizing encapsulation when the flat network is partially or fully unavailable. The failover procedure uses a packet origin table built automatically from incoming packets and from double-tunneled ARP requests. A monitor indicates whether the flat network is fully available (up) or not fully available (down).

Abstract: Failover controllers help maintain user-perceived continuous connectivity for users of a geographically dispersed flat network when part of that network becomes unavailable, even though flat network packets are not WAN-routable. One such controller has local and remote flat network ports, at least one WAN port, and failover capability to WAN(s) utilizing encapsulation when the flat network is partially or fully unavailable. The failover procedure uses a packet origin table built automatically from incoming packets and from double-tunneled ARP requests. A monitor indicates whether the flat network is fully available (up) or not fully available (down).

Abstract: To help maintain secure and convenient connectivity for users when IP addresses change, devices connected between sites by using multiple virtual private network security associations update one another when the security association IP addresses change. The device whose WAN interface IP address changed transmits an address change notification message to the other device over a WAN interface whose IP address did not change. The message indicates which IP address(es) changed and new value(s) to use. The devices can then continue the same secure virtual private network session (from a user point of view above the security association level) by using the new value(s) for the changed IP address(es). Use of the new value for the changed IP address is transparent to (unseen by) VPN applications that are running in the LANs. IPSec sessions and load balancing may be provided.