Abstract: A system, mechanism and method are provided for inspecting packets. Application processing engines (ASEs) inspect an IP packet flow of subscribers. It is determined whether any of the ASEs is operating as a master and if not one of the ASEs is elected. The master forms one or more redundancy group of the ASEs based on a configuration of IP packet flow for subscribers determining for the redundancy group how many active ASEs are needed to support an operational configuration of the IP packet flow of the subscribers. If there is already an active ASE performing a determined configured function, the master allows the function to continue to be performed by that active ASE and assigns other configured functions to available ASEs with ASEs not assigned a configuration serving as standby ASE in the redundancy group. The active ASEs multicast or broadcast subscriber state data to each of the standby ASEs. The standby ASEs maintain received subscriber state data for each active ASE.

Abstract: A network gateway device is provided with a network physical interface for receiving and transmitting data and for receiving packets for transmission and forwarding packets from received data. A packet processor is provided that provides for a key exchange and hosts a security association (SA) used for encryption and decryption for communication with a network peer. The packet processor includes an ingress processing security subsystem with a decryption processor for decrypting packets and an egress processing security subsystem for encrypting packets. One or both of the ingress processing security subsystem and the egress processing security subsystem receiving one or both of ingress and egress SAs. The packet processor may include a processor subsystem for handling key exchanges and for distributing SAs to the ingress processing security subsystem and the egress processing security subsystem.