Abstract: To generate an encrypted packet, a transmitting endpoint in a communication system chooses the desired IPsec tunnel, then retrieves the SA linked to that tunnel from its Outbound SA table of its local SA database (SAD), and encrypts the packet using the retrieved SA. To decrypt the encrypted packet, the receiving endpoint extracts the Security Parameter Index (SPI) value, the source address, the destination address, and the source port number from the packet to retrieve the appropriate SA from its local SAD database and decrypts the encrypted packet using the retrieved SA. In this way, the transmitting and receiving endpoints can retrieve the appropriate SAs for situations in which either endpoint is one of multiple endpoints located behind a Carrier-Grade Network Address Translation (CG-NAT) function having a single public IP address shared by the multiple endpoints.

Abstract: In an enterprise having a local endpoint located behind a Symmetric NAT node, the local endpoint distributes its public IP address for endpoint packets to remote endpoints by generating probe packets having the local endpoint's private IP address as the source address in an outer IP header and the local endpoint's ID as the source address in an inner IP header. The Sym-NAT node replaces the private IP address with the public IP address for endpoint packets as the outer IP header's source address. Each remote endpoint uses the local endpoint's ID in the probe packet's inner IP header and uplink information from decrypted probe data to identify the source address in the probe packet's outer IP header as the local endpoint's public IP address for endpoint packets, thereby solving the problem of remote nodes receiving only the local endpoint's public IP address for controller packets from the enterprise controller.

Abstract: To generate an encrypted packet, a transmitting endpoint in a communication system chooses the desired IPsec tunnel, then retrieves the SA linked to that tunnel from its Outbound SA table of its local SA database (SAD), and encrypts the packet using the retrieved SA. To decrypt the encrypted packet, the receiving endpoint extracts the Security Parameter Index (SPI) value, the source address, the destination address, and the source port number from the packet to retrieve the appropriate SA from its local SAD database and decrypts the encrypted packet using the retrieved SA. In this way, the transmitting and receiving endpoints can retrieve the appropriate SAs for situations in which either endpoint is one of multiple endpoints located behind a Carrier-Grade Network Address Translation (CG-NAT) function having a single public IP address shared by the multiple endpoints.