Patent ID: 11956213
Assignee: VMWARE LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 17:
18. A non-transitory machine readable medium storing a program for execution by a set of processing units of a source gateway device, the program for transmitting data messages via secure tunnels in a network, the program comprising sets of instructions for:
determining that a data message received at the gateway device is to be sent via a secure interface of the gateway device;
matching the data message to a firewall rule that maps to a particular secure tunnel used by the secure interface, wherein a plurality of different firewall rules map to a plurality of different secure tunnels used by the secure interface; and
encapsulating the data message with a header that comprises an indicator value specifying the particular secure tunnel and forwarding the encapsulated data message to a destination gateway device,
wherein the plurality of different secure tunnels corresponds to a plurality of different security associations (SAs) for processing data messages at the destination interface,
prior to receipt of the data message at the gateway device and during an Internet key exchange (IKE) session with the destination gateway device:
(i) negotiating a plurality of Internet protocol security (IPsec) rules, wherein the plurality of firewall rules is integrated with the plurality of IPsec rules,
(ii) negotiating parameters for (1) the plurality of different secure tunnels and (2) the plurality of different SAs, and
(iii) mapping (1) the plurality of different firewall rules to the plurality of different secure tunnels and (2) the plurality of different secure tunnels to the plurality of different SAs.