Patent ID: 11968237
Assignee: FORTINET, INC.
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 6:
7. A method in local network gateway device having multiple processing blades coupled to a data communication network with a remote network gateway device and a local network with a plurality of stations, for preventing key failure in BSS (Basic Service Set) fast transition of a station attempting to connect from a source access point managed by a Wi-Fi controller to the target access point also managed by the Wi-Fi controller, the method comprising the steps of:
assigning a processing blade from the plurality of processing blades to scan data packets;
managing a session table and an Internet Protocol security (IPsec) routing table by updating the session table with a particular security engine card assigned to the session and by updating the IPsec routing table for storing a remote Internet Protocol (IP) address for a particular session;
parsing outbound raw data packets of a particular session are parsed for matching cleartext tuple information prior to IPsec encryption, and inbound encrypted data packets of the particular session are parsed for matching cipher tuple information prior to IPsec decryption;
sending information about an IPsec tunnel to a load balancing engine including a remote gateway address and an IPsec tunnel key correlated with a source address and a destination address;
updating the session table and the IPsec routing table for handling subsequent data packets in the session;
detecting outbound data packets assigned to the assigned processing blade; and
detecting inbound data packets assigned to the assigned processing blade from the session table and forward to the station.