Apparatus comprising means for performing: determining, by a security node (121-A, 221-A1, 221-A2) for a redundancy domain (210-1, 210-2) including the security node (121-A, 221-A1, 221-A2) and one or more other security nodes (121-B, 221-B1, 221-B2), an administrative role of the security node (121-A, 221-A1, 221-A2) within the redundancy domain (210-1, 210-2) and a runtime role of the security node (121-A, 221-A1, 221-A2) within the redundancy domain (210-1, 210-2); performing, by the security node (121-A, 221-A1, 221-A2) based on interaction with at least one of the one or more other security nodes (121-B, 221-B1, 221-B2) for a secure channel associated with a client device and having secure channel state information associated therewith, a process for synchronizing at least a portion of the secure channel state information; and performing, by the security node (121-A, 221-A1, 221-A2), a process for causing traffic of the client device to be attracted to an active security node of the redundancy domain (210-1, 210-2) that is configured to provide security for communications of the client device based on the at least a portion of the secure channel state information; wherein the runtime role of the security node (121-A, 221-A1, 221-A2) in the redundancy domain is that the security node (121-A, 221-A1, 221-A2) is the active security node of the redundancy domain (210-1, 210-2); the apparatus further comprising means for performing at least one of: a dvertising, by the security node (121-A, 221-A1, 221-A2) based on the process for causing traffic of the client device to be attracted to the active security node of the redundancy domain, a gateway endpoint address route having a first metric that is better than respective metrics of respective gateway endpoint address routes advertised by the one or more other security nodes (121-B, 221-B1, 221-B2); or a dvertising, by the security node (121-A, 221-A1, 221-A2) based on the process for causing traffic of the client device to be attracted to the active security node of the redundancy domain, a payload route having a first metric that is better than respective metrics of respective payload routes advertised by the one or more other security nodes (121-B, 221-B1, 221-B2). determining, by a security node (121-A, 221-A1, 221-A2) for a redundancy domain (210-1, 210-2) including the security node (121-A, 221-A1, 221-A2) and one or more other security nodes (121-B, 221-B1, 221-B2), an administrative role of the security node (121-A, 221-A1, 221-A2) within the redundancy domain (210-1, 210-2) and a runtime role of the security node (121-A, 221-A1, 221-A2) within the redundancy domain (210-1, 210-2); performing, by the security node (121-A, 221-A1, 221-A2) based on interaction with at least one of the one or more other security nodes (121-B, 221-B1, 221-B2) for a secure channel associated with a client device and having secure channel state information associated therewith, a process for synchronizing at least a portion of the secure channel state information; and performing, by the security node (121-A, 221-A1, 221-A2), a process for causing traffic of the client device to be attracted to an active security node of the redundancy domain (210-1, 210-2) that is configured to provide security for communications of the client device based on the at least a portion of the secure channel state information; wherein the runtime role of the security node (121-A, 221-A1, 221-A2) in the redundancy domain is that the security node (121-A, 221-A1, 221-A2) is the active security node of the redundancy domain (210-1, 210-2); a dvertising, by the security node (121-A, 221-A1, 221-A2) based on the process for causing traffic of the client device to be attracted to the active security node of the redundancy domain, a gateway endpoint address route having a first metric that is better than respective metrics of respective gateway endpoint address routes advertised by the one or more other security nodes (121-B, 221-B1, 221-B2); or a dvertising, by the security node (121-A, 221-A1, 221-A2) based on the process for causing traffic of the client device to be attracted to the active security node of the redundancy domain, a payload route having a first metric that is better than respective metrics of respective payload routes advertised by the one or more other security nodes (121-B, 221-B1, 221-B2).