A method of protecting against Denial of Service attacks by distributing traffic from an end node in a packet switched network to a cluster (151, 152) of service gateway nodes (151a, 151b, 151c, 152a, 152b, 152c) that host subscriber-aware servers, comprising the steps of: receiving a control plane message for supporting data plane traffic from a particular subscriber; determining a particular service gateway node among the cluster of service gateway nodes for the control plane message based on policy-based routing, PBR, at a PBR engine for the data plane traffic from the particular subscriber, wherein the PBR includes a unique network identifier for the particular subscriber, the unique network identifier being used to determine a next hop network address for data plane traffic associated with the particular subscriber; and wherein determining the particular service gateway node for the control plane message further comprises: determining the unique network identifier for the particular subscriber; providing the unique network identifier to the policy-based routing engine; receiving the next hop network address for the data plane traffic associated with the particular subscriber from the policy-based routing engine; determining the particular service gateway node for the control plane message based on the next hop network address; and sending a message based on the control plane message to a control plane process on the particular service gateway node, whereby related data plane traffic and control plane traffic from the same subscriber are directed to one or more related gateway nodes of the cluster of service gateway nodes. receiving a control plane message for supporting data plane traffic from a particular subscriber; determining a particular service gateway node among the cluster of service gateway nodes for the control plane message based on policy-based routing, PBR, at a PBR engine for the data plane traffic from the particular subscriber, wherein the PBR includes a unique network identifier for the particular subscriber, the unique network identifier being used to determine a next hop network address for data plane traffic associated with the particular subscriber; and wherein determining the particular service gateway node for the control plane message further comprises: determining the unique network identifier for the particular subscriber; providing the unique network identifier to the policy-based routing engine; receiving the next hop network address for the data plane traffic associated with the particular subscriber from the policy-based routing engine; determining the particular service gateway node for the control plane message based on the next hop network address; and sending a message based on the control plane message to a control plane process on the particular service gateway node, whereby related data plane traffic and control plane traffic from the same subscriber are directed to one or more related gateway nodes of the cluster of service gateway nodes. determining the unique network identifier for the particular subscriber; providing the unique network identifier to the policy-based routing engine; receiving the next hop network address for the data plane traffic associated with the particular subscriber from the policy-based routing engine; determining the particular service gateway node for the control plane message based on the next hop network address; and sending a message based on the control plane message to a control plane process on the particular service gateway node, whereby related data plane traffic and control plane traffic from the same subscriber are directed to one or more related gateway nodes of the cluster of service gateway nodes.