A method for dynamically scaling a virtual private network, VPN, gateway having multiple instances (114a, 114b) for facilitating VPN network traffic between a private network and a cloud computing system, the method comprising: determining whether a first instance of the VPN gateway is overloaded for processing incoming packets from the private network based on a preset threshold, the first instance being connected to an on-premise gateway of the private network via a VPN connection through a public network, wherein the VPN connection between the private network and the cloud computing system is configured according to encapsulating security payload, ESP, protocol; in response to determining that the first instance is overloaded, creating a security logic group corresponding to a portion of the VPN network traffic between the private network and the cloud computing system, the created security logic group including one or more security parameters configured to allow secure communications between a first endpoint in the private network and a second endpoint in the cloud computing system, wherein creating the security logic group includes creating a security association, SA, between the private network and the cloud computing system, the SA having a unique security parameter index, SPI; and upon completion of creating the security logic group, forwarding the portion of the network traffic to a second instance of the VPN gateway when a digital identifier of the created security logic group is a part of each of additional incoming packets, wherein forwarding the portion of the network traffic includes forwarding packets containing the unique SPI of the created SA in a header field of the individual packets to the second instance; and forwarding other packets to the first instance of the VPN gateway when the other packets containing another unique SPI corresponding to another SA in a header field of the individual other packets. determining whether a first instance of the VPN gateway is overloaded for processing incoming packets from the private network based on a preset threshold, the first instance being connected to an on-premise gateway of the private network via a VPN connection through a public network, wherein the VPN connection between the private network and the cloud computing system is configured according to encapsulating security payload, ESP, protocol; in response to determining that the first instance is overloaded, creating a security logic group corresponding to a portion of the VPN network traffic between the private network and the cloud computing system, the created security logic group including one or more security parameters configured to allow secure communications between a first endpoint in the private network and a second endpoint in the cloud computing system, wherein creating the security logic group includes creating a security association, SA, between the private network and the cloud computing system, the SA having a unique security parameter index, SPI; and upon completion of creating the security logic group, forwarding the portion of the network traffic to a second instance of the VPN gateway when a digital identifier of the created security logic group is a part of each of additional incoming packets, wherein forwarding the portion of the network traffic includes forwarding packets containing the unique SPI of the created SA in a header field of the individual packets to the second instance; and forwarding other packets to the first instance of the VPN gateway when the other packets containing another unique SPI corresponding to another SA in a header field of the individual other packets.