Patent ID: 8908698

Claim:
A system for automatically configuring a site-to-site virtual private network (VPN), the system comprising: a management server and a set of one or more IP registry servers, communicatively coupled to a plurality of routers, the management server including a configuration and management module configured to: determine a virtual private network (VPN) participation setting that identifies whether at least one router from the plurality of routers is currently configured to participate in the VPN; identify one or more router configuration settings for the at least one router, wherein the router configuration settings include settings for one or more subnets participating in the VPN, wherein at least one of the one or more subnets is located behind the at least one router; generate VPN configuration information including: VPN peer subnet route information associating the one or more subnets participating in the VPN with an appropriate one the routers from among the plurality of routers participating in the VPN; and keys to establish VPN tunnels between the at least one router and each of the routers from among ef the plurality of routers participating in the VPN; the plurality of routers, wherein each of the routers from among the plurality of routers participating in the VPN includes: one or more VPN tunnels with others of the routers participating in the VPN, wherein the one or more VPN tunnels are created using the keys generated by the management server; a set of one or more data structures storing the router configuration settings and the VPN configuration information; a configuration module to communicate with the set of IP registry servers and generate VPN network address translation (NAT) traversal information; an IP registry module to generate IP registry information based on the communications with the set of IP registry servers; a punch table module to generate a punch table based on the IP registry information, wherein the punch table includes a plurality of combinations of IP addresses and ports for each of the routers participating in the VPN; a testing module to test the plurality of combinations in the punch table to identify a current best one for each of the routers participating in the VPN; and a forwarding module to forward traffic between the subnets participating in the VPN over an appropriate one of the one or more VPN tunnels, based on the set of data structures.