Patent ID: 7155740

Claim:
A method comprising: after a secure tunnel has been created between a first endpoint and a second endpoint on a packet network which tunnel traverses at least one network address translator (NAT) that is functioning independently of the first and second endpoints and that implements VPN Masquerade and that, in outgoing packets, sent from the first endpoint to the second endpoint, notes but does not change a packet's security association identifier located within the packet and translates a private address of the first endpoint to a shared global address that is not uniquely associated with the first endpoint and, in incoming packets, sent from the second endpoint to the shared global address, notes but does not change a packet's security association identifier and translates the global address to which the packet is addressed to a private address, which address is determined by heuristically matching the second endpoint's address and incoming security association identifier with the first endpoint's private address and outgoing security association identifier, where mismatches may occur due to collisions and/or race conditions in the use of security association identifiers, and which tunnel is operating under a secure protocol that is independent of whatever applications are running on the first and second endpoints, and before one or more packets containing application data are sent between the first and second endpoints, sending a control packet from the first endpoint of the tunnel through the tunnel to the second endpoint of the tunnel; and waiting at the first endpoint for a responsive control packet through the tunnel from the second endpoint before sending packets containing application data through the tunnel wherein race conditions and collisions in the use of the security association identifiers in forwarding packets sent by the second endpoint to the first endpoint are eliminated or automatic recovery from them is provided.