Patent ID: 8010085

Claim:
A network security system, comprising: a plurality of processing nodes external to network edges of a plurality of enterprises, each processing node performing operations comprising: hosting a plurality of tunnel endpoints, each tunnel endpoint being associated with a corresponding enterprise and being a tunnel endpoint for a tunnel between the enterprise and the processing node; and storing security policy data defining security policies for each of the enterprises, performing threat detection processes to classify content items communicated over the tunnel between the enterprises and the processing node and managing the classified content items in accordance with the security policy data so that security policies for the enterprises in communication with the processing node over tunnels are implemented external to the network edges for each of the enterprises, wherein hosting the plurality of tunnel end points, each tunnel endpoint being associated with a corresponding enterprise and being a tunnel endpoint for a communication tunnel between the enterprise and the processing node comprises the operations of: hosting a plurality of virtual gateway nodes, each virtual gateway node corresponding to an enterprise and having an associated tunnel destination address for a corresponding tunnel, each tunnel destination address being one of the tunnel endpoints; wherein each processing node performs the further operation of propagating routing data related to the processing node and the virtual gateway nodes, and receiving routing data propagated by processing nodes and a monitoring node in data communication with the processing nodes; and wherein the monitoring node is configured to perform operations comprising: monitoring a tunnel status of each of the corresponding tunnels in the processing nodes; detecting routes to each of the virtual gateway nodes and propagating routing data related to the processing nodes and the virtual gateway nodes to the processing nodes; and identifying failover states for the tunnels, and in response to identifying a failover state for a first tunnel in a first processing node: updating the routing data to specify a second processing node as hosting a virtual gateway node associated with the first tunnel and hosted in the first processing node; and propagating the updated routing data to the processing nodes so that the second processing node hosts the virtual gateway node.