Patent ID: 7207063

Claim:
An apparatus for determining secure endpoints of tunnels in a network that uses Internet security protocol, comprising: a network interface that is coupled to the network for receiving one or more packet flows therefrom; a processor; one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: sending from a first network device a first description of network traffic that is to be protected, wherein the first description comprises a first set of network addresses; receiving, at the first network device and from a second network device, a second description of network traffic that is to be protected, wherein the second description comprises a second set of network addresses; creating and storing a third description of network traffic that is to be protected based on determining a logical intersection of the first description of network traffic and the second description of network traffic, wherein the step of creating and storing a third description further comprises the step of determining a largest common subset between the first set of network addresses and the second set of network addresses; and establishing the secure connection between the first network device and the second network device based on the third description of network traffic; and wherein the first description comprises a packet summary value that summarizes packets in the network traffic to be protected, and wherein the second description is generated by the second network device based on comparing the packet summary value to one or more access control lists that are managed by the second network device.