Patent ID: 8307423

Claim:
A method, comprising: configuring a policy server, in a data communication network comprising a plurality of VPN gateway devices that are configured only for plaintext data communication, with a security policy including DO NOT ENCRYPT statements temporarily overriding PERMIT statements defining which packets should be encrypted; selecting one sub-group among one or more groups of the VPN gateway devices in which tunnel-less encryption is not configured; configuring each of the VPN gateway devices in the selected sub-group for tunnel-less encryption by: configuring each device in a passive mode of operation in which the device is configured to receive either encrypted packets or plaintext packets matching encryption policy; configuring local DO NOT ENCRYPT statements matching traffic that is currently being converted to ciphertext; removing, from an access control list of the policy server, DO NOT ENCRYPT statements referring to protected local area network classless inter-domain routing (LAN CIDR) blocks behind the VPN gateway devices in the selected sub-group; configuring the sub-group to send encrypted packets by removing, from each of the VPN gateway devices in the selected sub-group, the local DO NOT ENCRYPT statements for the protected LAN CIDR blocks currently being converted and protected by the selected sub-group; repeating the configuring each of the VPN gateway devices in the selected sub-group for tunnel-less encryption, and the configuring the sub-group to send encrypted packets, for each other one of the sub-groups; removing the passive mode on each of the VPN gateway devices.