Patent ID: 8606939

Claim:
A method of configuring an on-demand secure connection between a control site and a client network, comprising: establishing a partner tunnel from said control site to a partner site, wherein said partner tunnel terminates at said partner site; prompting the establishment of a primary tunnel from said partner site to an edge device of said client network with the control site via the partner tunnel, wherein the client network includes multiple sub-networks located within corresponding sub-layers of said client network, and wherein the primary tunnel is configured to couple the partner site with the client network; and prompting the recursive establishment of one or more nested tunnels from said partner site through one or more sub-layers of said client network, wherein each of said nested tunnels is established inside of the primary tunnel and any nested tunnel previously established for upper sub-layers of said client network, each nested tunnel extending out of a previous tunnel and into the next layer at an edge device of a next sub-layer of the client network, wherein said recursive establishment comprises: conducting a discovery process in one or more sub-layers of said client network via the primary tunnel to ascertain a presence of at least one device in a corresponding lower sub-layer of said client network connected to an upper sub-layer of said client network, and configuring the at least one device discovered in said corresponding lower sub-layer with the control site via the partner tunnel and the primary tunnel to establish a nested tunnel within said primary tunnel, said primary tunnel terminating at the edge device and said nested tunnel extending through the edge device and terminating at the at least one device in the lower sub-layer to couple said partner site with lower sub-layer of said client network.