Patent ID: 8547874

Claim:
A method comprising: configuring, between a first tunnel endpoint device and a second tunnel endpoint device, a single security association for an interne protocol security (IPsec) tunnel, the first tunnel endpoint device servicing a first plurality of end devices and the second tunnel endpoint device servicing a second plurality of end devices, the second plurality being different from the first plurality of end devices, the single security association defining network traffic policies on network communications between the first and second endpoint devices, the configuring including: receiving a request, from the first tunnel endpoint device, for configuration information from the second tunnel endpoint device; sending configuration information to the first tunnel endpoint device, the configuration information including an indication that the second tunnel endpoint device supports a virtual interface; receiving, from the first tunnel endpoint device, a list of the plurality of sub-network routes to the second tunnel endpoint device; accepting the list of the plurality of sub-network routes; sending an acknowledgement to the first tunnel endpoint device, the acknowledgement including a list of the accepted plurality of sub-network routes; and based on the list of the plurality of sub-network routes, configuring the single security association for the IPsec tunnel, wherein the single security association includes a default route for routing network traffic through the IPsec tunnel; providing network information about the plurality of sub-network routes to the first and second plurality of end devices; and using the network information about the plurality of sub-network routes to route network traffic to the first plurality of end devices from the second plurality of end devices through the IPsec tunnel facilitated through the plurality of sub-network routes by the single security association.