Patent ID: 7945666

Claim:
A method for a data network comprising: storing a data structure ( 14 ) in a first data processing apparatus ( 1 ), wherein the first data processing apparatus ( 1 ) and a plurality of second and third data processing apparatuses are connected to a data network ( 24 ), wherein the data structure ( 14 ) accommodates a plurality of entries, wherein each entry comprises a plurality of selectors and a specification of a logical tunnel ( 64 , 65 ) between the first data processing apparatus ( 1 ) and the second data processing apparatuses, and wherein a selector specifies values for certain header fields of a datagram, processing each outgoing datagram by the first data processing apparatus ( 1 ), comprising: searching the data structure ( 14 ) for an entry whose selectors match the datagram, for deciding ( 73 ) whether the datagram is sent over one of the logical tunnels ( 64 , 65 ) defined by the data structure entry, and if so, over which one, afterwards deciding ( 75 ) to which second data processing apparatus in the data network ( 24 ) the datagram is sent, sending a reachability information ( 11 ) by the third data processing apparatus to the first data processing apparatus ( 1 ) temporally related to every change of the network topology at the second data processing apparatus which is an endpoint of the logical tunnel ( 64 , 65 ), wherein said reachability information ( 11 ) comprises at least the following elements: a network destination address ( 52 ), a gateway ( 53 ), and an indication whether the network destination address ( 52 ) is newly reachable or no longer reachable via the gateway ( 53 ), incorporating the reachability information ( 11 ) into the data structure ( 14 ) by the first data processing apparatus ( 1 ), comprising inserting into ( 15 ) or removing from ( 15 ) the outbound SPD ( 14 ) an entry, which has a selector for the header field of datagrams in which the network destination address of a datagram is stored, or more specifically a selector of type “destination IP address”, with the network destination address ( 52 ) of the reachability information ( 11 ), and which has the action “protect” with a specification of a logical tunnel ( 64 , 65 ), or more specifically a tunnel-mode SA specification, wherein this SA specification specifies the gateway ( 53 ) of the reachability information ( 11 ) as the IP address of the other tunnel endpoint, inserting into ( 17 ) or removing from ( 17 ) the inbound SPD ( 16 ) an entry, which has a selector of type “source IP address” with the network destination address ( 52 ) of the reachability information ( 11 ), and which has the action “protect” with a tunnel-mode SA specification, wherein this SA specification specifies the gateway ( 53 ) of the reachability information ( 11 ) as the IP address of the other tunnel endpoint.