Seamless Remote Access VPN Failover via Active Standby Controller Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current VPN connection establishment methods experience interruptions and session information loss due to primary VPN concentrator unavailability, leading to delayed failover and uneven network load distribution among concentrators.
Innovation Solution
A system and method that utilize a cluster of VPN concentrators, where a cluster leader manages network load to identify active and standby controllers, ensuring seamless failover and load balancing through frequent heartbeat packet sharing and state information exchange, allowing continuous VPN connections without re-establishment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single primary VPN concentrator is used to establish VPN connections, then the system structure is simple, but the connection is interrupted and session information is lost when the concentrator becomes unavailable
Solution Approach 1:
The system segments the VPN concentrator functionality into multiple independent concentrators (primary and standby) distributed across different physical devices. Each concentrator handles specific portions of the VPN connection management, allowing failover to another segment if one becomes unavailable, thus maintaining connection continuity while distributing system complexity across multiple manageable units.
Solution Approach 2:
The system performs preliminary actions by pre-establishing standby VPN concentrators with synchronized session information before any failure occurs. The standby concentrators are prepared in advance with all necessary connection state data, so when a primary concentrator fails, the failover is immediate and seamless without requiring re-establishment of VPN connections or loss of session information.
2Productivity
If VPN concentrators operate independently without coordination, then the system operation is simple, but network load is unevenly distributed among concentrators
Solution Approach 1:
The system implements feedback mechanisms where VPN concentrators continuously exchange load status information through heartbeat packets and state synchronization. The primary concentrator monitors the load on standby concentrators and can dynamically redirect new VPN connections to less loaded concentrators. This feedback loop ensures even load distribution while maintaining centralized coordination to manage the complexity of multi-concentrator operations.
Solution Approach 2:
The system introduces dynamic load balancing where the roles of primary and standby concentrators are not fixed but can change based on current load conditions. Concentrators can transition between primary and standby roles dynamically, and the system adapts its connection routing in real-time based on the operational status and load of each concentrator, optimizing productivity while managing operational complexity through automated role assignment.
3Loss of time
If failover detection is performed infrequently, then the system consumes less energy, but the failover time is delayed causing connection interruption
Solution Approach 1:
The system employs periodic heartbeat packets exchanged between primary and standby VPN concentrators to detect failures. These periodic signals allow the standby concentrator to monitor the health of the primary concentrator and detect failures quickly. The periodic nature of this communication enables timely failover detection while controlling energy consumption by using efficient, lightweight packet formats and optimizing the heartbeat interval based on the required failover time and energy constraints.
Data Source
AI summary
A system and a method of establishing seamless remote access VPN connections are described. For establishment of a VPN connection for a user device, a cluster leader of a cluster of controllers identifies an active controller and a standby controller, based on network load of each controller of the cluster of controllers. An active VPN connection is established between the user device and the active controller and a standby VPN connection is established between the user device and the standby controller. The standby VPN connection is utilized in place of the active VPN connection during failover of the active controller. Because information of an active session is regularly shared by the active controller to the standby controller, the standby controller can seamlessly resume the active session during failover of the active controller.