Method and device for controlling internet protocol security (IPSEC) load sharing through user number

Abstract

The invention discloses a method for controlling internet protocol security (IPSEC) load sharing through user number. The method comprises the following steps: S1, configuring load sharing interface groups on a network device, wherein each load sharing interface group comprises a plurality of load sharing interfaces; S2, configuring a plurality of IPSEC tunnels to be bound onto the load sharing interface groups; and S3, according to different numbers of the tunnels built by the load sharing interfaces in each load sharing interface group, choosing the load sharing interface with the smallest number of the built tunnels during new connection building for consulting to build the tunnels. Additionally, the invention further discloses a system for controlling IPSEC load sharing through user number to achieve the method. By means of the method and system for controlling IPSEC load sharing through user number, IPSEC and interface load sharing are perfectly combined, the aim of IPSEC interface load sharing is achieved, outlet interface distribution is more flexible, and interface resource distribution is even.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a method and equipment for controlling IPSEC load sharing through the number of users. Background technique [0002] Most of the current network devices are equipped with IPSEC function and traffic load sharing function. Interface traffic load balancing usually distributes the data flow with the same destination address to the load sharing interface as evenly as possible in the way of load sharing (the load sharing interface is greater than or equal to 2). At this time, the load sharing interface has a route to the same destination address, so it can be Send data to the same destination through two different interfaces. Each IPSEC tunnel established on an interface needs to occupy interface resources, and when using the IPSEC function to forward packets, the interface cannot usually be selected. Therefore, the number of IPSEC tunnels that have been negotiated and e...

AI Technical Summary

Problems solved by technology

Each IPSEC tunnel established on an interface needs to occupy interface resources, and when using the IPSEC function to forward packets, the interface cannot usually be selected. Therefore, the number of IPSEC tunnels that have been negotiated and established based on the interface cannot be realized. Select a load-sharing interface with a small number of IPSEC tunnels to make the outbound interface resource allocation more even

Images