Abstract: An outbound packet is detected from a client device of a first spoke destined to a client device of a second spoke over SD-WAN through a hub connecting the first and second spokes with IPSec tunneling. The first spoke is on a local enterprise network, the second spoke is on a remote enterprise network and the hub is on wide area network, and each of the first spoke, the second spoke and the hub are each ADVPN2.0 compatible. Responsive to the detection, a health check is performed on the remote spoke. A path is selected between a local NAT device of multiple NAT devices of the first spoke and a remote NAT device of the multiple remote NAT devices of the second spoke, based on link quality data of the response. A NAT hole is punched between a selected local NAT and a selected inbound NAT and an IPSec tunnel is established, independent of the hub.

Abstract: A local spoke is configured with a hub that serves at least one remote spoke equipped with a plurality of IPSEC endpoint interfaces for routing traffic according to a routing table of the hub. A first routing path is received to the at least one remote spoke for dynamic VPN with a first IPSEC endpoint selected by the hub based on a Reply message without consideration of first link quality of the remote spoke relative to other available links. In another embodiment, an ADVPN shortcut is established. Data packets are then transmitted using a second routing path for dynamic VPN with a second IPSEC endpoint. A new ADVPN shortcut is established for more optimal routing, based on updated link quality metrics discovered during a health check. The existing ADVPN shortcut is then allowed to expire.