Path selection for data packets encrypted based on an IPSEC protocol

A non-transitory computer readable medium comprising instructions that, when executed by one or more processors of a computing system, cause the computing system to perform a method for selecting between a plurality of paths for sending an encrypted packet from a source endpoint to a destination endpoint, the method comprising:

• selecting, at the source endpoint, a first source port, of a plurality of source ports, associated with a first path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, wherein each source port of the plurality of source ports is associated with a different path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, and wherein the encrypted packet is encrypted based on a security association (SA) established between the source endpoint and the destination endpoint in accordance with an Internet Protocol (IP) Security (IPSec) protocol;
• determining, at the source endpoint, network address translation traversal (NAT-T) is enabled for the SA;
• based on the determining that NAT-T is enabled for the SA, encapsulating, at the source endpoint, the encrypted packet with a user datagram protocol (UDP) header having the first source port associated with the first path;
• and
• transmitting the encapsulated encrypted packet from the source endpoint to the destination endpoint via the first path.

A computer system, comprising:

• a memory;
• and
• a processor coupled to the memory, the processor being configured to:
• select, at a source endpoint, a first source port, of a plurality of source ports, associated with a first path of a plurality of paths for sending an encrypted packet from the source endpoint to a destination endpoint, wherein each source port of the plurality of source ports is associated with a different path of the plurality of paths for sending the encrypted packet from the source endpoint to the destination endpoint, and wherein the encrypted packet is encrypted based on a security association (SA) established between the source endpoint and the destination endpoint in accordance with an Internet Protocol (IP) Security (IPSec) protocol;
• determine, at the source endpoint, network address translation traversal (NAT-T) is enabled for the SA;
• based on the determining that NAT-T is enabled for the SA, encapsulating, at the source endpoint, the encrypted packet with a user datagram protocol (UDP) header having the first source port associated with the first path;
• and
• transmit the encapsulated encrypted packet from the source endpoint to the destination endpoint via the first path.