Methods to support dynamic transit paths through hub clustering across branches in SD-WAN

A method of securely passing data messages through a software defined wide area network (SD-WAN), the method comprising:

• assigning a particular hub router of a hub cluster comprising a plurality of hub routers located in a set of one or more datacenters as a master hub router to serve as the hub router for all of the other hub routers in the hub cluster, the plurality of hub routers implementing the SD-WAN with a plurality of edge routers each located at one of a plurality of sites, the SD-WAN serving as a network that connects the machines operating at the plurality of sites to each other and to the datacenter set;
• sending a command to each of a plurality of other hub routers in the hub cluster to establish a VPN (virtual private network) tunnel between the other hub router and the master hub router;
• and
• advertising, to the other hub routers, routes between the other hub routers through the master hub router, said other hub routers comprising first and second hub routers, said other hub routers using said routes when the first hub router (i) connects to a first site through a first edge router of the first site but not to a second site that is connected to the second hub router that connects to the second site through a second edge router of the second site and (ii) needs to securely forward data messages received from the first site through the first edge router to the second site through the master hub router, the second hub router, and the second edge router.