Dynamic path selection of VPN endpoint

A non-transitory machine-readable medium storing a program for execution by at least one processing unit, the program comprising sets of instructions for:

• identifying a plurality of paths between a first site and a second site, wherein a security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session;
• selecting a path from the plurality of paths based on metrics that are obtained for the plurality of paths, the selected path defined by a first endpoint address of the first site and a second endpoint address of the second site;
• sending a message from the first site to the second site to update the SA to switch from using an original path to using the selected path, the message indicating the first and second endpoint addresses, and the SA being associated with a shared security attribute between the first site and the second site;
• and
• transmitting a packet comprising a payload that is encrypted according to the updated SA.

A computing device comprising:

• a set of processing units;
• and
• non-transitory machine-readable medium storing a program for execution by at least one of the processing units, the program comprising sets of instructions for:
• identifying a plurality of paths between a first site and a second site, wherein a security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session;
• selecting a path from the plurality of paths based on metrics that are obtained for the plurality of paths, the selected path defined by a first endpoint address of the first site and a second endpoint address of the second site;
• sending a message from the first site to the second site to update the SA to switch from using an original path to using the selected path, the message indicating the first and second endpoint addresses, and the SA being associated with a shared security attribute between the first site and the second site;
• and
• transmitting a packet comprising a payload that is encrypted according to the updated SA.