Network address translation (NAT) hole punching over software-defined wide area networking (SD-WAN) for link quality selection of virtual private networking (VPN) tunnels

A non-transitory computer-readable medium in a network device, on a data communication network, for Network Address Translation (NAT) hole punching over Software-Defined Wide Area Networking (SD-WAN) to allow link quality selection for Virtual Private Networking (VPN) tunnel, the method comprising:

• detecting an outbound packet from a client device of a first spoke destined to a client device of a second spoke over SD-WAN through a hub connecting the first and second spokes with Internet Protocol Security (IPSec) tunneling, wherein the first spoke is on a local enterprise network, the second spoke is on a remote enterprise network and the hub is on wide area network, and each of the first spoke, the second spoke and the hub are each Auto Discovery Virtual Private Networking 2.0 (ADVPN2.0) compatible;
• responsive to the detection, receiving an offer at the first spoke from the hub, including an IP address of the second spoke;
• querying the second spoke, from the first spoke through the hub, with a health check for link quality information for a plurality of links, wherein the link quality concerns multiple remote NAT devices of the second spoke;
• receiving a response from the second spoke, at the first spoke through the hub, wherein the response includes multiple external IP addresses with ports and link quality data for the multiple remote NAT devices;
• selecting a path between a local NAT device of multiple NAT devices of the first spoke and a remote NAT device of the multiple remote NAT devices of the second spoke, based on link quality data of the response;
• transmitting an update message, from the first spoke through the hub to the second spoke, wherein the update message includes the selected inbound and outbound NAT devices, wherein a NAT hole is punched between a selected local NAT and a selected inbound NAT and an IPSec tunnel is established, independent of the hub;
• and
• transmitting the outgoing packet from the client device of the first spoke, over the IPSec tunnel between the selected local NAT and the selected remote NAT, to the client device of the second spoke.

A network device for Network Address Translation (NAT) hole punching over Software-Defined Wide Area Networking (SD-WAN) to allow link quality selection for Virtual Private Networking (VPN) tunnel, the network device comprising:

• a processor;
• a network interface communicatively coupled to the processor and to a data communication network;
• and
• a memory, communicatively coupled to the processor and storing:
• a VPN session module to detect an outbound packet from a client device of a first spoke destined to a client device of a second spoke over SD-WAN through a hub connecting the first and second spokes with Internet Protocol Security (IPSec) tunneling, wherein the first spoke is on a local enterprise network, the second spoke is on a remote enterprise network and the hub is on wide area network, and each of the first spoke, the second spoke and the hub are each Auto Discovery Virtual Private Networking 2.0 (ADVPN2.0) compatible;
• an optimal VPN tunnel path to, responsive to the detection, receive an offer at the first spoke from the hub, including an IP address of the second spoke,
• wherein the optimal VPN path module queries the second spoke, from the first spoke through the hub, with a health check for link quality information for a plurality of links, wherein the link quality concerns multiple remote NAT devices of the second spoke,
• wherein the optimal VPN path module receives a response from the second spoke, at the first spoke through the hub, wherein the response includes multiple external IP addresses with ports and link quality data for the multiple remote NAT devices, and
• wherein the optimal VPN tunnel module selects a path between a local NAT device of multiple NAT devices of the first spoke and a remote NAT device of the multiple remote NAT devices of the second spoke, based on link quality data of the response;
• a VPN tunnel module to transmit an update message, from the first spoke through the hub to the second spoke, wherein the update message includes the selected inbound and outbound NAT devices,
• wherein a NAT hole is punched between a selected local NAT and a selected inbound NAT and an IPSec tunnel is established, independent of the hub;
• and
• a VPN tunnel module to transmit the outgoing packet from the client device of the first spoke, over the IPSec tunnel between the selected local NAT and the selected remote NAT, to the client device of the second spoke.