US patent US12750314
Network address translation (NAT) hole punching over software-defined wide area networking (SD-WAN) for link quality selection of virtual private networking (VPN) tunnels
Abstract
An outbound packet is detected from a client device of a first spoke destined to a client device of a second spoke over SD-WAN through a hub connecting the first and second spokes with IPSec tunneling. The first spoke is on a local enterprise network, the second spoke is on a remote enterprise network and the hub is on wide area network, and each of the first spoke, the second spoke and the hub are each ADVPN2.0 compatible. Responsive to the detection, a health check is performed on the remote spoke. A path is selected between a local NAT device of multiple NAT devices of the first spoke and a remote NAT device of the multiple remote NAT devices of the second spoke, based on link quality data of the response. A NAT hole is punched between a selected local NAT and a selected inbound NAT and an IPSec tunnel is established, independent of the hub.