identifying a plurality of paths between a first site and a second site, wherein a security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session;

selecting a path from the plurality of paths based on metrics that are obtained for the plurality of paths, the selected path defined by a first endpoint address of the first site and a second endpoint address of the second site;

sending a message from the first site to the second site to update the SA to switch from using an original path to using the selected path, the message indicating the first and second endpoint addresses, and the SA being associated with a shared security attribute between the first site and the second site; and

transmitting a packet comprising a payload that is encrypted according to the updated SA.