A method performed at a network controller, comprising: receiving business-level network policies that represent a virtual private network, VPN, as a policy model, the VPN providing secure connectivity between connection sites based on the business-level network policies, wherein the business-level network policies include a connectivity policy specifying that a first connection site is to communicate securely both over a secure physical link without encryption and over an unsecure physical link with encryption, and include an encryption policy that governs encryption of network traffic between the connection sites according to the connectivity policy; translating the business-level network policies into network-level device configuration information represented in a network overlay and used for configuring a network underlay that provides connectivity for the connection sites to the VPN, wherein the translating includes translating the encryption policy into encryption algorithms to be used by the first connection site for encrypting traffic sent from the first connection site over the unsecure physical link; configuring the network underlay with the device configuration information so that the network underlay implements the VPN in accordance with the business-level network policies, and so that the first connection site is configured, based on the device configuration information, to communicate securely both over the secure physical link without encryption and over the unsecure physical link with encryption; determining whether the business-level network underlay is operating to direct traffic flows between the connection sites in compliance with the network policies; and if it is determined that the unsecure physical link has failed such that the first connection site is not operating in compliance with the business-level network policies, reconfiguring the network underlay including reconfiguring the first connection site with new network-level device configuration information so that the first connection site communicates only over the secure physical link without encryption in compliance with the business-level network policies until such time that a new unsecure physical link is configured over which encrypted information is to be sent. receiving business-level network policies that represent a virtual private network, VPN, as a policy model, the VPN providing secure connectivity between connection sites based on the business-level network policies, wherein the business-level network policies include a connectivity policy specifying that a first connection site is to communicate securely both over a secure physical link without encryption and over an unsecure physical link with encryption, and include an encryption policy that governs encryption of network traffic between the connection sites according to the connectivity policy; translating the business-level network policies into network-level device configuration information represented in a network overlay and used for configuring a network underlay that provides connectivity for the connection sites to the VPN, wherein the translating includes translating the encryption policy into encryption algorithms to be used by the first connection site for encrypting traffic sent from the first connection site over the unsecure physical link; configuring the network underlay with the device configuration information so that the network underlay implements the VPN in accordance with the business-level network policies, and so that the first connection site is configured, based on the device configuration information, to communicate securely both over the secure physical link without encryption and over the unsecure physical link with encryption; determining whether the business-level network underlay is operating to direct traffic flows between the connection sites in compliance with the network policies; and if it is determined that the unsecure physical link has failed such that the first connection site is not operating in compliance with the business-level network policies, reconfiguring the network underlay including reconfiguring the first connection site with new network-level device configuration information so that the first connection site communicates only over the secure physical link without encryption in compliance with the business-level network policies until such time that a new unsecure physical link is configured over which encrypted information is to be sent.