A system, comprising: a first switching fabric at a first site communicatively coupled via a public network to a second switching fabric at a second site, wherein the first site is at a different geographic location than the second site, wherein the first switching fabric is configured to: receive a first packet from a first host at the first site, the first packet comprising a destination of a second host at the second site, wherein the first and second hosts a re assigned to a stretched endpoint group, EPG, extending between the first and second sites, wherein the stretched EPG defines a security policy shared by the first and second hosts, change a source ID in the first packet to a unicasttunnel endpoint at the first site, upon determining that a path between the first and second hosts (125A, 125B) is unlearned, transmit the first packet from the first site to the second site using a multicast tunnel through the public network, receiving, after receiving the first packet, a second packet from the first host at the first site, the second packet comprising the destination of the second host at the second site, and upon determining that the path between the first and second hosts (125A, 125B) is learned, and aftertransmittingthe first packet using the multicasttunnel, transmit the second packet from the first site to the second site using a unicasttunnel, and not the multicast tunnel, through the public network. a first switching fabric at a first site communicatively coupled via a public network to a second switching fabric at a second site, wherein the first site is at a different geographic location than the second site, wherein the first switching fabric is configured to: receive a first packet from a first host at the first site, the first packet comprising a destination of a second host at the second site, wherein the first and second hosts a re assigned to a stretched endpoint group, EPG, extending between the first and second sites, wherein the stretched EPG defines a security policy shared by the first and second hosts, change a source ID in the first packet to a unicasttunnel endpoint at the first site, upon determining that a path between the first and second hosts (125A, 125B) is unlearned, transmit the first packet from the first site to the second site using a multicast tunnel through the public network, receiving, after receiving the first packet, a second packet from the first host at the first site, the second packet comprising the destination of the second host at the second site, and upon determining that the path between the first and second hosts (125A, 125B) is learned, and aftertransmittingthe first packet using the multicasttunnel, transmit the second packet from the first site to the second site using a unicasttunnel, and not the multicast tunnel, through the public network. receive a first packet from a first host at the first site, the first packet comprising a destination of a second host at the second site, wherein the first and second hosts a re assigned to a stretched endpoint group, EPG, extending between the first and second sites, wherein the stretched EPG defines a security policy shared by the first and second hosts, change a source ID in the first packet to a unicasttunnel endpoint at the first site, upon determining that a path between the first and second hosts (125A, 125B) is unlearned, transmit the first packet from the first site to the second site using a multicast tunnel through the public network, receiving, after receiving the first packet, a second packet from the first host at the first site, the second packet comprising the destination of the second host at the second site, and upon determining that the path between the first and second hosts (125A, 125B) is learned, and aftertransmittingthe first packet using the multicasttunnel, transmit the second packet from the first site to the second site using a unicasttunnel, and not the multicast tunnel, through the public network.