In one embodiment, a first device in a network receives application traffic sent from a source device towards a destination address. The first device sends the application traffic to a traffic identification service. The first device receives an instruction to establish a network tunnel to send the application traffic from the source device towards the destination address. The instruction is based on a classification of the application traffic by the traffic identification service. The first device establishes the network tunnel to send the application traffic from the source device towards the destination address.