County courts are migrating DMVPN IPsec protection from IKEv1 to IKEv2. What is a primary reason to prefer IKEv2 for modern crypto hygiene on the overlay?
Select an answer to reveal the explanation.
Short Explanation
IKEv2 is the cleaner handshake for locking the DMVPN tunnels — fewer round trips, modern crypto expectations, better hygiene than old IKEv1. mGRE still needs IPsec for encryption on Internet transports; IKEv2 does not magically encrypt by itself.
Full Explanation
Protecting DMVPN on Internet transports relies on IPsec, and IKEv2 is the preferred key-exchange evolution over IKEv1 for county courts: more efficient negotiation, fewer round trips, improved reliability features, and alignment with modern cryptographic guidance. Migrating profiles to IKEv2 improves crypto hygiene without abandoning the DMVPN overlay model.
IKEv2 does not eliminate the need for IPsec profiles because mGRE alone is not encryption. IKEv2 does not force Phase 1-only DMVPN for evidence networks. IKEv2 can use pre-shared keys where policy allows; migration does not require replacing DMVPN with MPLS L3VPN solely because of IKEv2 myths.
Exam caveat: IKEv2 improves the handshake and crypto practices; mGRE still needs IPsec for confidentiality on public underlays.
Operational check: migrate court hub/spoke profiles to IKEv2, verify SA establishment and Phase 3 shortcuts still form, retire IKEv1 proposals, and document cipher suites against county crypto standards. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services. Re-validate after the next platform or policy change.