Two branches each have dual transports but only one IPsec tunnel forms instead of four. Both use the same system IP scheme and colors look mismatched in SD-WAN Manager. Which TLOC-structure insight explains how system IP, color and encapsulation drive tunnel formation?

The correct insight is that a TLOC is the tuple of system IP, color and encapsulation, and tunnels form only between compatible local and remote TLOCs learned through OMP, which is why two dual-transport branches should yield four tunnels when system IPs are unique, colors pair correctly, and encapsulation matches, but collapse when duplication and mismatch exist. The explanation that duplicate system IPs only limit control sessions while matching colors still build the mesh fails because uniqueness is overlay identity: duplicated IPs cause the SD-WAN Controller to conflate devices, corrupt OMP advertisements, and prevent correct TLOC resolution even if colors align. The explanation that every local TLOC meshes with every remote TLOC regardless of color or encapsulation fails because tunnel formation is selective: private colors only pair with the same color and encapsulation must match, so mismatches prune tunnels. The explanation that unique system IPs ensure reachability so available transports can establish tunnels reflects onboarding logic, yet it fails because underlay reachability is insufficient when colors signal different transports and GRE will not pair with IPsec. As an exam caveat, separate controller control connections from data-plane tunnels, since control can look healthy while TLOC mismatch keeps tunnels partial. As a practical check, compare show sdwan omp tlocs with tunnel connections to confirm unique IPs, paired colors, and consistent IPsec.