A new manufacturing site has dual transports for Internet and MPLS, must build IPsec tunnels on each uplink, identify each path correctly, and permit SSH and NTP inbound only on the MPLS interface. Which transport interface configuration correctly implements color, tunnel interface, encapsulation and allowed services?

Distinct tunnel colors give Internet and MPLS separate transport identities, allowing policy-based path selection and SLA monitoring per uplink. IPsec encapsulation meets the requirement for encrypted tunnels on both transports, while permitting inbound SSH for management and NTP for time synchronization only on the MPLS interface enforces least-privilege access without exposing the Internet edge. Allowing SSH and NTP on the Internet interface instead puts those services on the wrong transport and violates the MPLS-only requirement, even though the tunnel colors and IPsec are appropriate. GRE encapsulation provides neither the required IPsec protection nor compliance with the mandate to build IPsec tunnels, despite having distinct colors and correct service placement. Using a shared color preserves IPsec and MPLS-only access but gives both transports the same identity, undermining path distinction, steering, and failure isolation. An exam caveat: colors and encapsulation define transport and overlay properties, whereas allowed services are interface-level access controls; do not confuse routing identity with access policy. As a practical check, verify each tunnel’s color and encapsulation, confirm the controller shows two distinct transports with established IPsec sessions, and test that SSH and NTP work via MPLS but are refused on the Internet interface.