A logistics firm encrypts all inter-site traffic over the Internet but needs unencrypted transport for a private MPLS leg to support non-IPsec inspection, while keeping overlay routing intact. Which data-plane encapsulation choice correctly distinguishes IPsec versus GRE usage?
Select an answer to reveal the explanation.
Short Explanation
You spotted the encryption trade-off perfectly for that mixed network. IPsec secures the wild Internet like a sealed envelope, while GRE carries private traffic openly. Keeping both lets routing stay consistent.
Full Explanation
Cisco SD-WAN data plane defaults to IPsec with encryption for secure transport over untrusted networks such as the Internet, while GRE provides encapsulation without IPsec encryption for trusted private transports or service-insertion cases where inspection devices or underlay constraints require native packets, with both still carrying OMP routes and TLOCs. Reversing the mapping fails by concept because GRE over the Internet leaves traffic unencrypted and IPsec over inspection links breaks visibility that motivated GRE. Using IPsec everywhere fails by concept because mandatory encryption defeats the stated need for unencrypted inspection on the private leg. Using GRE everywhere fails by concept because Internet traffic would lose confidentiality and integrity. Exam caveat: encapsulation is a per-TLOC and per-tunnel property tied to color configuration, not a global fabric toggle. Practical check: in SD-WAN Manager (formerly vManage) confirm tunnel encapsulation per color and verify IPsec versus GRE tunnel counts on the WAN Edge.