A manufacturing firm connects a Detroit plant to a Monterrey plant over the public internet. Engineers must carry EIGRP routing updates plus legacy non-IP protocols for shop-floor controllers, while security mandates encrypted transport for all inter-site traffic. Which site-to-site VPN tradeoff decision correctly balances multiprotocol support with encryption overhead?
Select an answer to reveal the explanation.
Short Explanation
You're juggling factory protocols that pure IPsec simply won't carry. GRE acts as the delivery truck for routing and non-IP cargo, while IPsec provides the armored vault around it. Together you get reach plus secrecy.
Full Explanation
GRE provides a virtual point-to-point interface that encapsulates multiprotocol traffic and supports multicast for dynamic routing protocols, while IPsec adds confidentiality and integrity, so GRE-over-IPsec combines routability with encryption at the cost of extra headers and MTU considerations. Native IPsec tunnel mode alone fails by concept because IPsec protects unicast IP without native multicast or non-IP encapsulation, so it cannot carry EIGRP hellos or legacy protocols without GRE. GRE alone without IPsec fails by concept because GRE provides encapsulation without encryption or strong authentication, violating the mandated encrypted transport. IPsec transport mode alone fails by concept because transport mode protects host-to-host payloads and does not provide the tunnel virtual interface needed for routing adjacency across sites. Exam caveat: choose GRE-over-IPsec when routing or non-IP must cross encrypted VPN. Practical check: confirm tunnel interface status, routing adjacency, and crypto session counters together.