Campus and cloud Cisco IOS XE routers exchange routes over GRE across the public internet. The security team requires the payload to be encrypted. GRE is up and readable on a capture. What should be added?
Select an answer to reveal the explanation.
Short Explanation
A clear plastic tube across the street is not a locked case. You put an IPsec profile on the GRE tunnel at both ends so the payload is encrypted. OSPF authentication only checks the routing hello, and permitting GRE while denying ESP keeps the tube clear.
Full Explanation
GRE across the public internet does not encrypt the passenger traffic. Tunnel protection with an IPsec profile wraps the GRE packets so a capture on the internet sees IPsec rather than the inner payload. Both IOS XE routers need the matching profile. OSPF authentication proves the hello came from a trusted neighbor. It does not encrypt user packets, which is why the capture can still read them. A secure internet gateway is an inspection service for internet-bound traffic. It is not required just because two routers use GRE, and inserting one would not by itself protect this GRE tunnel. An ACL that permits GRE and denies ESP leaves the current cleartext GRE in place and blocks the protection you are about to add. Exam caveat: the profile has to match on both ends, including the transform and the identity. A profile on only the campus side will blackhole the tunnel that is up today. Operational check: a capture outside the tunnel should show ESP or UDP 4500 rather than readable inner addresses, and the GRE interface should still show up under the protection.