A campus IOS XE GRE tunnel to a secure internet gateway is up. A capture on the internet shows the inner addresses in the clear. The gateway's guide requires IPsec as well as GRE. What should be added?
Select an answer to reveal the explanation.
Short Explanation
The tube is up and anyone on the street can read the cargo. You add IPsec protection on the GRE tunnel, because the guide wants both. A second cleartext GRE tunnel does not encrypt the first, and denying ESP blocks the protection you still need.
Full Explanation
GRE alone does not encrypt. The capture shows inner addresses because no IPsec profile is protecting the tunnel, and the secure internet gateway's guide requires IPsec as well as GRE. Apply tunnel protection with a matching IPsec profile. A second unprotected GRE tunnel only creates another cleartext path. OSPF authentication checks routing hellos. It does not encrypt the user packets a capture can already read. An ACL that permits GRE and denies ESP leaves the current tunnel in place and blocks the ESP the profile will send. Exam caveat: the profile has to match what that gateway expects, including the transform. A profile copied from an AWS VPN may not be the one this SIG will negotiate. Operational check: a capture outside the tunnel should show ESP or UDP 4500 instead of readable inner addresses, and the SIG portal should still show the tunnel up.