A school district overlays student-info traffic with GRE and then protects that path with IPsec. How should staff describe each technology's role?
Select an answer to reveal the explanation.
Short Explanation
GRE is the shipping crate that lets the district's private addressing ride across the ISP. IPsec is the lock and seal on that crate. Mix up those jobs and you will either ship cleartext or lock an empty box.
Full Explanation
A school district that overlays student-info traffic with GRE and then protects that path with IPsec should describe each technology by its role in the combined design. GRE provides the overlay encapsulation so student-info IP (or multiprotocol) traffic can traverse intervening networks as a tunnel. IPsec supplies encryption and integrity for the encapsulated traffic so the district does not send sensitive student information in cleartext on the underlay. Encapsulation versus cryptography is the correct division of labor. IPsec does not create the multiprotocol overlay while GRE only encrypts underlay ISP billing packets—that reverses the roles. GRE and IPsec are not interchangeable names for the same VRF feature; VRF is routing-table virtualization, distinct from tunnel encapsulation and crypto. IPsec does not build VXLAN VNIs while GRE assigns LISP EIDs to each student device; VNIs and LISP EIDs belong to other network-virtualization toolkits. Exam caveat: order and scoping matter—GRE-inside-IPsec versus IPsec protecting GRE traffic must match platform guidance, and omitting IPsec leaves the GRE overlay cleartext despite a tunneled student path. Operational check: verify GRE endpoints and overlay routing for student-info subnets, confirm IPsec SAs protect that GRE path, capture on the WAN to ensure payloads are not cleartext, and test application reachability after both layers are up.