A company's private MPLS WAN must encrypt any-to-any traffic among 80 sites. The carrier requires that original IP headers remain visible so its QoS and routing keep working, and the team wants no point-to-point tunnels. Which technology fits?
Select an answer to reveal the explanation.
Short Explanation
Picture every branch carrying the same house key, so any branch can lock and unlock packets for any other without a private hallway between each pair. That's GETVPN — group keys from a key server and no tunnels. The trap is DMVPN; it wraps packets in new headers, which is exactly what your carrier can't have.
Full Explanation
Group Encrypted Transport VPN provides tunnel-less, any-to-any encryption for private WANs. A key server authenticates each group member through GDOI and distributes common traffic encryption keys and policy. Members encrypt traffic with IPsec tunnel mode using header preservation, copying the original source and destination addresses into the outer header, so the carrier's routing, multicast, and QoS treatment continue to work. Because every member shares the group key, any site can decrypt traffic from any other without per-pair security associations, which scales well to 80 sites. DMVPN builds GRE tunnels with new outer headers carrying tunnel endpoint addresses, so the original headers are hidden from the carrier, and it relies on per-peer tunnels. FlexVPN hub-and-spoke uses point-to-point IKEv2 tunnels and hairpins traffic through the hub, which violates both stated requirements. An SSL VPN design centralizes decryption at a head-end and creates client-style connections rather than any-to-any site encryption. Exam caveat: GETVPN depends on routable original addresses, which is why it suits private MPLS but not the public internet with private addressing. Operational check: on a group member, confirm registration with the key server and that the current key policy is installed, then verify that encrypted packets still carry original source and destination addresses.