An engineer wants OSPF to run across an IPsec site-to-site connection between two sites and wants traffic selected for encryption by routing rather than by an access list that names the protected networks. Which approach provides this?
Select an answer to reveal the explanation.
Short Explanation
A crypto ACL is like a guest list at the door — only names on the list get in. A virtual tunnel interface is more like a hallway: whatever routing sends down it gets protected, including OSPF's multicast hellos. That's why route-based beats policy-based when you need a routing protocol across the tunnel.
Full Explanation
A virtual tunnel interface is a logical interface with IPsec protection applied directly to it. Because it behaves like any other routed interface, it can carry an IP address, participate in dynamic routing, and forward multicast, so OSPF can form an adjacency across it. Traffic is selected for encryption by the routing table: anything routed out the tunnel interface is encrypted, and the protected networks can change as routes change without editing access lists. This route-based model is the standard way to run routing protocols over IPsec between two sites. A policy-based tunnel selects traffic with an access list of source and destination networks; it does not provide an interface for a routing protocol, and OSPF multicast hellos are not carried natively, so a separate GRE tunnel would be needed. GETVPN uses a key server to distribute keys and policy, not routes; members rely on the existing WAN routing. SSL VPN connects remote clients and is not used to build routed site-to-site adjacencies, and IPsec can carry multicast once a tunnel interface exists. Exam caveat: on Cisco Secure Firewall, route-based VPN uses a VTI, while policy-based VPN uses protected-network definitions. Operational check: confirm the tunnel interface is up, verify the OSPF neighbor reaches the full state across it, and confirm that encrypt and decrypt counters increase.