Which secure tunnel type should be used to connect one WAN Edge router to other WAN Edge routers?

DTLS is the default protocol for control plane connections between WAN Edge routers and vSmart controllers, but TLS is also a valid alternative.

SSL VPNs are typically used for remote user access to a network, not for forming the core site-to-site overlay network between WAN Edge routers in Cisco SD-WAN.

IPsec is used for the data plane tunnels between WAN Edge routers to encrypt user traffic, not for the underlying control plane connections that establish the overlay itself.

TLS can be used as the secure tunnel type for establishing control plane connections between WAN Edge routers and vSmart controllers, which are fundamental for building the overlay network that logically connects WAN Edge routers. While DTLS is the default for control, TLS is an alternative when TCP is preferred.