Which technology is used to send multicast traffic over a site-to-site VPN?

IPsec in tunnel or transport mode natively handles only unicast traffic and cannot encapsulate multicast or broadcast packets. GRE encapsulation wraps multicast packets as unicast GRE packets, which IPsec can then encrypt and forward across the site-to-site VPN. Cisco IOS routers fully support GRE over IPsec with multicast enabled on the tunnel interface, making them the correct platform for this requirement.

Cisco Firepower Threat Defense (FTD) does not support GRE tunnel interfaces, so GRE over IPsec is not a supported configuration on FTD.

A native IPsec tunnel on FTD cannot carry multicast traffic because IPsec itself has no mechanism to encapsulate or forward multicast packets.

Cisco ASA does not support GRE tunnel interfaces, making GRE-based encapsulation unavailable on the ASA platform regardless of the IPsec configuration.