An administrator is planning a VPN configuration that will encrypt traffic between multiple servers that will be passing unicast and multicast traffic. This configuration must be able to be implemente

FlexVPN creates IKEv2-based virtual tunnel interfaces and requires routing protocol or static route changes to direct traffic into the tunnels.

VTI (Virtual Tunnel Interface) creates point-to-point or point-to-multipoint tunnels that require routing configuration to steer traffic; it also does not natively support multicast encryption.

GETVPN uses the GDOI (Group Domain of Interpretation) key-management protocol and IPsec tunnel-less encryption, meaning the original source and destination IP headers are kept intact inside the encrypted packet. This header preservation means the existing routing infrastructure does not need to change. Additionally, GETVPN natively supports multicast traffic encryption, making it the correct choice when both unicast and multicast must be protected without routing redesign.

DMVPN uses GRE tunnels over NHRP and requires routing protocol changes (typically OSPF or EIGRP) to populate the routing table with spoke prefixes; multicast support is via GRE, not native encryption.