A company is setting up a dynamic crypto map on the Cisco ASA at the headquarters to accept connections from the branch offices. There will be no IP subnet overlap between the branch offices, but…

RRI instructs the ASA to automatically create static routes for each encryption domain negotiated when a remote peer brings up an IPsec tunnel. This satisfies both constraints simultaneously - the HQ ASA does not need to know branch subnets in advance because routes are injected dynamically, and no routing protocol is used, so no routing traffic leaves the HQ network.

The tunneled keyword on a default route is a configuration applied on branch routers to direct traffic into the tunnel, not a solution for the HQ ASA to learn return routes to branch subnets.

Static routes require the administrator to know all remote subnets before configuration, which is impossible in this scenario where branch encryption domains are unknown in advance.

EIGRP is a dynamic routing protocol, and its use would directly violate the company security policy prohibiting routing protocol traffic from leaving the HQ network.