Which VPN technology minimizes the impact on VPN performance when encrypting multicast traffic on a Private WAN?

DMVPN can carry multicast but must replicate multicast traffic as individual unicast streams to each spoke router, which increases overhead and does not minimize performance impact.

Standard IPsec VPN does not support multicast natively and requires GRE encapsulation before encryption, which adds overhead and does not preserve original multicast addressing.

FlexVPN can support multicast but requires additional encapsulation such as mGRE and is not architecturally optimized for native multicast preservation the way GETVPN is on private WANs.

GETVPN encrypts the payload while preserving the original IP header, which means multicast group addresses remain visible to WAN routers and multicast routing continues to function normally. This architecture eliminates the need to replicate or convert multicast to unicast, minimizing performance impact on private WANs such as MPLS where the original addressing must be maintained.