Which configuration construct must be used in a FlexVPN tunnel?

EAP is an optional authentication method that may be used within an IKEv2 profile, but it is not a required construct for every FlexVPN deployment.

Multipoint GRE tunnel interfaces are associated with DMVPN, not a required component of FlexVPN tunnels.

FlexVPN is built exclusively on IKEv2; IKEv1 policies are incompatible with the FlexVPN framework.

FlexVPN exclusively uses IKEv2 as its key management protocol, and the IKEv2 profile is a required construct that ties together authentication methods, authorization policies, and virtual template interfaces. Without an IKEv2 profile, the router cannot map inbound IKEv2 negotiations to the correct tunnel parameters. All other FlexVPN components depend on this profile being defined.