How is CAPWAP data traffic encapsulated when running an Over the Top WLAN in a Cisco SD- Access wireless environment?

LISP (Location/ID Separation Protocol) is used in SD-Access for control plane functions, specifically for endpoint identification and mapping, not for data plane encapsulation.

Cisco SD-Access utilizes VXLAN as its underlying data plane encapsulation protocol for both wired and wireless traffic within the fabric. When wireless APs are deployed in an "Over-the-Top" fashion, the CAPWAP data tunnels are encapsulated within VXLAN tunnels to carry user traffic across the fabric.

GRE (Generic Routing Encapsulation) is a tunneling protocol but is not the primary data plane encapsulation used by Cisco SD-Access for client traffic.

IPsec is a security protocol for encryption and authentication, not the fundamental data plane encapsulation method for client traffic within the SD-Access fabric itself.