Which tunnel type allows clients to perform a seamless Layer 3 roam between a Cisco AireOS WLC and a Cisco IOS XE WLC?

Cisco's Mobility tunnel (often part of the Mobility Group feature) is specifically designed to allow wireless clients to roam seamlessly between different WLCs, even across Layer 3 boundaries, by maintaining the client's original IP address. This tunnel encapsulates client traffic between WLCs to ensure continuous connectivity during the roam.

IPsec provides secure VPN tunnels but is a generic tunneling protocol not specifically designed for seamless client Layer 3 roaming between WLCs in the way Cisco's Mobility protocol is.

VPNs establish secure connections over a network but do not provide the specialized seamless Layer 3 roaming functionality for wireless clients required between different WLCs.

Ethernet over IP (EoIP) encapsulates Ethernet frames within IP packets, but it is a generic Layer 2 tunneling protocol and does not provide the specialized Layer 3 mobility features offered by Cisco's mobility tunnels for WLCs.