Which restriction prevents a designer from using a GDOI-based VPN to secure traffic that traverses the Internet?

Non-routable enterprise IP addresses are a general Internet routing issue that affects all VPN types equally and is not a restriction specific to GDOI or GET VPN.

GDOI and GET VPN are not less secure than traditional IPsec; they provide equivalent encryption with the added benefit of scalable group key management via a key server.

GET VPN uses tunnel-header preservation, meaning the original source and destination IP addresses remain in the outer IP header after encryption rather than being replaced by tunnel endpoint addresses. NAT devices in the Internet path attempt to rewrite those outer IP addresses, but because those addresses fall within the IPsec-protected scope, the modification breaks IPsec integrity verification and causes packet drops. This incompatibility restricts GET VPN to private MPLS or non-NAT environments where the original IP addressing is preserved end to end.

GDOI does not prohibit the use of public IP addresses; the actual restriction is NAT incompatibility caused by tunnel header preservation, not any limitation on address type.