Your customer recently acquired a company with a national WAN of 750 locations consisting of MPLS VPN-based sales, Internet-based sites and sites with direct links to regional hub sites. The existing

DMVPN operates over any IP underlay - including both MPLS and Internet connections - and the hierarchical hub-and-spoke design scales efficiently to hundreds of branches without requiring a uniform transport. Combining DMVPN with IPsec provides the cryptographic encryption required by the audit across all site types, making it the only solution that works universally across the mixed WAN environment described.

Migrating all sites to MPLS VPN does not provide encryption because standard MPLS VPN relies on label switching and provider-level isolation rather than cryptographic security, and migration may not be feasible for Internet-only sites.

GETVPN uses a tunnel-less architecture that requires a shared routable IP network such as MPLS and cannot extend encryption to Internet-based sites that do not share the same private IP address space.

Adding redundant key servers improves GETVPN availability but does not resolve the fundamental limitation that GETVPN cannot operate over Internet-based sites lacking connectivity to the private key server infrastructure.