Company XYZ has designed their network to run GRE over IPsec on their Internet-based VPN to connect two sites. Which IPsec tunneling feature can they enable to optimize the data flow while ensuring…

Tunnel Mode wraps the entire GRE packet in a new IP header, creating a duplicate outer IP address on top of the existing GRE tunnel IP header and adding unnecessary overhead - exactly the problem the question asks to avoid.

When a GRE tunnel is protected by IPsec, GRE already provides the outer IP encapsulation; enabling IPsec Transport Mode encrypts only the inner GRE payload without adding a new outer IP header, which prevents duplicate outer IP addresses and optimizes data flow by minimizing total header overhead compared to Tunnel Mode.

Although Transport Mode is the correct IPsec mode for GRE over IPsec optimization, this option incorrectly associates it with Phase II; the relevant IKE negotiation phase for establishing this GRE-IPsec Transport Mode configuration is Phase I.

Tunnel Mode in Phase II appends an additional outer IP header to the already-GRE-encapsulated packet, resulting in redundant IP addresses and increased overhead rather than optimizing the data flow.