Refer to the exhibit. A company named XYZ has two data centers. A recent change to the company's security policy states that the firewall must not inspect intrazone communication between the data…

GRE tunnels can transport VRF-specific traffic between data center routers, effectively extending each VRF across the WAN so that communication within a given VRF is intrazone from the firewall's perspective and therefore bypasses inspection. This approach also scales well as additional VRFs (zones) are added due to application transformation, since each new VRF tunnel simply extends the new zone to both sites.

An L2VPN service provides Layer 2 bridging between sites but does not extend Layer 3 VRF instances between routers, so it does not satisfy the zone-based firewall requirement to keep intrazone routing domains consistent across data centers.

Enabling MPLS through a GRE tunnel describes a transport encapsulation technique but does not by itself extend VRF instances between data center routers to satisfy the intrazone firewall inspection bypass requirement.

Interconnecting data center switches through an L2VPN service provides Layer 2 adjacency between switches but does not extend Layer 3 VRF instances between routers, failing to meet the per-zone routing isolation requirement for zone-based firewall policy.

MPLS L3VPN services natively extend Layer 3 VRF instances between sites, ensuring that intra-VRF traffic between the two data centers is treated as intrazone by the firewall and thus not inspected. L3VPN also scales efficiently as the number of zones grows because each VRF maps directly to a separate VPN instance.