An organization is working on a design solution for a new Internet-based remote access virtual private network that has 1000 remote sites. A network administrator recommends GETVPN as the model…

GETVPN is specifically designed to scale to thousands of sites using a group-based keying model, so lack of scalability is not a valid concern.

GETVPN requires Group Members to register with a Key Server (KS) to obtain IPsec group keys. When deployed over the public Internet, the KS must have a publicly routable IP address, exposing it to attack from any Internet-connected host. This is a fundamental architectural mismatch because GETVPN assumes a trusted private transport and lacks the endpoint authentication model needed to protect a publicly exposed KS.

GETVPN and DMVPN can interoperate in certain hub-and-spoke designs; non-interoperability is not an inherent limitation.

GETVPN uses periodic rekey messages rather than continuous background traffic, and it does not require excessive keepalive traffic to maintain its IPsec SAs.