A customer asks you to perform a high level review of their upcoming WAN refresh for remote sites. The review is specially focused on their retail store operations consisting of 500+ locations connect

EIGRP is fully supported over DMVPN and multipoint IPsec tunnel interfaces and scales well with spoke-to-hub deployments using split-horizon tuning.

IS-IS is a Layer 2 OSI protocol that runs directly over data-link layer adjacencies and cannot be encapsulated over IP-based tunnel interfaces such as IPsec or GRE. Because multipoint IPsec VPN designs rely on logical tunnel interfaces for spoke connectivity, IS-IS adjacencies cannot form across those tunnels. This makes IS-IS the most restrictive choice for expanding a 500+ site multipoint IPsec VPN deployment.

OSPF supports multiple network types including point-to-multipoint, which maps directly to hub-and-spoke IPsec VPN topologies, making it a common and valid choice.

BGP is the most scalable option for large-scale VPN deployments and is natively used in many MPLS and IPsec overlay designs with no tunnel interface restrictions.