Which of the following statements is true regarding the differences between route-based and policy-based IPsec VPNs? (Choose two.)

Firewall policies for policy-based VPNs are bidirectional, meaning a single policy defines traffic in both directions over the tunnel. In contrast, route-based VPNs typically require two separate, unidirectional firewall policies (one for each direction) to allow traffic in and out of the virtual IPsec interface.

In policy-based VPNs, traffic is *not* routed to a virtual IPsec interface; instead, the policy itself specifies which traffic should be encrypted and sent over the tunnel. Routing to a virtual IPsec interface is characteristic of *route-based* VPNs.

For route-based VPNs, the firewall policy action is typically 'Accept' (or 'Deny') as traffic is simply allowed or denied to the virtual IPsec interface, with the routing table determining the tunnel. For policy-based VPNs, the firewall policy explicitly has an 'IPsec' action that binds the traffic to a specific Phase 2 selector and initiates the tunnel.

Route-based VPNs *do* use a virtual IPsec interface (e.g., a 'vpn-tunnel' interface) to which routes are added, whereas policy-based VPNs rely solely on the firewall policy to define the encrypted traffic without a dedicated virtual interface for routing.