Which of the following statements about policy-based IPsec tunnels are true? (Choose two.)

GRE-over-IPsec is generally implemented with route-based IPsec VPNs, where GRE tunnels are built over the virtual IPsec interface, not typically with policy-based IPsec which uses traffic selectors.

Policy-based IPsec tunnels can be configured in both NAT/Route (gateway) mode and transparent (bridge) mode on a FortiGate, providing flexibility for different network architectures.

For policy-based IPsec VPNs, two firewall policies are essential: one policy to permit outbound traffic from the local network into the tunnel, and another policy to permit inbound return traffic from the tunnel to the local network.

L2TP-over-IPsec is a distinct VPN technology often used for remote access and is not a direct characteristic or general capability of policy-based IPsec tunnels for site-to-site connectivity.