Which tunnel protocol is automatically established between WAN Edge routers in Cisco SD-WAN fabrics?

• A. Generic Routing Encapsulation (GRE)
• B. IPsec
• C. Control And Provisioning of Wireless Access Points (CAPWAP)
• D. Virtual Extensible LAN (VXLAN)

Answer: (B)

In Cisco SD-WAN fabrics, the data plane between WAN Edge routers is carried by IPsec tunnels that are automatically established to form the secure overlay across any underlying transport. The fabric’s control plane (vBond, vSmart) handles device authentication and policy, but the actual tunnels that carry user traffic are IPsec, providing encryption, integrity, and authentication for the WAN links. GRE, CAPWAP, and VXLAN have different, more specific roles (GRE as a general tunnel, CAPWAP for wireless APs, VXLAN for data-center L2 overlays) and are not the standard secure tunnel used between WAN Edges in this context.