What is the primary role of IPSec in an SD-WAN deployment?

• A. IPsec is primarily used to assign IP addresses to branches.
• B. IPsec handles load balancing across multiple underlays.
• C. IPsec provides encryption and data integrity for tunnels between edges, ensuring confidentiality and integrity of traffic across the SD-WAN fabric.
• D. IPsec substitutes the need for a firewall in SD-WAN.

Answer: (C)

The main idea is that IPSec in an SD-WAN deployment is about securing the transport between edge devices. It creates encrypted, authenticated tunnels that run over the underlay networks (like the Internet or private links) so traffic between branches remains confidential and unmodified as it traverses the SD-WAN fabric. This protection comes from encryption and integrity checks (and anti-replay protection), typically using ESP in tunnel mode with a key exchange mechanism (IKE) to establish and refresh the secure tunnels and authenticate the peers.

This role is distinct from assigning IP addresses, which is handled by addressing services or DHCP, and from load balancing across underlays, which is handled by the SD-WAN’s path selection and traffic engineering mechanisms. It also doesn’t replace firewall functionality; security policies and firewall features are still needed for application-aware protection. In short, IPSec provides confidentiality and integrity for the tunnels between SD-WAN edges, safeguarding traffic across the fabric.