Which of the following is true regarding the IPsec VPN between the NSGs?

In the Nokia Nuage Networks VNS (Virtualized Network Services) solution, an overlay network is created using VXLAN to carry traffic between different sites. When this traffic must traverse an untrusted underlay network, such as the public internet, IPsec is used to provide security. The IPsec tunnel is established between the Network Services Gateways (NSGs). The entire VXLAN packet, including its headers and the original payload, is encapsulated and encrypted by IPsec (typically using ESP). This ensures the confidentiality and integrity of the overlay traffic as it transits the underlay.

B. Nuage VNS uses a centralized and automated security model. The VSD (Virtualized Services Directory) orchestrates a PKI, issuing certificates to NSGs for authentication and using IKEv2 for dynamic key exchange, not manual keys.
C. IPsec tunnels from the branch are terminated on dedicated data center gateway components like a VRS-Gateway (VRS-G), a 7750 SR, or a VSR. The VRS is the virtual switch within the hypervisor and does not terminate WAN IPsec tunnels.
D. While enabling an encryption function is a necessary configuration step, option A provides a more fundamental and descriptive truth about the architectural role of IPsec in the VNS solution—specifically, how it interacts with VXLAN.

1. Nokia Nuage Networks, Virtualized Network Services (VNS) Fundamentals Student Guide, R19.10, 2019.

Section: VNS Security. This guide explains that the VNS solution uses IPsec to secure the VXLAN tunnels over the WAN underlay. It explicitly states, "The data path between the NSG and the data center gateway is an IPsec-protected VXLAN tunnel," which directly supports answer A.

Section: VNS Security. The guide details the automated security establishment process: "The VSD acts as the PKI and certificate authority (CA) for the VNS. The VSD issues a certificate to each NSG after it has been bootstrapped. The certificates are used to authenticate the NSGs during the IKEv2 exchange." This confirms that manual keying (Option B) is not the required method.

Section: VNS Components. The roles of the VNS components are defined. The VRS is described as the data plane element in the hypervisor, while the VRS-G is presented as a software-based data center gateway that terminates VXLAN and IPsec tunnels. This distinction proves Option C is incorrect.

2. Nokia Nuage Networks, VNS User Guide, R19.10, 2019.

Chapter: System Overview > VNS Solution. This document describes the architecture where "IPsec is used to encrypt traffic over the Internet between the branch (NSG) and the data center (DC gateway) or between two branches." It clarifies that the traffic being encrypted is the VXLAN overlay traffic, reinforcing answer A.