A service provider wants to connect customer SD-WAN CPE devices to their Virtual WAN using IPsec with BGP so each customer site advertises site routes dynamically. Which sequence of Virtual WAN objects and configuration settings is required to establish BGP over IPsec for each SD-WAN site?

To establish BGP over IPsec with Azure Virtual WAN, you must define a VPN site for each customer CPE, providing its public IP address. Within the VPN site properties, configure the customer's BGP peer ASN and peer IP address, which are essential for dynamic route exchange. Finally, create a connection from the Virtual Hub to this VPN site, ensuring BGP is explicitly enabled on this connection. Setting linkSpeedInMbps accurately reflects the site's bandwidth capacity, crucial for proper routing and traffic management. Incorrect options: Deploying VNet Gateways in spokes and using local network gateway objects with ExpressRoute is for VNet-to-VNet or on-premises to VNet connectivity, not for connecting SD-WAN CPEs directly to Virtual WAN via IPsec/BGP. Creating an ExpressRoute circuit per site is for dedicated private connectivity, not for IPsec VPNs over the internet. Azure Virtual WAN Device Manager is for managing devices, but it doesn't replace the need for IPsec for secure connectivity, and Azure Route Server is for BGP peering within VNets, not directly with external SD-WAN CPEs over the public internet without IPsec.