On-premises does not support BGP and has 30 CIDR ranges. Your VPN gateway creates a unique child SA per CIDR. Which two Google-recommended methods allow Google Cloud to reach all 30 CIDRs? (Choose two.)

Route-based VPNs are recommended when the on-premises gateway doesn't support BGP and has many CIDR ranges, as they simplify configuration by using a single tunnel to advertise all routes. Policy-based VPNs create a unique Security Association (SA) for each local-remote CIDR pair. If the on-premises gateway creates a unique child SA per CIDR, you must create a separate tunnel for each CIDR pair. To avoid issues with multiple SAs from the same peer IP, each tunnel should connect to a unique peer IP address on the on-premises side. Creating a single policy-based tunnel with multiple remote traffic selectors would fail because the on-premises gateway expects a unique SA per CIDR, not per tunnel. Similarly, creating multiple policy-based tunnels to the same peer IP address would likely cause SA negotiation problems.