Which protocol encrypts control-plane traffic between SD-WAN controllers and SD-WAN endpoints?

DTLS (Datagram Transport Layer Security) is used to encrypt the control-plane traffic between SD-WAN controllers (vManage, vSmart, vBond) and SD-WAN endpoints (vEdge routers). It provides secure communication over UDP, which is essential for the real-time nature of control-plane exchanges. While IPsec is used for data-plane encryption between vEdge routers, it's not the primary protocol for control-plane communication with controllers. PGP (Pretty Good Privacy) is for email and file encryption, not network control planes. HTTPS uses TLS over TCP and is typically used for web-based management interfaces, not the underlying control-plane communication between SD-WAN components.