Which tunnel type allows seamless Layer 3 client roam between a Cisco AireOS WLC and a Cisco IOS XE WLC?

CAPWAP (Control and Provisioning of Wireless Access Points) is the correct answer because it's the standard protocol used by Cisco WLCs (both AireOS and IOS XE) for managing access points. CAPWAP tunnels encapsulate client traffic and control messages, allowing the WLC to maintain client sessions even when roaming between APs managed by different WLC platforms, as long as they are part of the same mobility group. This provides seamless Layer 3 roaming. IPsec and VPN are general-purpose secure tunneling protocols but are not specifically designed for or inherently capable of managing seamless client roaming between WLCs. Ethernet over IP (EoIP) is a tunneling protocol that encapsulates Ethernet frames in IP packets, but it doesn't provide the necessary control plane for seamless Layer 3 client roaming across different WLC platforms.