Which AES mode should be used in a Cisco SD-WAN environment that includes multicast applications?

AES Galois/Counter Mode is the appropriate AES mode for Cisco SD-WAN environments that include multicast applications. In SD-WAN data-plane security, encryption must protect traffic efficiently while supporting high-throughput forwarding and modern integrity protection. AES-GCM is an authenticated encryption mode, which means it provides confidentiality and integrity in a single efficient operation. It is well suited to modern IPsec designs and avoids the older requirement to combine a confidentiality mode with a separate authentication algorithm. Cipher Block Chaining and Cipher Feedback are older modes and are not preferred for this design requirement. Electronic Code Book is unsuitable because it exposes patterns in plaintext and is not considered secure for network transport encryption. Multicast support also requires a data-plane security model that can scale without per-flow negotiation overhead. AES-GCM is therefore the correct selection for a secure, efficient Cisco SD-WAN deployment that must carry multicast traffic. Reference topics: Cisco SD-WAN encryption, AES-GCM, IPsec data-plane security, multicast transport, authenticated encryption.