A company needs to securely connect its headquarters router to a branch office router over the public internet. All traffic between the two sites' internal subnets must be encrypted automatically without requiring any user interaction, and the tunnel should remain established at all times. Which solution best meets these requirements?