A network engineer must connect two remote enterprise sites over a service-provider IP backbone that does not support the customer's dynamic routing protocol natively. The engineer needs a virtual point-to-point overlay that can carry OSPF adjacencies and multicast traffic between the sites' routers, but data confidentiality is being handled separately by an application-layer solution. Which device virtualization / data-path technology BEST meets these requirements with the least configuration overhead?