A network architect is documenting the Cisco Catalyst SD-WAN fabric for a new deployment. She needs to identify which component sits in the branch and data center sites, establishes IPsec data plane tunnels to other sites, and forwards actual user traffic through the overlay. Which SD-WAN component performs this role?