hi,
as per my SECURE notes, it looks like GET VPN is ideal for MPLS. and yes, DMVPN is tunnel-based.
kindly see the difference between the two VPN-based technology and summary of each features.
* Cisco Dynamic Multipoint VPN (DMVPN): DMVPN is based on a hub-and-spoke configuration but allows spoke-to-spoke tunnels to be dynamically and automatically provisioned. Configuration scalability is high because only spoket-to-hub peering needs to be configured, and as long as PIKI is used for authentication, authentication scalability is high as well. DMVPN can be used in hub-and-spoke, partial mesh, and full mesh environments. It is also adequate for connections that traverse public networks, such as the Internet, because it supports IP tunnels.
* Cisco GET VPN: Cisco GET VPN uses a mixed encapsulation in which the IP addressing of the packets does not get changed as it is encapsulated. Because of this, it can only be deployed over networks that can route the internal addresses, such as Multiprotocol Label Switching (MPLS) or private WAN circuits. GET VPNs cannot be deployed over the Internet because of this. Cisco GET defaults to a full mesh topology with a small number of policy/authentication hubs called key servers. Because of this, Cisco GET provides high configuration and authentication scalability.
Criterion DMVPN GET VPN
Encapsulation Tunneled IPsec Non-tunneled IPsec
Configuration High for any device High for any device
scalability
Authentication High with PKI High with PSK or PKI
scalability
Suitable topologies Hub-and-spoke/Partial Mesh Full mesh
Suitable transport Any, including the Internet Private WAN or MPLS, no Internet
networks
