# DMVPN and FlexVPN Technologies

> Chapter 12 of the Courseiva ENARSI curriculum — https://courseiva.com/learn/enarsi/dmvpn-and-flexvpn

**Official objective:** 2.3 — Configure and verify DMVPN and FlexVPN

## Introduction

How do you connect hundreds of branch offices to a company's headquarters and to each other without buying expensive dedicated cables between every pair of sites? That is the core problem that Dynamic Multipoint VPN (DMVPN) and FlexVPN solve, and it is why Cisco's 300-410 exam tests your understanding of these technologies. If you are studying for this exam, mastering DMVPN and FlexVPN is non-negotiable because they are the most common methods enterprises use to build scalable, secure, and cost-effective wide-area networks (WANs).

## The Private Driver Guild Analogy

When a company's first few employees need to visit a client site, you might book them a single taxi each time. That works for a few people. As the company grows to hundreds of employees needing secure, reliable transport to dozens of client sites every day, booking individual taxis becomes a nightmare of scheduling, cost, and security. This leads to the company forming a Private Driver Guild. The Guild has a central office that registers every driver and every client site once. Whenever an employee near a client site needs transport, they signal the Guild's central coordinator. The coordinator instantly finds the closest registered driver and establishes a direct, encrypted route between that driver and the client site. If the driver's usual vehicle breaks down, the Guild automatically reroutes another driver without any call to the central office. The Guild saves the company from negotiating separate contracts with each taxi company for every trip. It also allows any registered employee to securely reach any registered client site directly, even if they have never driven that route before. The central office only handles the initial registration and security checks, not every single journey. For the 300-410 exam, DMVPN operates like this Guild: a central hub registers spoke sites (like employees), and then any spoke can talk to any other spoke directly without routing every packet through the hub.

## Core explanation

Let's start with the big picture. A Wide Area Network (WAN) connects computers that are far apart, like a branch office in London and headquarters in New York. Before the technologies we call Software-Defined WAN (SD-WAN) became popular, companies used two main approaches to build WANs: leased lines and VPNs. A leased line is a dedicated physical cable or circuit you rent from a telecom provider. It is very secure and fast, but it is also extremely expensive, especially when you need to connect many sites. A VPN, or Virtual Private Network, solves the cost problem by using the public internet to create a secure, encrypted 'tunnel' between sites. DMVPN and FlexVPN are specific Cisco implementations of VPN technology. They are both part of the 'Dynamic Multipoint VPN' family, which means they are designed to let many sites connect to each other dynamically, without needing a human to manually configure every single connection.

**DMVPN (Dynamic Multipoint VPN)** works using three main components: a Hub, multiple Spokes, and a routing protocol. Think of the Hub as a central meeting point that every branch site registers with. Each branch site is a Spoke. The routing protocol (typically EIGRP or OSPF) is the language they use to tell each other, 'I am here and I can reach these networks.' When a Spoke wants to talk to the Hub, it creates a direct IPsec (IP Security) tunnel. IPsec is a set of protocols that encrypts the data, making it unreadable to anyone who intercepts it on the internet. The clever part is when one Spoke wants to talk to another Spoke. Instead of sending all traffic through the Hub, DMVPN lets the Hub tell the first Spoke, 'The second Spoke is at this IP address, go talk to it directly.' The two Spokes then negotiate a direct IPsec tunnel between themselves, bypassing the Hub. This is called 'spoke-to-spoke' or 'on-demand' tunnel creation. This saves enormous bandwidth on the Hub and reduces latency for the users.

**FlexVPN** is Cisco's newer, more flexible implementation of the same concept. It uses a standard called IKEv2 (Internet Key Exchange version 2) for negotiating the secure tunnels. IKEv2 is more robust and feature-rich than the older IKEv1 used by some early DMVPN deployments. FlexVPN can do everything DMVPN does, but it also supports hub-and-spoke topologies, spoke-to-spoke, and even full mesh (where every site connects to every other site) in a more unified way. The key difference is that DMVPN was built around a specific Cisco protocol called mGRE (multipoint Generic Routing Encapsulation) and NHRP (Next Hop Resolution Protocol). NHRP is the protocol that lets a Spoke ask the Hub, 'Who can reach this remote network?', and the Hub responds with the real public IP address of the target Spoke. FlexVPN, by contrast, is built around the more flexible IKEv2 framework, allowing it to integrate more easily with other Cisco security features and newer authentication methods.

To make this concrete, imagine a company with 50 branch offices. Using FlexVPN or DMVPN, the IT team configures one Hub router at headquarters. Each branch router (Spoke) is configured with just a few lines pointing to the Hub. Once plugged in, each Spoke automatically establishes a tunnel to the Hub. When a user in Branch A wants to access a file server in Branch B, the Branch A router asks the Hub for Branch B's address. The Hub replies, and Branch A and Branch B create a direct encrypted tunnel. The data never has to travel through headquarters, making the connection faster and more reliable. This is why DMVPN and FlexVPN are described as 'any-to-any' connectivity without a 'hairpin' of traffic through a central point.

Exam-relevant features include:
- **Phase 1, 2, and 3 of DMVPN**: Phase 1 is purely hub-and-spoke (all traffic through hub). Phase 2 allows spoke-to-spoke tunnels but requires the hub to be involved in the routing. Phase 3, the most advanced, uses 'redirect messages' from the hub to allow spokes to build direct tunnels without the hub being in the routing path.
- **NHRP Registration**: Each spoke registers its real IP address with the hub using NHRP. This is how the hub builds a database of where every spoke lives.
- **mGRE**: Multipoint GRE allows a single tunnel interface on the hub to handle connections to many spokes, rather than having one tunnel interface per spoke.
- **IPsec Profiles**: Both technologies use IPsec to encrypt traffic. You define an IPsec profile that specifies encryption algorithms (like AES-256) and authentication methods.

For the exam, you must know the differences between DMVPN (Cisco proprietary, uses mGRE and NHRP) and FlexVPN (standards-based IKEv2, more flexible). Both solve the same problem: allowing many branch offices to connect securely to each other and to the corporate HQ using the public internet, with minimal configuration and automatic, on-demand tunnel creation.

## Real-world context

Let's imagine you are a network engineer for a retail chain called 'GreenLeaf Stores'. GreenLeaf has 200 stores across the UK, plus 5 regional warehouses and a central headquarters in Manchester. Currently, each store has an expensive MPLS (Multiprotocol Label Switching) connection from a telecom provider, which costs £500 per store per month. That is £100,000 a month just for WAN connectivity. The CFO demands you cut this cost by 40%. You decide to replace MPLS with internet-based VPNs using DMVPN.

Your first step is to choose a 'hub' site. Headquarters in Manchester is perfect because it has a high-speed internet connection with a static public IP address. You deploy a Cisco ISR 4451 router there and configure it as a DMVPN hub. You configure a single mGRE tunnel interface with NHRP enabled, and assign a 'tunnel key' for security. You also set up an IPsec profile using AES-256 encryption and SHA-256 hashing to ensure all data is secure.

Next, you send a pre-configured router to each of the 200 stores and 5 warehouses. The configuration on each branch router (spoke) is nearly identical. It includes:
- The Hub's public IP address.
- The NHRP authentication string (a shared password).
- The IPsec profile parameters.
- A routing protocol configuration (you choose EIGRP) to exchange network routes.

You ship the routers, and the store managers simply plug them into their existing internet connection. Within minutes, each spoke router establishes an IPsec tunnel to the hub. The hub registers each spoke's public IP address via NHRP. Now, all stores can reach the central inventory database at headquarters securely over the internet.

Now imagine a scenario: a customer in the Cardiff store wants to buy a product that is out of stock there. The cashier checks the system, which queries inventory across all stores. The Cardiff router (Spoke A) needs to talk to the Bristol store's router (Spoke B), which has the item. Because you configured DMVPN Phase 3, when the Cardiff router gets a packet destined for the Bristol network, it sends an NHRP 'resolution request' to the hub. The hub replies with the Bristol router's public IP address. Cardiff and Bristol then negotiate a direct IPsec tunnel between themselves. The data now flows directly from Cardiff to Bristol. This is much faster than sending the query to Manchester and then back to Bristol, and it reduces the bandwidth load on your corporate internet connection.

Here is what you, as the IT professional, actually do day-to-day:
- Monitor the 'show dmvpn' command output to verify that all 200 spokes have registered and are active.
- Troubleshoot when a spoke fails to register, often by checking the NHRP authentication string or firewall settings.
- Upgrade the IPsec profiles as new security standards emerge (e.g., moving from SHA-1 to SHA-256).
- Plan for disaster recovery: if the Manchester hub fails, you might have a secondary hub in another city that spokes automatically fail over to.
- Add new stores: when GreenLeaf opens a new store, you create a standard configuration template with the hub's IP and a unique spoke tunnel IP, then you ship the router. The new store is online within an hour of connecting to the internet.

The result: GreenLeaf cuts its monthly WAN bill from £100,000 to £20,000 (just internet connections). The network is more resilient because spoke-to-spoke tunnels create a mesh of direct paths, and you can centrally manage it all from the Manchester hub. This is why DMVPN and FlexVPN are examined on the 300-410: real companies rely on them every day to balance cost, performance, and security.

## Exam focus

The 300-410 exam specifically tests your ability to configure and verify DMVPN and FlexVPN. This is not a theoretical exercise — you will see questions that ask you to identify the right command to fix a broken tunnel, the correct phase for a given topology, or the difference between two protocols. Here is exactly what you need to know.

**What they love to test:**
- **The Three Phases of DMVPN**: The exam will ask you to identify which phase is being described. Phase 1 is hub-and-spoke only; all traffic passes through the hub. Phase 2 allows spoke-to-spoke tunnels but requires the hub to be in the routing path (meaning the hub's routing table must include all remote networks). Phase 3 uses NHRP redirect and shortcut routes to let spokes build direct tunnels without the hub in the routing path. The trick question: 'In which phase does the hub send a redirect message to the spoke?' Answer: Phase 3.
- **NHRP Commands**: You must memorise key commands like 'ip nhrp network-id', 'ip nhrp nhs', 'ip nhrp map', and 'ip nhrp authentication'. They might show you a config with a mismatch in the network-id or authentication string and ask why the tunnel is not forming. The trap: the authentication string on hub and spoke must match exactly, including case.
- **mGRE vs. p2p GRE**: The hub uses multipoint GRE (tunnel mode gre multipoint) while spokes can use either multipoint or point-to-point GRE. If you see a hub configured with 'tunnel mode gre ip' (point-to-point), it is wrong — that will only allow one spoke.
- **IPsec Profiles**: They will test that DMVPN uses an IPsec profile applied to the tunnel interface, not a crypto map (older method). The command is 'tunnel protection ipsec profile [name]' under the interface. A trap is showing a configuration that uses 'crypto map' instead — that is the old way and will not work with DMVPN.
- **FlexVPN specifics**: FlexVPN uses IKEv2. The exam will test that IKEv2 is more secure and supports EAP (Extensible Authentication Protocol) for certificate-based authentication. You may see a FlexVPN configuration that uses 'crypto ikev2 policy' and 'crypto ikev2 keyring'. Know that FlexVPN can also support hub-and-spoke and spoke-to-spoke like DMVPN, but it does not use NHRP in the same way — it relies on IKEv2 routing and VRF selection.
- **Routing Protocol Interaction**: You must understand that DMVPN requires a routing protocol (typically EIGRP or OSPF) running over the tunnel interface. The trick: on the hub, you must use a 'no ip split-horizon' command for EIGRP, or 'no ip ospf network' adjustments for OSPF, to allow spoke-to-spoke routing updates. The exam will show a scenario where spoke-to-spoke traffic fails because split horizon is blocking route advertisements.
- **Verification Commands**: 'show dmvpn' is the most important command. It shows the status of all NHRP registrations and tunnel status. 'show crypto ipsec sa' shows the IPsec security associations. 'show ip nhrp' shows the NHRP cache. The exam will ask: 'Which command shows the public IP address of a remote spoke?' Answer: 'show dmvpn' or 'show ip nhrp'.

**Common traps:**
- Confusing DMVPN Phase 2 and Phase 3. Phase 2 requires the hub to have routes to all remote subnets; Phase 3 does not because the spoke learns the shortcut route directly.
- Forgetting that the hub's tunnel interface must be in 'multipoint' mode. A common mistake is to configure the hub with 'ip address negotiated' which is wrong. The hub needs a static IP on the tunnel interface.
- Thinking FlexVPN is completely different from DMVPN. In reality, they share many concepts (hub-spoke, encryption, routing). The exam may ask: 'Which technology uses NHRP?' You say DMVPN. 'Which uses IKEv2?' You say FlexVPN (though DMVPN can also use IKEv2 in newer versions, the core focus is DMVPN with IKEv1 and FlexVPN with IKEv2).
- Overlooking the requirement for IP multicast support. DMVPN does not natively support multicast (like video conferencing between spokes) unless you configure additional features like PIM or mGRE with multicast replication. The exam will test this limitation.

**Key terms to memorise:**
- **NHRP (Next Hop Resolution Protocol)**: Used by spokes to register with the hub and to query for remote spoke addresses.
- **mGRE (Multipoint Generic Routing Encapsulation)**: A type of tunnel interface on the hub that can connect to multiple spokes simultaneously.
- **IPsec (IP Security)**: A suite of protocols that encrypts and authenticates IP packets.
- **IKE (Internet Key Exchange)**: The protocol that sets up the IPsec tunnel. IKEv1 is used by classic DMVPN; IKEv2 is used by FlexVPN.
- **Phase 1/2/3**: The three evolutionary stages of DMVPN capabilities.

If you see a question with 'show crypto ikev2 sa active', recognise it as a FlexVPN verification command. If you see 'show dmvpn detail', know it shows NHRP registrations. The exam often presents a shoddy configuration and asks: 'What is the issue?' The answer is usually a mismatch in authentication, network-id, or tunnel key, or a missing 'tunnel protection ipsec profile' command.

## Step by step

1. **Identify the Need for Dynamic VPNs** — Your company has many branch offices that need to talk securely to each other and to headquarters. Leased lines are too expensive. Traditional site-to-site VPNs require you to manually configure every pair of sites, which does not scale. This is where DMVPN or FlexVPN become necessary.
2. **Design the Hub-and-Spoke Topology** — Choose one or two sites as hubs (typically headquarters). Assign a static public IP address to the hub router. This will be the central registration point where all branch sites (spokes) authenticate. All other sites will be spokes.
3. **Configure the Hub Router** — On the hub, create a multipoint GRE tunnel interface. Assign an IP address to it (usually from a private subnet like 10.0.0.1/24). Enable NHRP with a unique network-id and an authentication string. Apply an IPsec profile to the tunnel interface using 'tunnel protection ipsec profile [name]'. Configure a routing protocol (EIGRP or OSPF) over the tunnel.
4. **Configure Each Spoke Router** — On each branch router, create a tunnel interface (can be multipoint or point-to-point). Set the tunnel destination to the hub's public IP address. Use the same NHRP network-id and authentication string as the hub. Configure the spoke as an NHRP client with 'ip nhrp nhs [hub-tunnel-ip]'. Apply the same IPsec profile and routing protocol.
5. **Verify Spoke Registration and Routing** — Once the spoke router is plugged in and connected to the internet, it will automatically establish an IPsec tunnel to the hub. Use 'show dmvpn' on the hub to confirm the spoke has registered. Use 'show ip route' to verify that routes from other sites are being learned. Troubleshoot with 'show crypto ipsec sa' and 'show ip nhrp' for any failures.
6. **Enable Spoke-to-Spoke Direct Tunnels (Optional)** — If you want branch offices to talk directly (not through the hub), configure DMVPN Phase 3. On the hub, enable NHRP redirect with 'ip nhrp redirect'. On each spoke, enable 'ip nhrp shortcut'. Now, when a spoke wants to reach another spoke, the process triggers a direct tunnel negotiation, and traffic bypasses the hub.
7. **Monitor and Maintain the Network** — Use 'show dmvpn detail' to see the number of active tunnels and encryption statistics. Set up syslog or SNMP monitoring to alert you if a spoke fails to register. Periodically review the IPsec profiles to ensure they use strong encryption (AES-256) and authentication (SHA-256). Add new spokes by replicating the spoke configuration template.

## Comparisons

### DMVPN vs FlexVPN

**DMVPN:**
- Uses NHRP and mGRE for dynamic tunnel discovery.
- Typically uses IKEv1 for IPsec key exchange.
- Originated as a Cisco-proprietary solution in the late 1990s.

**FlexVPN:**
- Uses IKEv2 for all tunnel negotiation, no NHRP required.
- Supports EAP and certificate-based authentication out of the box.
- Is a standards-based (RFC 7296) evolution, introduced later by Cisco.

### DMVPN Phase 2 vs DMVPN Phase 3

**DMVPN Phase 2:**
- Allows direct spoke-to-spoke tunnels, but the hub must be in the routing path.
- Spokes learn remote networks via the hub's routing table (no shortcut routes).
- The hub sends routing updates (EIGRP/OSPF) with all remote subnets.

**DMVPN Phase 3:**
- Allows direct spoke-to-spoke tunnels without the hub in the routing path.
- Uses NHRP redirect and shortcut routes installed in the spoke's routing table.
- The hub does not need to have routes to all remote subnets; spokes learn shortcuts via NHRP.

### Hub Configuration in DMVPN vs Spoke Configuration in DMVPN

**Hub Configuration in DMVPN:**
- Configured with 'tunnel mode gre multipoint' to accept multiple connections.
- Uses a static IP address on the tunnel interface.
- Disables routing protocol split horizon (e.g., 'no ip split-horizon eigrp').

**Spoke Configuration in DMVPN:**
- Can use either multipoint or point-to-point GRE tunnel mode.
- Uses a static or negotiated IP on the tunnel interface.
- Does not need to disable split horizon; it receives routing updates from the hub.

### Internet Key Exchange v1 (IKEv1) vs Internet Key Exchange v2 (IKEv2)

**Internet Key Exchange v1 (IKEv1):**
- Uses two phases: Main/Aggressive mode then Quick mode.
- Does not natively support EAP or certificate-only authentication.
- Older, less secure cryptography by default (e.g., DES, MD5).

**Internet Key Exchange v2 (IKEv2):**
- Uses a single exchange (IKE_SA_INIT and IKE_AUTH).
- Supports EAP, certificates, and built-in NAT traversal.
- Mandates stronger default cryptography (AES, SHA-256).

### IPsec with Crypto Map (Traditional VPN) vs IPsec with IPsec Profile (DMVPN)

**IPsec with Crypto Map (Traditional VPN):**
- Applied to a physical or logical interface directly.
- Defines a static peer IP address for each VPN tunnel.
- Cannot scale to hundreds of peers without hundreds of crypto maps.

**IPsec with IPsec Profile (DMVPN):**
- Applied to a tunnel interface via 'tunnel protection ipsec profile'.
- Dynamically discovers peer IPs through NHRP or IKEv2.
- Designed for scalability: one profile handles all peers on a multipoint interface.

## Diagram

_DMVPN topology showing a central hub router with three registered spoke routers, and direct spoke-to-spoke IPsec tunnels established after NHRP resolution._

```mermaid
flowchart TD
    H[Hub Router<br>mGRE + NHRP + IPsec<br>Hub Public IP 203.0.113.1] -->|Registers| R1[Spoke A<br>NHRP Client<br>Public IP 198.51.100.1]
    H -->|Registers| R2[Spoke B<br>NHRP Client<br>Public IP 198.51.100.2]
    H -->|Registers| R3[Spoke C<br>NHRP Client<br>Public IP 192.0.2.1]
    R1 -.->|Direct IPsec Tunnel<br>via NHRP Resolution| R2
    R2 -.->|Direct IPsec Tunnel| R3
    R1 -.->|Direct IPsec Tunnel| R3
```

## Common misconceptions

- **Misconception:** DMVPN and FlexVPN are completely different technologies with no overlap. **Reality:** They share the same purpose (dynamic secure site-to-site VPNs) and many concepts (hub-spoke design, routing protocols, IPsec). DMVPN is Cisco's older implementation using NHRP and mGRE; FlexVPN is the newer one using IKEv2. Both can create spoke-to-spoke tunnels. (Because DMVPN and FlexVPN are marketed separately, students assume they are unrelated. In reality, they solve the same problem with different underlying protocols.)
- **Misconception:** DMVPN Phase 3 requires all traffic to still go through the hub first. **Reality:** Phase 3 uses NHRP redirect messages to allow spokes to build direct tunnels without routing through the hub after the initial resolution. Traffic between spokes goes directly once the shortcut is installed. (Students confuse Phase 2 (where the hub must be in the routing path) with Phase 3 (which allows direct spoke-to-spoke routes without the hub). The names 'Phase 2' and 'Phase 3' are too similar.)
- **Misconception:** You configure IPsec on DMVPN using a 'crypto map' like on a traditional site-to-site VPN. **Reality:** DMVPN uses an IPsec profile applied to the tunnel interface with the command 'tunnel protection ipsec profile [name]'. Crypto maps are the older method and are not used with DMVPN. (Many beginners learn IPsec with crypto maps for simple point-to-point VPNs and assume the same interface-level configuration applies to hubs with many spokes.)
- **Misconception:** The hub must have a public IP address for every spoke tunnel, so you need as many public IPs as spokes. **Reality:** The hub uses a single mGRE tunnel interface and a single public IP address. NHRP manages multiple spoke connections over this single interface. (People familiar with point-to-point tunnels think each tunnel needs its own interface and IP address. DMVPN's multipoint nature is a key conceptual leap.)
- **Misconception:** DMVPN works out of the box with any routing protocol without special configuration. **Reality:** Routing protocols like EIGRP and OSPF require modifications on the hub, such as disabling split horizon (EIGRP) or changing network type (OSPF), to allow spoke-to-spoke route propagation. (Students often forget that routing protocols have default behaviours (like split horizon) that prevent routing updates from being sent back out the same interface, which is necessary in a hub-and-spoke VPN.)
- **Misconception:** FlexVPN is just a rebranded DMVPN with no real differences. **Reality:** FlexVPN uses IKEv2 instead of IKEv1, supports more flexible authentication (including certificates), and allows per-VRF tunnel selection. It is a more modern, standards-based architecture. (Because both technologies are often used interchangeably in marketing, students think they are identical. The exam explicitly tests the differences in protocol versions and features.)

## Key takeaways

- DMVPN uses NHRP to allow spokes to register with a hub and dynamically discover each other's real IP addresses for direct tunnel creation.
- FlexVPN is Cisco's IKEv2-based implementation of dynamic VPNs, offering more flexible authentication and VRF support than classic DMVPN.
- DMVPN Phase 3 is defined by the hub sending NHRP redirect messages to spokes, enabling direct spoke-to-spoke tunnels without the hub in the routing path.
- On a DMVPN hub, you must configure the tunnel interface as multipoint GRE (tunnel mode gre multipoint) to accept connections from multiple spokes.
- When using EIGRP over DMVPN, you must disable split horizon on the hub with 'no ip split-horizon eigrp [AS-number]' to allow spokes to learn routes from other spokes.
- The command 'show dmvpn' displays all registered spokes, their public IP addresses, and the status of the IPsec tunnels on the hub.
- For the exam, remember that DMVPN Phase 2 requires the hub to have a route to every remote network, while Phase 3 does not, because spokes install a shortcut route directly.

## FAQ

**What is the main difference between DMVPN and FlexVPN?**

DMVPN uses NHRP and mGRE and typically relies on IKEv1 for IPsec. FlexVPN is based on IKEv2, which is more modern, supports better authentication (like certificates and EAP), and allows per-VRF tunnel selection.

**Do I need a static public IP address for every branch site in a DMVPN setup?**

No. Only the hub needs a static public IP so spokes can always find it. Spokes can have dynamic public IPs; they register their current IP with the hub using NHRP. Other spokes then learn the dynamic IP via the hub.

**What does the 'show dmvpn' command show?**

It shows all NHRP registrations, the real (public) IP addresses of the spokes, the tunnel IP of the hub, the status of IPsec tunnels, and whether spoke-to-spoke shortcuts are active.

**Why is my spoke not forming a tunnel to the hub in DMVPN?**

Common reasons include: NHRP authentication string mismatch, tunnel key mismatch, IPsec profile configuration error, or firewall blocking UDP 500 (IKE) and UDP 4500 (IPsec NAT-T). Check with 'show crypto ikev1 sa' or 'show crypto ipsec sa'.

**Is FlexVPN backward compatible with DMVPN?**

No, they use different underlying protocols (IKEv2 vs IKEv1) and different configuration approaches. A FlexVPN hub cannot accept a DMVPN spoke's registration unless the spoke is also configured to use IKEv2, which is not standard for classic DMVPN.

**What is an NHRP shortcut route?**

An NHRP shortcut route is a route installed in a spoke's routing table that points directly to another spoke's public IP for a specific remote network. It is created when the hub sends an NHRP redirect and the spoke initiates a direct IPsec tunnel, bypassing the hub.

## Check your understanding

1. **What is the primary purpose of NHRP in a DMVPN network?**

   Answer: NHRP (Next Hop Resolution Protocol) allows spokes to register their real IP addresses with the hub and to query for the real IP address of another spoke in order to build a direct IPsec tunnel.

2. **Which command correctly applies IPsec to a DMVPN tunnel interface?**

   Answer: The command is 'tunnel protection ipsec profile [name]' under the tunnel interface configuration.

3. **In DMVPN Phase 3, what mechanism allows a spoke to learn that it should create a direct tunnel to another spoke?**

   Answer: The hub sends an NHRP redirect message to the initiating spoke, which then triggers an NHRP resolution request to the target spoke to establish a direct tunnel.

4. **Name one restriction when using EIGRP over a DMVPN hub that often causes spoke-to-spoke routing failures and how to fix it. **

   Answer: EIGRP split horizon prevents the hub from advertising routes learned from one spoke back out the same interface to other spokes. The fix is to disable split horizon with 'no ip split-horizon eigrp [AS-number]' on the hub's tunnel interface.

5. **How does a FlexVPN hub authenticate remote spoke routers?**

   Answer: FlexVPN uses IKEv2, which can authenticate spokes using pre-shared keys, digital certificates (PKI), or Extensible Authentication Protocol (EAP).

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/enarsi/dmvpn-and-flexvpn