300-410 VPN Technologies Practice Question
A network administrator is configuring DMVPN Phase 3 with a hub-and-spoke topology. The administrator wants to enable spoke-to-spoke communication directly without traversing the hub. Which command must be configured on the hub router to allow spoke-to-spoke tunnels?
⚠ Common exam trap
It's easy for candidates to confuse the roles of 'ip nhrp redirect' and 'ip nhrp shortcut', and misplacing them on the wrong routers (hub vs. spoke).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ip nhrp redirect
The correct answer is 'ip nhrp redirect' on the hub. In DMVPN Phase 3, the hub uses NHRP redirect messages to inform spokes about a better direct path to other spokes. When a spoke receives a redirect, it can establish a direct tunnel to the destination spoke, reducing latency and hub load. This command is essential on the hub to enable this behavior. The spoke routers must also have 'ip nhrp shortcut' configured to act on the redirects.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ip nhrp network-id 1
Why it's wrong here
The 'ip nhrp network-id' command is used to identify the NHRP network and must match on all routers in the DMVPN cloud. It is a basic configuration requirement but does not enable spoke-to-spoke communication. It simply ensures that NHRP packets are processed within the same network ID.
- ✓
ip nhrp redirect
Why this is correct
The 'ip nhrp redirect' command on the hub enables DMVPN Phase 3 functionality. When a spoke sends traffic to another spoke via the hub, the hub sends an NHRP redirect message to the originating spoke, informing it of a better path directly to the destination spoke. This allows the originating spoke to initiate a direct tunnel to the destination spoke, bypassing the hub for subsequent packets. This is a key component of DMVPN Phase 3.
- ✗
ip nhrp shortcut
Why it's wrong here
The 'ip nhrp shortcut' command is configured on the spoke routers, not the hub. It enables the spoke to intercept traffic and use NHRP to find a direct path to the destination spoke. Without this command on the spokes, they cannot take advantage of the redirect messages sent by the hub. Therefore, this command is necessary but not on the hub.
- ✗
ip nhrp map multicast dynamic
Why it's wrong here
The 'ip nhrp map multicast dynamic' command is used on the hub in DMVPN to allow dynamic multicast mapping for spokes. It enables the hub to replicate multicast packets to all spokes without requiring static mappings. This is unrelated to enabling spoke-to-spoke direct tunnels; it is primarily for multicast traffic distribution in DMVPN.
Go deeper
Related to this question
Learn chapter
Advanced EIGRP Features (Stub, Load Balancing, Named Mode)
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
One of 1,401 original 300-410 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.