300-410 VPN Technologies Practice Question
A network administrator is troubleshooting a DMVPN Phase 3 configuration on a Cisco IOS router. The hub router is configured with a multipoint GRE tunnel interface and NHRP. Spoke routers are unable to establish direct spoke-to-spoke tunnels; all traffic between spokes is going through the hub. The administrator verifies that NHRP registration is successful and that the hub has a mapping for each spoke. Which configuration change on the hub is required to enable spoke-to-spoke direct communication?
⚠ Common exam trap
A common mix-up: candidates confuse the roles of ip nhrp redirect and ip nhrp shortcut, or applying the shortcut command on the hub instead of the spokes.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the tunnel interface with ip nhrp redirect.
In DMVPN Phase 3, spoke-to-spoke direct tunnels are facilitated by NHRP redirects from the hub and NHRP shortcuts on spokes. The hub must be configured with ip nhrp redirect to send redirect messages when it detects traffic between spokes that could be direct. This triggers the originating spoke to request the destination spoke's NBMA address and build a direct tunnel, offloading traffic from the hub.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure the tunnel interface with ip nhrp shortcut.
Why it's wrong here
The ip nhrp shortcut command is configured on spoke routers, not the hub. It allows the spoke to use NHRP resolution to establish a direct tunnel to another spoke. On the hub, this command is not used; instead, the hub uses ip nhrp redirect to inform spokes about better paths. Thus, this change on the hub would not enable spoke-to-spoke communication.
- ✗
Configure the tunnel interface with ip nhrp map multicast dynamic.
Why it's wrong here
The ip nhrp map multicast dynamic command is used on the hub to enable dynamic multicast mapping for spokes, typically for routing protocols like EIGRP or OSPF. It does not directly influence spoke-to-spoke unicast traffic or the creation of direct tunnels. While important for multicast, it is not the required change to enable direct spoke-to-spoke communication in DMVPN Phase 3.
- ✗
Configure the tunnel interface with ip nhrp network-id 100.
Why it's wrong here
The ip nhrp network-id command assigns a network identifier for the NHRP domain. It must match on all routers in the DMVPN cloud for NHRP to function, but it does not enable spoke-to-spoke direct tunnels. If misconfigured, NHRP registration would fail, but the scenario states registration is successful. Therefore, this command is not the solution.
- ✓
Configure the tunnel interface with ip nhrp redirect.
Why this is correct
In DMVPN Phase 3, the ip nhrp redirect command on the hub enables the hub to send NHRP redirect messages to spokes when it receives traffic that could be sent directly between spokes. This prompts the originating spoke to send an NHRP resolution request for the destination spoke's public IP, allowing a direct tunnel to be built. Without this, spoke-to-spoke traffic continues to traverse the hub.
Go deeper
Related to this question
Learn chapter
Device Management and Network Monitoring (SNMP, Syslog, NetFlow)
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,401 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.