300-410 Layer 3 Technologies Practice Question
A network engineer is troubleshooting a DMVPN Phase 3 network using Cisco IOS XE routers. Spoke routers are unable to establish direct spoke-to-spoke tunnels. The hub router is configured with 'ip nhrp redirect', and spokes are configured with 'ip nhrp shortcut'. The engineer notices that spoke routers are not receiving NHRP redirect messages from the hub. Which action should be taken to resolve this issue?
⚠ Common exam trap
The trap here is assuming that enabling 'ip nhrp shortcut' on the hub is necessary, when it is actually a spoke-side command.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that the hub router has a route to the spoke networks and that NHRP resolution is working.
In DMVPN Phase 3, the hub uses 'ip nhrp redirect' to inform spokes of a better path to a destination. For the hub to send redirects, it must have a route to the destination network and be able to resolve the destination's NBMA address via NHRP. If the hub lacks a route or NHRP resolution fails, no redirects are sent, and spokes cannot establish direct tunnels. Verifying hub routing and NHRP operation is essential for troubleshooting this issue.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure 'ip nhrp map multicast dynamic' on the spoke routers.
Why it's wrong here
'ip nhrp map multicast dynamic' is typically configured on the hub to allow it to dynamically learn multicast mappings for spokes, enabling multicast traffic over the DMVPN. On spokes, this command is not used; instead, they use 'ip nhrp map multicast' with the hub's NBMA address. Configuring it on spokes would not resolve the lack of NHRP redirects from the hub.
- ✗
Enable 'ip nhrp shortcut' on the hub router.
Why it's wrong here
'ip nhrp shortcut' is configured on spoke routers to allow them to use shortcut paths learned from NHRP redirect messages. Enabling it on the hub is not necessary and does not address the issue of spokes not receiving redirects. The hub should have 'ip nhrp redirect' enabled, which it already does. The problem likely lies elsewhere, such as with the tunnel or routing configuration.
- ✗
Change the tunnel mode from GRE multipoint to GRE point-to-point.
Why it's wrong here
DMVPN requires GRE multipoint (mGRE) tunnel interfaces on the hub and often on spokes to support dynamic tunnel creation. Changing to point-to-point GRE would break the DMVPN functionality, as it would not allow multiple NBMA mappings or dynamic spoke-to-spoke tunnels. This action would not resolve the issue and would likely cause further problems.
- ✓
Ensure that the hub router has a route to the spoke networks and that NHRP resolution is working.
Why this is correct
For the hub to send NHRP redirect messages, it must have a route to the destination spoke network and be able to perform NHRP resolution. If the hub lacks a route or NHRP resolution fails, it cannot generate redirects. The engineer should verify that the hub has routes to all spoke networks, that NHRP entries are correct, and that the hub can resolve spoke NBMA addresses. This is a common cause of missing redirects in DMVPN Phase 3.
Visual reference
Go deeper
Related to this question
Learn chapter
Device Management and Network Monitoring (SNMP, Syslog, NetFlow)
Key term
DMVPN Phase 3
DMVPN Phase 3 is a Cisco networking technology that allows branch offices to connect directly to each other without always going through a central hub, but with smarter routing that lets the hub control the traffic paths more efficiently.
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.