hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures a DMVPN Phase 2 network
An engineer configures a DMVPN Phase 2 network. Spoke-to-spoke tunnels do not form, even though NHRP registration is successful. Which is the most likely explanation?
⚠ Common exam trap
Cisco often tests the distinction between DMVPN Phase 2 and Phase 3, and the trap here is that candidates mistakenly think 'ip nhrp redirect' and 'ip nhrp shortcut' are required for spoke-to-spoke tunnels in Phase 2, when in fact they are Phase 3 features and the real issue is the missing route to the remote spoke's tunnel IP via the hub.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The spoke routers do not have a route to each other's tunnel IP via the hub, so the NHRP shortcut request fails.
In DMVPN Phase 2, spoke-to-spoke tunnels rely on NHRP shortcut requests. Even though NHRP registration succeeds, the spoke routers must have a route to each other's tunnel IP via the hub (typically a static route pointing to the hub's tunnel IP) for the NHRP shortcut request to be forwarded correctly. Without this route, the spoke cannot reach the destination spoke's tunnel IP through the hub, so the NHRP Resolution Request fails, and the direct tunnel never forms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The spoke routers do not have a route to each other's tunnel IP via the hub, so the NHRP shortcut request fails.
Why this is correct
Phase 2 requires that the spoke's routing table points to the hub for the remote spoke's tunnel IP; otherwise, the shortcut cannot be established.
- ✗
The NHRP authentication key is mismatched between spokes.
Why it's wrong here
NHRP authentication is between spoke and hub, not between spokes.
- ✗
The mGRE interface is configured with tunnel mode gre multipoint on the spokes.
Why it's wrong here
mGRE is required for Phase 2 and is correctly configured.
- ✗
The hub is not configured with 'ip nhrp redirect' and the spokes with 'ip nhrp shortcut'.
Why it's wrong here
These are required for Phase 2, but the scenario states registration is successful, implying these are configured.
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.