hardMultiple SelectObjective-mapped
DMVPN Phase 2 Operation: Spoke-to-Spoke Tunnels
Which TWO statements about the operation of DMVPN Phase 2 are true? (Choose TWO.)
Quick Answer
The correct answer is that the hub router must be configured with the 'ip nhrp redirect' command, and spoke-to-spoke tunnels are built dynamically using NHRP redirect and shortcut routes. In DMVPN Phase 2 operation, when a spoke sends traffic to another spoke’s destination behind its tunnel, the hub intercepts the packet and sends an NHRP Redirect message back to the source spoke, revealing the target spoke’s NBMA address. The source spoke then uses its 'ip nhrp shortcut' configuration to initiate a direct spoke-to-spoke tunnel, bypassing the hub for subsequent data flows. On the Cisco CCNP ENARSI 300-410 exam, this concept tests your understanding of how Phase 2 differs from Phase 1 and Phase 3, with a common trap being the belief that spoke-to-spoke traffic always transits the hub after the shortcut is established. A useful memory tip is to think of the hub as a “matchmaker” that introduces spokes via redirect, but does not stay in the conversation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Spoke routers can dynamically establish direct tunnels with each other.
In DMVPN Phase 2, spoke-to-spoke tunnels are built dynamically using NHRP redirect and shortcut routes. The spoke router learns the NBMA address of another spoke via an NHRP redirect from the hub, and then initiates a direct tunnel. Phase 2 uses the 'ip nhrp redirect' command on the hub and 'ip nhrp shortcut' on spokes. The other statements are incorrect: Phase 2 does not require a multipoint GRE tunnel on the hub (it can be point-to-multipoint), and spoke-to-spoke traffic does not always go through the hub after the shortcut is established.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Spoke routers can dynamically establish direct tunnels with each other.
Why this is correct
This is a key feature of Phase 2: spokes can build direct tunnels using NHRP redirect/shortcut.
- ✓
The hub router must be configured with the 'ip nhrp redirect' command.
Why this is correct
The hub sends NHRP redirect messages to spokes to inform them of the NBMA address of the destination spoke.
- ✗
The hub router must use a point-to-point GRE tunnel interface.
Why it's wrong here
In Phase 2, the hub typically uses a multipoint GRE (mGRE) tunnel interface, not point-to-point.
- ✗
All spoke-to-spoke traffic must traverse the hub router.
Why it's wrong here
After a direct tunnel is built, spoke-to-spoke traffic bypasses the hub.
- ✗
NHRP is not required for Phase 2 operation.
Why it's wrong here
NHRP is essential for Phase 2 to resolve NBMA addresses and build direct tunnels.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,966-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on 300-410
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. In DMVPN Phase 2, what is the default behavior of the 'ip nhrp redirect' command on the hub router?
hard- A.It is enabled by default and causes the hub to send redirect messages to spokes.
- B.It is disabled by default and must be configured for spoke-to-spoke direct communication.
- ✓ C.It is disabled by default and is used in Phase 3 to enable NHRP redirects.
- D.It is enabled by default and is used to disable NHRP shortcut switching.
Why C: In DMVPN Phase 2, the 'ip nhrp redirect' command is not enabled by default on the hub. It is used in Phase 3 to enable NHRP redirects, which allow the hub to inform spokes that a better path exists directly to another spoke. In Phase 2, spoke-to-spoke tunnels are established based on NHRP resolution triggered by traffic, not by redirect messages.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.