hardMultiple ChoiceObjective-mapped
300-410 Practice Question: A large enterprise is using a DMVPN Phase 2…
A large enterprise is using a DMVPN Phase 2 hub-and-spoke topology with IPsec protection. Spoke routers R3 and R4 are both behind NAT. The hub R1 has a tunnel interface with IPsec profile and mGRE. Spoke-to-spoke dynamic tunnels do not form. R3 can ping R4's tunnel IP via the hub, but R3's show dmvpn detail shows no NHRP redirect or shortcut. R4's show crypto ipsec sa shows no inbound/outbound SA for the R3-to-R4 traffic. What is the root cause?
⚠ Common exam trap
Cisco often tests the distinction between DMVPN Phase 2 and Phase 3, where Phase 3 uses 'ip nhrp redirect' on the hub and 'ip nhrp shortcut' on spokes, and candidates may incorrectly assume that spoke-to-spoke tunnels form automatically without explicit NHRP redirect configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The hub is missing the 'ip nhrp redirect' command under the tunnel interface.
In a DMVPN Phase 2 topology, spoke-to-spoke dynamic tunnels require the hub to send NHRP redirect messages to inform a spoke that the destination it is trying to reach is behind another spoke. Without the 'ip nhrp redirect' command on the hub's tunnel interface, the hub forwards traffic between spokes but never signals the source spoke to initiate a direct tunnel. This explains why R3 can ping R4's tunnel IP via the hub but no NHRP redirect or shortcut is seen, and no IPsec SA is built between the spokes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The hub is missing the 'ip nhrp redirect' command under the tunnel interface.
Why this is correct
Without NHRP redirect, the hub does not inform spokes of peer public addresses, preventing dynamic spoke-to-spoke tunnel formation.
- ✗
The IPsec profile on the hub does not include perfect forward secrecy (PFS).
Why it's wrong here
PFS is not required for spoke-to-spoke tunnels; it affects key derivation but not NHRP redirect.
- ✗
The spokes are using different ISAKMP policies.
Why it's wrong here
Different ISAKMP policies would prevent IKE phase 1, but the hub-to-spoke tunnels work, so ISAKMP is consistent.
- ✗
The NAT traversal feature is disabled on the hub.
Why it's wrong here
NAT-T is needed for spokes behind NAT, but the hub-to-spoke tunnels work; missing NAT-T would break all tunnels, not just spoke-to-spoke.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.