hardMultiple ChoiceObjective-mapped
300-410 Practice Question: An engineer configures DMVPN Phase 2 on a…
An engineer configures DMVPN Phase 2 on a hub-and-spoke network for an MPLS L3VPN customer. The spokes are configured with a single tunnel interface and use NHRP to register with the hub. The engineer notices that spoke-to-spoke traffic is not being established, even though the spokes have each other's NHRP mappings. The engineer verifies that the tunnel interfaces are up and that the hub can reach all spokes. What is the most likely explanation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The spokes have a default route pointing to the hub, which prevents them from using the direct spoke-to-spoke tunnel.
In DMVPN Phase 2, spoke-to-spoke tunnels are established dynamically using NHRP redirect and shortcut. However, a common edge case is that the spokes must have a route that points to the destination network via the tunnel interface. If the spokes have a default route or a summary route that points to the hub (Phase 1 behavior), they will not use the direct spoke-to-spoke tunnel. In Phase 2, the hub must send an NHRP redirect to the source spoke, and the source spoke must then send an NHRP resolution request to the destination spoke. If the spokes have a static route that forces traffic through the hub, the NHRP redirect will not work. Additionally, the 'ip nhrp redirect' command must be configured on the hub, and 'ip nhrp shortcut' on the spokes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The spokes have a default route pointing to the hub, which prevents them from using the direct spoke-to-spoke tunnel.
Why this is correct
Correct. In Phase 2, spokes must have a route that allows them to use the tunnel for direct communication; a default route to the hub will force traffic through the hub.
- ✗
The 'ip nhrp authentication' string is mismatched between the spokes.
Why it's wrong here
Incorrect. Authentication mismatch would prevent NHRP registration, but the issue is that spoke-to-spoke traffic is not established even though mappings exist.
- ✗
The tunnel mode is set to 'gre multipoint' on the spokes, which is not supported in Phase 2.
Why it's wrong here
Incorrect. 'gre multipoint' is required on the hub, but spokes can use 'gre' or 'gre multipoint' in Phase 2.
- ✗
The 'ip nhrp map multicast' command is missing on the spokes, preventing multicast traffic.
Why it's wrong here
Incorrect. Missing multicast mapping would affect routing protocol adjacencies, not spoke-to-spoke data traffic.
Go deeper
Related to this question
Learn chapter
Introduction to ENARSI Exam and Network Fundamentals
Key term
DMVPN Phase 2
DMVPN Phase 2 is an advanced Cisco routing technology that allows spoke routers to communicate directly with one another without sending traffic through a central hub, using dynamic routing protocols and multipoint GRE tunnels.
Key term
MPLS Layer 3 VPN
A technology that uses Multiprotocol Label Switching to create secure, scalable virtual private networks that connect multiple sites at the network layer, where the service provider manages routing between customer sites.
About these practice questions
Courseiva writes every 300-410 question from scratch — 1,966 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.