Question 320 A new spoke has internet connectivity but cannot register with the DMVPN hub because its NHRP network ID differs from the hub tunnel configuration. Which lasting design or operational safeguard best prevents this particular issue from recurring? Include overlay transport-loss detection and timer tests in resilience reviews. Include hub interface routing policies in DMVPN baseline validation. Choose one documented DMVPN phase and validate its NHRP features on all nodes. Keep hub and spoke NHRP parameters in synchronized deployment templates. ExplanationCorrect Answer D:Keep hub and spoke NHRP parameters in synchronized deployment templates. This addresses the recurring cause: NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. A targeted acceptance check is: Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Other Answers A:Include overlay transport-loss detection and timer tests in resilience reviews. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. B:Include hub interface routing policies in DMVPN baseline validation. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. C:Choose one documented DMVPN phase and validate its NHRP features on all nodes. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server.
Question 321 A DMVPN spoke points its NHRP NHS address to the hub's public WAN IP rather than the hub's tunnel IP; registration never completes. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Correct the NHRP NHS tunnel address and its associated NBMA mapping. Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. Enable the intended routing process or address-family interface participation on that spoke tunnel. Correct the NHRP authorization or authentication settings to admit the approved spokes. ExplanationCorrect Answer A:Correct the NHRP NHS tunnel address and its associated NBMA mapping. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. Confirm the spoke has an NHRP registration against the correct hub tunnel address. Other Answers B:Review split-horizon behavior on the hub's multipoint tunnel and correct it for the overlay routing design. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. C:Enable the intended routing process or address-family interface participation on that spoke tunnel. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. D:Correct the NHRP authorization or authentication settings to admit the approved spokes. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses.
Question 322 A DMVPN spoke points its NHRP NHS address to the hub's public WAN IP rather than the hub's tunnel IP; registration never completes. Which technical mechanism best explains the behavior observed in this scenario? Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. ExplanationCorrect Answer B:NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. This explains why the initial condition produces the observed failure. The direct repair is: Correct the NHRP NHS tunnel address and its associated NBMA mapping. Validate through: Confirm the spoke has an NHRP registration against the correct hub tunnel address. Other Answers A:Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. C:NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. D:NHRP maps overlay tunnel addresses to underlay NBMA addresses, which can change independently of tunnel IPs. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses.
Question 323 A DMVPN spoke points its NHRP NHS address to the hub's public WAN IP rather than the hub's tunnel IP; registration never completes. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. Confirm the spoke has an NHRP registration against the correct hub tunnel address. Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. ExplanationCorrect Answer C:Confirm the spoke has an NHRP registration against the correct hub tunnel address. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. Other Answers A:Fail the ISP path and observe neighbor loss, route withdrawal and recovery over the backup path. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. B:Inspect private-prefix routes and observe packets encapsulated into the tunnel rather than sent directly to WAN. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. D:Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses.
Question 324 A DMVPN spoke points its NHRP NHS address to the hub's public WAN IP rather than the hub's tunnel IP; registration never completes. Which lasting design or operational safeguard best prevents this particular issue from recurring? Standardize tunnel type for the approved DMVPN phase and shortcut behavior. Keep NHRP registration and resolution authorization aligned with the branch inventory. Prevent duplicated tunnel identity fields in automated branch provisioning. Validate both tunnel and underlay address roles during spoke provisioning. ExplanationCorrect Answer D:Validate both tunnel and underlay address roles during spoke provisioning. This addresses the recurring cause: NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. A targeted acceptance check is: Confirm the spoke has an NHRP registration against the correct hub tunnel address. Other Answers A:Standardize tunnel type for the approved DMVPN phase and shortcut behavior. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. B:Keep NHRP registration and resolution authorization aligned with the branch inventory. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. C:Prevent duplicated tunnel identity fields in automated branch provisioning. NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses.
Question 325 Two DMVPN spokes can reach the hub but cannot form a direct shortcut because one spoke is configured with a fixed point-to-point GRE tunnel. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Use a supported mGRE-based spoke-to-spoke DMVPN design and correct NHRP mappings. Enable the intended routing process or address-family interface participation on that spoke tunnel. Apply consistent tunnel protection to eligible spoke-to-spoke flows and reject unsecured paths. Repair the tunnel MTU and TCP MSS/path-MTU handling based on actual encapsulation overhead. ExplanationCorrect Answer A:Use a supported mGRE-based spoke-to-spoke DMVPN design and correct NHRP mappings. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. Other Answers B:Enable the intended routing process or address-family interface participation on that spoke tunnel. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. C:Apply consistent tunnel protection to eligible spoke-to-spoke flows and reject unsecured paths. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. D:Repair the tunnel MTU and TCP MSS/path-MTU handling based on actual encapsulation overhead. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface.
Question 326 Two DMVPN spokes can reach the hub but cannot form a direct shortcut because one spoke is configured with a fixed point-to-point GRE tunnel. Which technical mechanism best explains the behavior observed in this scenario? NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. ExplanationCorrect Answer B:Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. This explains why the initial condition produces the observed failure. The direct repair is: Use a supported mGRE-based spoke-to-spoke DMVPN design and correct NHRP mappings. Validate through: Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. Other Answers A:NHRP's NHS is identified inside the overlay, while NBMA mappings resolve tunnel identities to underlay addresses. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. C:NHRP registration requires compatible tunnel identity and reachability to the configured Next Hop Server. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. D:Direct DMVPN peers must establish suitable security associations, not just resolve each other's NBMA endpoints. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface.
Question 327 Two DMVPN spokes can reach the hub but cannot form a direct shortcut because one spoke is configured with a fixed point-to-point GRE tunnel. After applying the correction, which verification evidence most directly demonstrates that this issue is resolved? Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. Capture SA counters for both hub-spoke and direct spoke-spoke flows under the policy. Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. ExplanationCorrect Answer C:Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. This checks the affected traffic or control-plane behavior, not merely a generic up/down indicator. The underlying mechanism is: Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. Other Answers A:Inspect the route's next hop plus NHRP shortcut entry and capture direct spoke-to-spoke packets. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. B:Capture SA counters for both hub-spoke and direct spoke-spoke flows under the policy. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. D:Inspect NHRP registration state on hub and spoke and verify the spoke tunnel mapping. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface.
Question 328 Two DMVPN spokes can reach the hub but cannot form a direct shortcut because one spoke is configured with a fixed point-to-point GRE tunnel. Which lasting design or operational safeguard best prevents this particular issue from recurring? Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. Test DMVPN from representative NAT environments rather than assuming public-address-only spokes. Align routing next-hop policy with the deployed DMVPN phase and topology. Standardize tunnel type for the approved DMVPN phase and shortcut behavior. ExplanationCorrect Answer D:Standardize tunnel type for the approved DMVPN phase and shortcut behavior. This addresses the recurring cause: Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. A targeted acceptance check is: Inspect dynamic NHRP resolution and direct spoke-to-spoke encapsulation after the change. Other Answers A:Maintain authoritative hub addressing and decommission obsolete NHRP entries during migrations. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. B:Test DMVPN from representative NAT environments rather than assuming public-address-only spokes. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface. C:Align routing next-hop policy with the deployed DMVPN phase and topology. Multipoint GRE allows dynamically resolved multiple NBMA destinations on a single tunnel interface.
Question 329 A spoke's tunnel line protocol is up and NHRP resolves the peer, but IPsec security association negotiation fails due to incompatible transform proposals. Which corrective action most directly resolves the documented failure without suppressing unrelated safeguards? Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. Extend approved dynamic peer/profile matching to authorized spoke identities while keeping authentication restrictive. Assign each spoke a unique overlay tunnel IP and correct the cloned identity. Correct the NHRP NHS tunnel address and its associated NBMA mapping. ExplanationCorrect Answer A:Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. Other Answers B:Extend approved dynamic peer/profile matching to authorized spoke identities while keeping authentication restrictive. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. C:Assign each spoke a unique overlay tunnel IP and correct the cloned identity. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. D:Correct the NHRP NHS tunnel address and its associated NBMA mapping. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step.
Question 330 A spoke's tunnel line protocol is up and NHRP resolves the peer, but IPsec security association negotiation fails due to incompatible transform proposals. Which technical mechanism best explains the behavior observed in this scenario? Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. ExplanationCorrect Answer B:GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. This explains why the initial condition produces the observed failure. The direct repair is: Align supported IKE/IPsec proposals and tunnel-protection profiles on the intended peers. Validate through: Show compatible negotiated IKE and IPsec SAs and successful encrypted traffic through the tunnel. Other Answers A:Logical mGRE tunnel state need not reflect loss of a particular remote NBMA path. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. C:NHRP registration targets explicitly configured NHS resources; unused server mappings do not migrate automatically. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step. D:NHRP shortcut establishment depends on the deployed phase's redirect and resolution behavior. GRE/NHRP mapping can succeed while IPsec protection fails because cryptographic proposal negotiation is a separate step.
