Implementing and Operating Cisco Enterprise Network Core Technologies (ENCOR) v1.2SecurityHard
A network engineer is configuring a DMVPN solution with multiple spokes connecting to a single hub router. The requirement is for spokes to establish direct IPsec tunnels with each other for optimal data path once the initial tunnel to the hub is established. Which NHRP feature enables spoke-to-spoke direct tunnels?
- ANHRP Registration
- BNHRP Resolution Request
- CNHRP Next Hop Resolution Request (NHRP-NHR)
- DNHRP Redirect
Show answer & explanationAnswer & explanation
Correct answer: D. NHRP Redirect
NHRP Redirect is the feature that allows the hub to inform spokes about other spokes' tunnel addresses, enabling them to establish direct spoke-to-spoke IPsec tunnels without traversing the hub for data traffic. The hub acts as a redirector.
Why the other options are wrong
- A. NHRP Registration is how spokes register their real (public) and tunnel (private) IP addresses with the hub.
- B. NHRP Resolution Request is sent by a spoke to the hub to find the real IP of another spoke's tunnel IP.
- C. NHRP-NHR is not a standard, distinct NHRP message for this purpose in DMVPN.
DMVPN NHRP Redirect
An NHRP message type sent by the DMVPN hub to a spoke, informing it of the real (public) IP address of another spoke, enabling direct spoke-to-spoke IPsec tunnels.
- Initiated by the hub.
- Facilitates direct spoke-to-spoke communication.
- Optimizes data path by bypassing the hub.
Memory trick: The DMVPN hub is like a matchmaker, redirecting spokes to each other.