A sanitation department needs modular IKEv2 profiles that can cover both site-to-site branches and certain remote-access clients on the same crypto headend. Which approach best matches that requirement versus classic DMVPN Phase 3?
Select an answer to reveal the explanation.
Short Explanation
Classic DMVPN is great for spoke hubs that all speak NHRP. When you also need remote-access-style clients and clean IKEv2 building blocks on one headend, FlexVPN’s modular profiles are the better toolbox.
Full Explanation
FlexVPN is Cisco’s IKEv2-based VPN framework using reusable profiles, virtual-templates, and virtual-access interfaces. When a sanitation department needs modular IKEv2 profiles covering both site-to-site branches and certain remote-access clients on the same crypto headend, FlexVPN matches that mixed-peer requirement better than insisting on classic DMVPN Phase 3 alone.
Keeping classic DMVPN NHRP and adding Frame Relay inverse-ARP for remote-access users is nonsensical layering. Replacing the WAN with MPLS L2VPN pseudowires so IKEv2 is unnecessary abandons the crypto-headend goal. Using GETVPN group keys alone because GDOI “already terminates remote-access SSL portals” misstates GETVPN’s group-WAN role versus remote-access aggregation.
Exam caveat: FlexVPN for modular IKEv2 and mixed peers; DMVPN Phase 3 for NHRP mGRE spoke-to-spoke fabrics—pick based on the requirement.
Operational check: design FlexVPN profiles/virtual-access for site-to-site and remote-access classes, lab both peer styles on one headend, and document when classic DMVPN remains preferred for pure spoke-to-spoke overlays. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.