A fire district standardizing future branch crypto VPNs wants reusable IKEv2 configuration blocks and less dependence on mGRE/NHRP for every new site type. When should the architects favor FlexVPN over classic DMVPN Phase 3?
Select an answer to reveal the explanation.
Short Explanation
If the team wants Lego-style IKEv2 profiles and mixed peer flavors, FlexVPN is the tidy kit. If the whole story is NHRP multipoint GRE with Phase 3 shortcuts, stick with classic DMVPN.
Full Explanation
Architects should favor FlexVPN over classic DMVPN Phase 3 when operational preference is IKEv2 profile modularity and mixed peer styles rather than an NHRP-driven mGRE multipoint overlay as the default pattern. Fire-district standardization on reusable IKEv2 blocks and less dependence on mGRE/NHRP for every new site type maps to that FlexVPN preference.
When every spoke must dynamically build spoke-to-spoke shortcuts using NHRP redirect and shortcut only, classic DMVPN Phase 3 remains the natural fit. Hub-and-spoke GRE without any IPsec is not a reason to choose FlexVPN. Running PIM Bidirectional multicast exclusively inside DMVPN Phase 1 does not by itself define the FlexVPN-versus-DMVPN decision.
Exam caveat: requirement-driven choice—NHRP multipoint shortcuts → DMVPN; modular IKEv2/mixed peers → FlexVPN.
Operational check: list peer styles and shortcut needs for future branches, choose FlexVPN when modularity wins, retain DMVPN where NHRP Phase 3 is the operational center, and avoid mixing models without a clear handoff plan. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.