A police records bureau is building single-hub DMVPN. What role do GRE/mGRE encapsulations play before IPsec protection is applied?
Select an answer to reveal the explanation.
Short Explanation
GRE/mGRE is the cardboard tunnel tube; IPsec is the locked lid. DMVPN ships traffic through the tube first, then locks it for the Internet ride.
Full Explanation
In a police-records single-hub DMVPN, GRE/mGRE encapsulations create the tunnel overlay that can carry unicast and multicast-capable multipoint traffic between the hub and spokes across an IP underlay. IPsec is then commonly applied to encrypt and authenticate that GRE traffic on the public Internet. GRE provides the routing-friendly multipoint overlay; IPsec provides confidentiality. Separating those roles is essential to understanding protected DMVPN at ENARSI depth.
GRE/mGRE do not replace NHRP; spokes still register NBMA addresses with the hub NHS so multipoint peers can be resolved. They do not distribute VPN labels between PE routers in an MPLS L3VPN core—that is MP-BGP/LDP (or SR) in a different architecture. They also do not perform CEF label imposition on P routers for customer VRFs; DMVPN overlays are not the MPLS P-core label mechanism.
Exam caveat: cleartext GRE over the Internet is usually unacceptable for civic records—encryption is a security requirement layered on the overlay, not a substitute for GRE/NHRP. Operational check: confirm tunnel mode/mGRE, see GRE-encapsulated packets in captures or counters, verify IPsec SAs when tunnel protection is configured, and prove overlay multicast/routing adjacency rides the tunnel—not the raw underlay alone.