A county jail facilities team verifies spoke NHRP configuration for single-hub DMVPN. What must spokes typically point to as their Next Hop Server?
Select an answer to reveal the explanation.
Short Explanation
Spokes need the hub’s tunnel address as their NHS—like listing HQ dispatch as the directory help number. Registration and resolution go through that hub. Pointing NHS at random ISP loopbacks misses the design.
Full Explanation
For county jail facilities verifying spoke NHRP in single-hub DMVPN, spokes typically point to the hub’s tunnel (overlay) address as their NHRP Next Hop Server. Registration and resolution then go through that hub NHS, allowing the hub to learn spoke NBMA mappings and to assist shortcut resolution per design phase. Using the hub tunnel IP as NHS is the standard spoke configuration landmark in ENARSI labs and production civic DMVPN.
Listing every other spoke’s LAN address as a permanent NHS with no hub entry breaks the hub-centered registration model and does not scale. Pointing NHS at a random P-router loopback in an ISP MPLS core is meaningless for customer DMVPN overlays. Configuring the local spoke’s own NBMA address as its only NHS does not register the spoke to the hub directory and prevents proper hub-spoke NHRP operation.
Exam caveat: NHS is the hub’s tunnel overlay address (as configured), while NBMA is the underlay public address used for encapsulation—do not swap those fields in config. Operational check: on each spoke confirm ip nhrp nhs matches the hub tunnel IP, register, then on the hub verify dynamic mappings; test overlay reachability to jail HQ and confirm resolution requests reference the hub NHS.