A municipal hospital campus WAN sees broken large transfers across DMVPN after enabling GRE with IPsec. What adjustment best addresses encapsulation overhead on those civic VPN links?
Select an answer to reveal the explanation.
Short Explanation
GRE plus IPsec wraps packets in extra headers, so big civic transfers smash into the ceiling unless you shrink MTU or TCP MSS to leave room for that wrapping.
Full Explanation
On a municipal hospital campus WAN, DMVPN that wraps GRE (or mGRE) with IPsec adds dozens of bytes of encapsulation beyond the underlay path MTU. Large civic transfers—PACS image pushes, EHR bulk exports, or overnight backup streams—then exceed the effective payload size, fragment, or black-hole when DF is set and intermediate devices drop fragments. The correct adjustment is to lower the tunnel or physical interface MTU, and/or clamp TCP MSS on the tunnel or edge, so end-station TCP sessions negotiate a segment size that leaves room for GRE plus ESP/AH overhead before the packet hits the Internet or provider underlay.
Lowering only the hub BGP keepalive timer does not shrink GRE or IPsec headers; keepalive tuning affects session detection, not encapsulation budget. Disabling NHRP registration removes the mapping plane DMVPN depends on and does not bypass IPsec overhead in any useful way. Replacing mGRE with Frame Relay is unrelated to Internet-based DMVPN underlays and does not make MTU irrelevant when GRE+IPsec still wraps traffic.
Exam caveat: ENARSI expects you to reason about effective MTU and MSS under GRE/IPsec, not to treat keepalive or NHRP knobs as MTU fixes. Operational check: compare underlay MTU to show interface tunnel MTU, capture or estimate GRE+IPsec overhead, verify DF behavior with large pings or path MTU discovery, then confirm TCP MSS clamping with show run and a large hospital transfer that previously stalled. After change, retest spoke registration and overlay routing so MTU tuning did not break NHRP or IPsec.