A municipal water utility must prove dynamic DMVPN tunnels are healthy before a council network demo. Which verification approach best confirms overlay state?
Select an answer to reveal the explanation.
Short Explanation
show dmvpn and the NHRP mapping views are the flashlight—you see who registered and whether those dynamic tunnels actually look alive.
Full Explanation
Before a council network demo, a municipal water utility should prove dynamic DMVPN health with the commands that display overlay control state. show dmvpn summarizes hub/spoke roles, NBMA addresses, tunnel flags, and uptime; NHRP mapping and detail views show who registered, attribute flags, and whether dynamic entries exist for the expected yards and plants. Those outputs confirm registration and tunnel readiness in the same language ENARSI troubleshooting uses.
Relying only on show ip arp on LAN switches lists Ethernet adjacency on local VLANs; it does not enumerate GRE tunnel peers or NHRP NBMA mappings. Clearing the BGP table on a non-participating PE does not rebuild DMVPN mappings and may disrupt unrelated routing. Disabling CDP globally and treating silence as proof of spoke-to-spoke IPsec confuses Layer 2 discovery with IPsec/NHRP state and proves nothing about overlay health.
Exam caveat: ARP, CDP, and random BGP clears are distractors; DMVPN verify means show dmvpn and NHRP plus crypto SA counters when IPsec is used. Operational check: capture show dmvpn and show ip nhrp on hub and spokes, confirm NHS and spoke entries match inventory, generate light overlay traffic, and ensure encaps/decaps and mapping flags stay healthy through the demo window.