An airport authority exposes a DMVPN hub to the Internet and wants to reduce fake mapping risk. What is the purpose of NHRP authentication in that design?
Select an answer to reveal the explanation.
Short Explanation
NHRP auth is like a handshake password on the mapping chatter—it makes it harder for strangers on the Internet to feed the hub bogus spoke addresses.
Full Explanation
An airport authority exposing a DMVPN hub to the Internet should use NHRP authentication to reduce fake mapping risk. Shared NHRP authentication validates control messages so unauthorized devices on the underlay are less able to inject or spoof mappings toward the hub. That protects the mapping plane’s integrity as a complement to—not a replacement for—IPsec confidentiality and integrity on the GRE overlay that carries airline-ops and airfield civic traffic.
NHRP auth does not replace IPsec; GRE on a public underlay still needs encryption and integrity from crypto policy. It does not convert every spoke into a static-only mapped peer that never registers dynamically; dynamic registration remains the model, now authenticated. It does not force BGP AS-path prepending on overlay prefixes; AS-path policy is a routing concern unrelated to NHRP message authentication.
Exam caveat: do not confuse NHRP authentication with IPsec PSK or certificates—both may exist, for different planes. Operational check: configure matching NHRP authentication on hub and airport spokes, attempt registration from a test device without the secret (should fail), confirm legitimate spokes still show in show dmvpn, and keep IPsec enabled for payload protection on the public underlay.