A retailer runs a hub-and-spoke WAN of 300 stores over the internet. Store-to-store video traffic currently hairpins through the hub, and the team wants spokes to build direct encrypted tunnels to each other only when needed, without preconfiguring every pair. Which VPN technology fits?
Select an answer to reveal the explanation.
Short Explanation
Instead of every store calling headquarters to relay a message to the store next door, DMVPN lets them look up each other's number and call directly. NHRP is the phone book and mGRE is the one interface that can dial anyone. You don't want GETVPN here — it's tunnel-less and built for private WANs, not the internet.
Full Explanation
Dynamic Multipoint VPN combines multipoint GRE, the Next Hop Resolution Protocol, and IPsec. Each spoke has a single mGRE tunnel interface and registers its public address with the hub, which acts as the NHRP server. When a spoke needs to reach another spoke's network, it queries NHRP for that spoke's public address, then builds a direct IPsec-protected tunnel on demand and tears it down when idle. Only the hub-to-spoke configuration is static, so adding stores does not require configuring every pair, and video flows no longer hairpin through the hub. GETVPN uses group keys from a key server and preserves original IP headers without building tunnels; it suits private MPLS networks where those headers are routable, not internet transport with private store addressing. A full mesh of static tunnels among 300 sites requires tens of thousands of configured pairs, exactly what the team wants to avoid. A remote access SSL VPN connects individual clients to a head-end and does not create site-to-site paths between routers. Exam caveat: spoke-to-spoke tunnels require DMVPN phase 2 or phase 3 behavior; phase 1 keeps all traffic through the hub. Operational check: from a spoke, display NHRP mappings and IPsec security associations while traffic flows to confirm a direct spoke-to-spoke entry appears.