A network architect is designing a VPN solution for a client with these requirements multicast supported 80% of traffic is spoke to spoke minimal configuration. Which VPN type is the best choice?

VTI (Virtual Tunnel Interface) creates point-to-point IPsec tunnels that do not natively support multicast and require a full mesh of tunnels for spoke-to-spoke traffic, increasing configuration complexity.

IPsec direct encapsulation does not support multicast traffic because IPsec is a unicast-only protocol and would require a separate GRE encapsulation layer to carry multicast.

DMVPN uses mGRE (multipoint GRE) tunnels that natively carry multicast traffic, NHRP to dynamically resolve spoke addresses enabling direct spoke-to-spoke sessions without hub involvement, and requires configuration only on the hub router with minimal per-spoke settings, satisfying all three design requirements simultaneously.

GRE over IPsec supports multicast via the GRE header, but achieving spoke-to-spoke communication requires either a full mesh of static tunnels or complex routing, resulting in significantly more configuration than DMVPN.