An engineer is implementing the FlexVPN solution on a Cisco IOS router. The router must only terminate VPN requests and must not initiate them. Additionally, the interface must support VPNs from other

A point-to-point GRE tunnel is statically configured for a single remote peer and cannot dynamically accept sessions from multiple different clients.

A multipoint GRE interface is the hub interface construct for DMVPN and does not natively integrate with IKEv2 FlexVPN or support Cisco AnyConnect remote access clients.

A static VTI is preconfigured for a specific peer and can initiate tunnels, violating the requirement that the router must not initiate VPN requests.

A virtual template interface operates in a passive responder-only role, meaning the router never initiates tunnels - it only accepts them. When a new IKEv2 session arrives, IOS clones the template into a virtual access interface for that session, supporting simultaneous connections from both remote routers and Cisco AnyConnect clients. This is the standard FlexVPN server construct and the only option that satisfies all three stated requirements.