When troubleshooting FlexVPN spoke-to-spoke tunnels, what should be verified first?

Verifying that NHRP redirect is enabled on the hub is a valid check, but the hub only sends a redirect in response to traffic it receives from the spoke, so confirming the resolution request is sent is a more foundational prior step.

The spoke-to-spoke tunnel process begins only when the source spoke sends an NHRP resolution request to the hub (NHS) to discover the NBMA address of the destination spoke; if this request is not being generated, every downstream step - redirect, cache population, and direct tunnel formation - cannot occur, making it the logical first verification point.

NHRP cache entries on the spoke are populated only after a resolution request has been sent and a reply received from the hub, so this check belongs later in the troubleshooting sequence.

NHO (Next Hop Override) routes are installed on spokes only after the spoke-to-spoke tunnel is already functional, making this a downstream verification rather than the first troubleshooting step.