Refer to the exhibit. The network security engineer identified that the hub router cannot send traffic to the spoke router. Based on the provided output, which action resolves the issue? [Exhibit: Con

Blocked UDP 500 or 4500 would prevent IKE SA formation entirely, which would appear as errors in 'show crypto isakmp sa' rather than NHRP-specific registration failures.

In DMVPN, the spoke uses the 'ip nhrp nhs' command to identify the hub's NHS address for registration. When this IP is misconfigured, registration requests are sent to an unreachable or wrong destination, incrementing 'req-failed' while 'repl-recv' stays at zero and registrations remain pending indefinitely. Correcting the NHS IP on the spoke restores the NHRP registration process and allows tunnel traffic to flow.

A preshared key mismatch causes IKE Phase 1 authentication failure visible in the ISAKMP SA state, not in NHRP req-failed counters with zero replies.

A mismatched ip nhrp network-id causes NHRP packets to be discarded locally, but the specific combination of req-failed incrementing with repl-recv at zero most directly indicates the spoke is targeting a wrong NHS destination IP.