On a FlexVPN hub-and-spoke topology where spoke-to-spoke tunnels are not allowed, which command is needed for the hub to be able to terminate FlexVPN tunnels?

Virtual-access interfaces are created automatically by the system from the virtual-template at connection time and are not manually configured by an administrator to enable spoke termination.

'ip nhrp redirect' enables spoke-to-spoke shortcut routing in DMVPN and FlexVPN topologies, which is explicitly not required and not desired in this hub-and-spoke-only design.

A static 'interface tunnel' is used for fixed point-to-point or multipoint GRE tunnels and does not support the dynamic, per-spoke interface instantiation that FlexVPN hub termination requires.

The 'interface virtual-template' command defines a reusable template configuration on the hub that IKEv2 references to dynamically instantiate per-spoke virtual-access interfaces when spokes connect. Without a virtual-template, the hub has no blueprint from which to create these dynamic interfaces and cannot terminate FlexVPN tunnels.