Which IPsec design solution supports direct spoke-to-spoke communications across the Internet and easy provisioning of new sites?

Fully meshed direct IPsec requires a separate tunnel and crypto configuration between every pair of sites, making provisioning new sites operationally complex at scale.

Fully meshed IPsec with GRE tunnels still requires O(n^2) peer configurations across all sites and does not support dynamic spoke-to-spoke tunnel creation.

GET VPN is designed for any-to-any connectivity over private MPLS networks using a trusted group encryption model and does not support dynamic spoke-to-spoke tunnels over the public Internet.

DMVPN uses NHRP (Next Hop Resolution Protocol) to dynamically resolve spoke addresses, allowing on-demand direct spoke-to-spoke IPsec tunnels to be built without pre-configuration between every pair of sites. New spokes only require configuration pointing to the hub, which dramatically simplifies provisioning as the network grows.