Refer to the exhibit. A customer interconnected hundreds of branch offices into a single DMVPN network, with the HUB in the main data center. Due to security policies, the customer requires that the…

Front-Door VRF places the physical WAN interface into a separate VRF so that all user traffic routes through the DMVPN tunnel in the default VRF, while the WAN VRF holds only the routes needed to reach DMVPN peers - this is scalable because the same template applies to every branch without per-branch static route management.

An inbound ACL on the WAN interface that explicitly permits only IKE (UDP 500), NAT-T (UDP 4500), and ESP (protocol 50) traffic satisfies the security policy requirement by dropping all non-IPsec traffic at the edge, and this ACL template can be applied identically to hundreds of branches without modification.

Zone-based firewall can enforce the same IPsec-only policy but requires significantly more complex per-router configuration compared to a simple inbound ACL, making it far less scalable across hundreds of branch routers.

Adding a static host route for each remote branch and HUB router is explicitly not scalable when the network contains hundreds of branches, as it creates an unmanageable number of static entries on every branch.

A floating default route controls routing path preference between the tunnel and WAN backup, but does not enforce the security requirement of blocking non-IPsec traffic from traversing the local internet circuit.