Which two configurations are mandatory for an auto-discovery VPN (ADVPN) implementation on a hub? (Choose two.)

Question

Options

• AThe remote-ip must be on a different IP address from the overlay subnet.
• Bset net-device must be disabled to avoid dynamic interface creation.
• Cset add-route must be enabled to add routes.
• DAn overlay IP address with a mask of /32 must be assigned to the IPsec virtual interface.

• A
  5% (1)
• B
  84% (16)
• C
  11% (2)

Explanation

In ADVPN hub configurations, disabling net-device (B) is mandatory because it prevents the hub from creating a separate dynamic interface per spoke - instead, a single shared IPsec interface handles all spoke connections, which is what enables the ADVPN shortcut mechanism to function. Assigning a /32 mask to the IPsec overlay interface (D) is equally mandatory because it forces the hub to treat each spoke as an individual host route rather than a subnet, which is the routing model ADVPN depends on to broker spoke-to-spoke shortcuts.

Why A is wrong: The remote-ip in hub ADVPN configs is typically within the overlay subnet, not outside it - placing it on a different subnet would break connectivity to spokes.

Why C is wrong: add-route should generally be disabled on the hub, not enabled - route advertisement in ADVPN is handled by the dynamic routing protocol (e.g., BGP/OSPF), not by automatic route injection from the IPsec phase.

Memory tip: Think "Block per-peer interfaces, Drill down to /32" - the hub needs one shared interface (disable net-device) and host-level precision (/32) to route shortcut tunnels correctly.

No community discussion yet for this question.