Which command verifies that IPsec is protecting DMVPN tunnel traffic?
- show interface tunnel
- show dmvpn
- show ip nhrp
- show crypto ipsec sa
Explanation: According to the sources, the show crypto ipsec sa command is used to verify that IPsec is actively protecting DMVPN tunnel traffic. This command provides detailed information about established Security Associations (SAs), including the specific transform sets being used and granular statistics on the number of packets that have been encrypted and decrypted. While show dmvpn provides a high-level view of the tunnel and session status, show crypto ipsec sa is the primary tool for confirming that the data plane traffic is being successfully secured as it flows between the hub and spoke routers.
Related exam: CCNP ENARSI v9 Course Final Exam
