A DMVPN deployment shows spokes registered on the hub (NHRP registrations present), but spokes still forward traffic via the hub instead of forming direct spoke-to-spoke tunnels. Which two configurations are required to enable direct spoke-to-spoke routing? Choose two.

To enable direct spoke-to-spoke tunnels in a DMVPN Phase 2 or 3 deployment, two key configurations are required. First, ip nhrp redirect must be configured on the hub router's tunnel interface. This command instructs the hub to send an NHRP Redirect message to the source spoke when it detects traffic destined for another spoke, informing the source spoke of the destination spoke's real IP address. Second, ip nhrp shortcut must be configured on each spoke router's tunnel interface. This command enables the spoke to process the NHRP Redirect message from the hub and then initiate a direct spoke-to-spoke tunnel with the destination spoke. Applying a crypto map on the hub's multipoint GRE interface is incorrect because crypto maps are used for IPsec, which is typically applied to the tunnel interface itself, not just the GRE. Changing the tunnel mode to gre ip on all devices is incorrect because DMVPN relies on gre multipoint for its hub-and-spoke and spoke-to-spoke capabilities.