On a DMVPN network using multipoint GRE (mGRE), spokes must encrypt traffic destined for other spokes. Which single configuration is required on spokes to apply IPsec to mGRE-based spokes-to-spokes tunnels?

The tunnel protection ipsec profile command on the mGRE tunnel interface is the correct and most efficient way to apply IPsec to spoke-to-spoke tunnels in a DMVPN Phase 2 or 3 deployment. This command integrates IPsec directly with the NHRP resolution process, allowing spokes to dynamically establish secure tunnels with each other without pre-configuring static crypto maps for every possible spoke-to-spoke combination. Applying a crypto map to the mGRE tunnel interface is incorrect because crypto maps are typically used for static VPNs or traditional GRE over IPsec, not for dynamic mGRE tunnels where spoke-to-spoke tunnels are established on demand. Configuring static IPsec SAs per spoke pair is impractical and unscalable in a large DMVPN network, defeating the purpose of mGRE's dynamic nature. Enabling ip nhrp map multicast on the hub is necessary for multicast traffic over DMVPN but does not directly apply IPsec encryption to the tunnels.