On a DMVPN spoke configured with ip mtu 1400, which command enables fragmentation and the maximum negotiated TCP MTU over GRE/IPsec?

The ip tcp adjust-mss command is used to set the maximum segment size (MSS) for TCP sessions, preventing fragmentation at the TCP layer. An MSS of 1360 is appropriate here because a DMVPN spoke with an IP MTU of 1400 typically has an overhead of 40 bytes (20 for GRE, 20 for IPsec tunnel mode), leaving 1360 bytes for the TCP payload (1400 - 40 = 1360). The crypto ipsec fragmentation after-encryption command explicitly enables IP fragmentation after IPsec encryption, which is crucial for DMVPN spokes. This prevents the spoke from dropping packets that exceed the tunnel's MTU after encryption. mtu-discovery is not the correct keyword for explicitly enabling fragmentation in this context. ip tcp payload-mtu is not a valid command for adjusting TCP MSS.