Three generations of Cisco multipoint VPN, all built from the same bricks (mGRE + IPsec + a smart control plane):

DMVPN

• mGRE one interface, infinite spokes; NHRP maps tunnel IPs to real WAN IPs; IPsec encrypts per-tunnel via tunnel protection ipsec profile.
• Phase 1 hub-and-spoke, phase 2 spoke-to-spoke on demand, phase 3 NHRP redirect/shortcut — CCNP favourite.
• Hub config essentials: tunnel mode gre multipoint, ip nhrp map multicast dynamic, no ip redirects.

FlexVPN

The modern rebuild: IKEv2 everywhere (proposals/policies/keyrings/profiles), VTI data plane, hub-spoke and mesh from one framework, cert or PSK auth. If designing new, build FlexVPN.

interface Tunnel10
 tunnel mode ipsec ipv4
 tunnel protection ipsec profile FLEX-IPSEC

Old-school DMVPN still runs the world’s WANs; FlexVPN is what you’d write today. GRE-over-IPsec is the static two-router version of the same idea.