I've got a Dynamic Multipoint VPN tunnel setup, but I'm worried about the wildcard isakmp key, so is it possible to enable isakmp extended authentication (xauth) on the hub router? If so, could someone please point me to the documentation.
I think this should be possible. Following is a nice document on Configuring Dynamic Multipoint VPN (DMVPN) using GRE over IPSec between Multiple Routers. Gives you the hub configuration.