"Sharing IPsec with Tunnel Protection required in some DMVPN configs"

[MicJameson1]

Hello tech gods upon giant marble thrones atop mount Olympus.

Sharing IPSec with Tunnel Protection  [Support] - Cisco Systems

I am configuring a new DMVPN architecture. Because there are so many caveats to using shared IPsec with tunnel protection (as can be read in above link, my default is to not use this shared tunnel protection technology. I really don't see significant upside to the feature.

Near the beginning of text in above link, it states "Sharing IPsec with Tunnel Protection feature is required in some DMVPN configurations."

QUESTION: Specifically what are the "some" configurations that "Sharing IPsec with Tunnel Protection feature is required in some DMVPN configurations." refers to?

Thank you.

[Rob Ingram]

@MicJameson1

"The tunnel protection IPsec profile shared command is used to create a single IPsec SADB for all the tunnel interfaces that use the same profile and tunnel source interface"

How many source interfaces (WAN/Internet etc) do you have, if one interface you don't need to use "shared".

[MicJameson1]

I have not yet decided if I will use mor ethan 1 interface.

The essence of the question was what are any instances in which "shared" is required. Are there any "shared" required instances-- I cannot erect my topology without using "shared"?

[Rob Ingram · Accepted solution]

@MicJameson1 shared is required if you use the same physical interface as the tunnel source and ipsec profile for multiple mGRE tunnel interfaces.

[MHM Cisco World]

let see 
if you use in Spoke with dual hub (two tunnel) if you loss interface then you loss connection to both hub so it useless in spoke side 
if you use it in Hub BUT one hub is primary and other is backup and the spoke is register to backup hub not to primary here you can use one interface with shared and two tunnel