You are deploying a single-hub DMVPN. All spokes have formed their GRE tunnels but none of the spokes can register with the hub, and 'show ip nhrp' on the hub shows no dynamic mappings. The tunnel interfaces are up/up and ping to the hub's tunnel address fails. On a spoke you run 'debug nhrp' and see the message 'NHRP: Receive Registration Reply' is never generated, while the hub logs 'NHRP: Rejecting authentication error'. What is the most likely cause?