A network engineer configures a single-hub DMVPN over the Internet with IPsec protection. Small pings across the tunnel succeed, and NHRP registration is up, but users report that large HTTP transfers and some application sessions hang or fail intermittently. A packet capture shows large TCP segments with the DF bit set being dropped along the path. Which configuration on the tunnel interface most directly resolves this issue?