A company runs a FlexVPN hub-and-spoke topology built on IKEv2 and a dynamic VTI on the hub. Two branch spokes frequently exchange large volumes of VoIP and file-transfer traffic with each other, and network engineers notice all this traffic currently transits the hub, saturating the hub's WAN link and adding latency. Management wants the spokes to build direct tunnels dynamically without a full mesh of static tunnels. Which action should the engineer take to achieve this?