300-730 · Question #219
Which state means IKEv1 Phase 1 is up when the show crypto isakmp sa command is run?
The correct answer is D. QM_IDLE. The 'show crypto isakmp sa' command displays the state of IKEv1 Phase 1 security associations. QM_IDLE indicates that Phase 1 (Main Mode) completed successfully and the ISAKMP SA is active.
Question
Options
- AQM_AUTH_AWAIT
- BMM_KEY_EXCH
- CMM_SA_SETUP
- DQM_IDLE
How the community answered
(55 responses)- A2% (1)
- B2% (1)
- C4% (2)
- D93% (51)
Why each option
The 'show crypto isakmp sa' command displays the state of IKEv1 Phase 1 security associations. QM_IDLE indicates that Phase 1 (Main Mode) completed successfully and the ISAKMP SA is active.
QM_AUTH_AWAIT indicates the device is waiting for authentication during Quick Mode, meaning Phase 1 is not yet fully complete.
MM_KEY_EXCH indicates the peers are in the middle of Diffie-Hellman key exchange during Main Mode, so Phase 1 is still in progress.
MM_SA_SETUP indicates the ISAKMP SA parameters are still being negotiated in Main Mode, so Phase 1 has not completed.
QM_IDLE stands for 'Quick Mode Idle,' meaning the IKEv1 Main Mode (Phase 1) negotiation finished successfully and the ISAKMP SA is established and ready. The SA sits idle at this state waiting for Phase 2 Quick Mode to be triggered by traffic.
Concept tested: IKEv1 Phase 1 ISAKMP SA state interpretation
Source: https://www.cisco.com/c/en/us/support/docs/security/ios-ipsec/5409-ipsec-debug-00.html
Topics
Community Discussion
No community discussion yet for this question.