352-001 · Question #392
Which ISAKMP feature could be used within your design recommendation to reduce device CPU load in a small scale setup for known active ISAKMP security associations?
The correct answer is C. Dead Peer Detection (DPD). Dead Peer Detection (DPD) reduces CPU load by eliminating unnecessary ISAKMP keepalive exchanges. In on-demand DPD mode, the device only sends probe messages when it has traffic to send but receives no response from the peer - meaning that for known-active SAs where traffic is…
Question
Which ISAKMP feature could be used within your design recommendation to reduce device CPU load in a small scale setup for known active ISAKMP security associations?
Options
- Amain mode
- BIKEv2
- CDead Peer Detection (DPD)
- DSecurity Parameter Index (SPI)
How the community answered
(24 responses)- A4% (1)
- B13% (3)
- C79% (19)
- D4% (1)
Explanation
Dead Peer Detection (DPD) reduces CPU load by eliminating unnecessary ISAKMP keepalive exchanges. In on-demand DPD mode, the device only sends probe messages when it has traffic to send but receives no response from the peer - meaning that for known-active SAs where traffic is flowing, DPD generates no probes at all. This avoids constant CPU-intensive IKE exchanges just to verify liveness. Main mode (A) is actually more CPU-intensive than aggressive mode, using 6 messages instead of 3. IKEv2 (B) is more efficient overall but is not specifically targeted at reducing load for already-established, known-active SAs. The Security Parameter Index (D) is simply an identifier used to look up an SA, not a mechanism for reducing CPU overhead.
Topics
Community Discussion
No community discussion yet for this question.