Which ISAKMP feature can be used to reduce device CPU load by not sending keepalive messages for known active ISAKMP security associations?

DPD (defined in RFC 3706) uses an on-demand model where a device sends a DPD query only when it has traffic to forward but has received no recent reply from the peer; when the ISAKMP SA is actively exchanging data, no DPD messages are generated, eliminating the periodic keepalive overhead. This directly reduces CPU cycles compared to heartbeat-style keepalives that fire at fixed intervals regardless of SA activity.

IKEv2 improves on IKEv1 with fewer message exchanges and better reliability, but it is a protocol version, not a feature that specifically suppresses keepalives for known-active security associations.

SPI (Security Parameter Index) is an identifier in the IPsec and IKE packet headers used to look up the correct SA at the receiver; it has no function related to keepalive scheduling or CPU optimization.

Main mode is one of the IKEv1 Phase 1 negotiation modes offering identity protection through six message exchanges; it defines how an SA is established, not how keepalives are handled afterward.