Which two statements about IKE version 2 fragmentation are true? (Choose two.)

Question

Options

• AIKEv2 fragmentation is performed at IP layer.
• BThe reassembly timeout default value is 30 seconds.
• COnly some IKE version 2 packets are considered fragmentable.
• DThe maximum number of IKE version 2 fragments are 64.

• A
  3% (1)
• B
  5% (2)
• C
  93% (37)

Explanation

C is correct because IKEv2 fragmentation (RFC 7383) only applies to messages that occur after the IKE Security Association is established - specifically IKE_AUTH, CREATE_CHILD_SA, and INFORMATIONAL messages. IKE_SA_INIT cannot be fragmented because the cryptographic context needed to protect fragments doesn't exist yet.

D is correct because the implementation caps the maximum number of IKEv2 fragments at 64, which is a defined limit in Cisco's IKEv2 fragmentation support.

A is wrong because IKEv2 fragmentation happens at the IKE layer, not the IP layer. This is a key distinction from traditional IP fragmentation - IKEv2 does its own fragmentation before handing packets to IP, avoiding issues with middleboxes that block IP fragments.

B is wrong because the default reassembly timeout is 60 seconds, not 30. Confusing this with other protocol timers is a common trap.

Memory tip: Think "64 fragments, 60 seconds" - both start with 6. And remember IKEv2 fragments itself (IKE layer) specifically because it can't fragment the very first exchange (SA_INIT) where no keys exist yet.

No community discussion yet for this question.