A: Only some IKEv2 packets are considered fragmentable: AUTH, CREATE_CHILD_SA, and some INFORMATIONAL.
B: Reassembly timeout is 15 seconds, not 30 seconds.
C: Check the question and the Study guide. IKEv2 fragmentation does happen in the IP layer, and IKEv2 fragmentation "SUPPORT" happens at the IKE layer instead of the IP layer.
D: The maximum number of IKEv2 fragments is 64, not 128
A and C are correct. See page 300 in the Enterprise Firewall 7.2 Study Guide:
A: Only some IKEv2 packets are considered fragmentable: AUTH, CREATE_CHILD_SA, and some INFORMATIONAL.
C: Page 299 in Study Guide: If fragmentation occurs at the IP layer, during the IKEv2 connection, it is possible that payload sizes may exceed the IP MTU and packets get fragmented.
Now, on page 300, it is indeed stated that fragmentation is performed on the IKE-layer to solve the issues raised with Fragmentation on the IP-layer. This is supported on IKEv2 with IKEv2 fragmentation support:
config vpn ipsec-phase1-$interface
set ike-version 2
set fragmentation enable | disable
set fragmentation-mtu $size
Bottom line; somewhat tricky question, at least with regards to it requesting two answers, and i definitely isn't B or D.
Answer should be A only, but it requires 2 answers so it's AC ...
p300 :
A correct : "Only some packets are considered fragmentable."
C wrong : "With IKEv2 fragmentation support, the fragmentation occurs at the IKE layer instead of the IP layer." BUT if set fragmentation is set to disable, then answer C could be right ....
BD wrong : "The maximum number of IKEv2 fragments are 64, and the reassembly timeout is 15 seconds."
only A is correct imho
A -> yes, study guide p. 300
B -> reassembly timeout 15 sec, not 30
C -> nope, fragmentation is done at IKE layer, not IP! (To not be blocked by firewalls)
D -> nope, the max number is 64 (p. 300 study guide)
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
havokdu
Highly Voted 10 months, 1 week agotruserud
Highly Voted 1 year agonetworkconundrums1
Most Recent 7 months, 3 weeks agomecacig953
9 months, 1 week agocharruco
11 months, 2 weeks agoKop01
1 year, 1 month agoArtbrut
1 year, 1 month agoArtbrut
1 year, 1 month ago5deee77
1 year, 1 month agorananaj
1 year, 1 month agorananaj
1 year, 1 month ago