Which DPD mode on FortiGate will meet the above requirement?

An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the tunnel.

Which DPD mode on FortiGate will meet the above requirement?
A . Disabled
B . On Demand
C . Enabled
D . On Idle

Answer: D

Explanation:

The Dead Peer Detection (DPD) mode on FortiGate that will meet the requirement of sending DPD probes only when no traffic is observed in the tunnel is "On Idle."

Therefore, the correct answer is:

D. On Idle

Disabled:

DPD is turned off. No detection probes are sent.

On Demand:

DPD probes are sent when there is no traffic detected in the tunnel for a specified period.

Enabled:

DPD probes are sent periodically, regardless of whether there is traffic in the tunnel or not.

On Idle:

DPD probes are sent only when there is no traffic observed in the tunnel for a certain period. This mode is often preferred when you want to conserve bandwidth by sending DPD probes only when the tunnel is not actively transmitting data.

In the context of the administrator’s requirement to send DPD probes only when no traffic is observed in the tunnel, the appropriate choice is "On Idle." This ensures that the DPD probes are triggered only during periods of inactivity, helping to detect and address potential issues in a more bandwidth-efficient manner.