Fortinet FortiGate 100A, Administration Manual

Page: 269 / 374

VPN ipsec phase1
FortiGate-100A Administration Guide 01-28007-0068-20041203
269
CLI configuration
This section provides information about features that must be configured through CLI
commands. CLI commands provide additional network options that cannot be
configured through the web-based manager. For complete descriptions and examples
of how to use CLI commands, see the
FortiGate CLI Reference Guide .
ipsec phase1
In the web-based manager, the Dead Peer Detection option can be enabled when you
define advanced Phase 1 options. The
config vpn ipsec phase1
CLI command
supports additional options for specifying a long and short idle time, a retry count, and
a retry interval.
Command syntax pattern
config vpn ipsec phase1
edit <name_str>
set <keyword> <variable>
end
config vpn ipsec phase1
edit <name_str>
unset <keyword>
end
ipsec phase1 command keywords and variables
Keywords and
variables Description Default Availability
dpd-idlecleanup
<seconds_integer>
The DPD long idle setting when
dpd
is set
to
enable
. Set the time, in seconds, that a
link must remain unused before the local
VPN peer pro-actively probes its state. After
this period of time expires, the local peer
will send a DPD probe to determine the
status of the link even if there is no traffic
between the local peer and the remote
peer. The
dpd-idlecleanup
range is 100
to 28 800 and must be greater than the
dpd-idleworry
setting.
300
seconds
All models.
dpd
must
be set to
enable
.
dpd-idleworry
<seconds_integer>
The DPD short idle setting when
dpd
is set
to
enable
. Set the time, in seconds, that a
link must remain unused before the local
VPN peer considers it to be idle. After this
period of time expires, whenever the local
peer sends traffic to the remote VPN peer it
will also send a DPD probe to determine
the status of the link. The
dpd-idleworry
range is 1 to 300.
To control the length of time that the
FortiGate unit takes to detect a dead peer
with DPD probes, use the
dpdretrycount
and
dpd-retryinterval
keywords.
10
seconds
All models.
dpd
must
be set to
enable
.