Fortinet FortiGate FortiGate-100A, Administration Manual

Page: 274 / 388

274
01-28006-0068-20041105 Fortinet Inc.
ipsec phase1 VPN
ipsec phase1 command keywords and variables
Keywords and
variables Description Default Availability
dpd-idlecleanup
<seconds_integer>
The DPD long idle setting when
dpd
is set
to
enable
. Set the time, in seconds, that a
link must remain unused before the local
VPN peer pro-actively probes its state. After
this period of time expires, the local peer
will send a DPD probe to determine the
status of the link even if there is no traffic
between the local peer and the remote
peer. The
dpd-idlecleanup
range is 100
to 28 800 and must be greater than the
dpd-idleworry
setting.
300
seconds
All models.
dpd
must
be set to
enable
.
dpd-idleworry
<seconds_integer>
The DPD short idle setting when
dpd
is set
to
enable
. Set the time, in seconds, that a
link must remain unused before the local
VPN peer considers it to be idle. After this
period of time expires, whenever the local
peer sends traffic to the remote VPN peer it
will also send a DPD probe to determine
the status of the link. The
dpd-idleworry
range is 1 to 300.
To control the length of time that the
FortiGate unit takes to detect a dead peer
with DPD probes, use the
dpdretrycount
and
dpd-retryinterval
keywords.
10
seconds
All models.
dpd
must
be set to
enable
.
dpd-retrycount
<retry_integer>
The DPD retry count when
dpd
is set to
enable
. Set the number of times that the
local VPN peer sends a DPD probe before
it considers the link to be dead and tears
down the security association (SA). The
dpd-retrycount
range is 0 to 10.
To avoid false negatives due to congestion
or other transient failures, set the retry
count to a sufficiently high value for your
network.
3 All models.
dpd
must
be set to
enable
.
dpd-retryinterval
<seconds_integer>
The DPD retry interval when
dpd
is set to
enable
. Set the time, in seconds, that the
local VPN peer waits between sending DPD
probes. The
dpd-retryinterval
range
is 1 to 60.
5
seconds
All models.
dpd
must
be set to
enable
.