ACM Installation and Operations Guide
Rev 3 Nov 17
50
4119855
Dead Peer Detection is not Working
If dead peer detection (DPD) is not functioning properly:
•
Make sure the correct “set vpn ipsec” DPD options are used:
·
When enabling DPD, use “action clear”—do not use “action hold” or “action
reset”.
For example:
set vpn ipsec ike-group <IKE-GRP-NAME> dead-peer-
detection action clear
·
If using IKEv1, use “dead-peer-detection interval” and “dead-peer-detection
timeout”. See
Configure IKE Groups with IKEv1
·
If using IKEv2, use “ikev2-retransmit-timeout” and “ikev2-retransmit-tries”.
See
Configure IKE Groups with MOBIKE (IKEv2)
vpn ipsec ‘lifetime’ Command is Not
Available
The ‘lifetime command is no longer supported for either IKEv1 or IKEv2 and has
been removed.
VPN Tunnel Establishes with Mismatched
IKE Group
Note: This issue applies to IKEv1 and IKEv2.
If the ACM is configured with multiple IKE groups (e.g group_1, group_2) and has
configured a peer with one of those groups (e.g. group_1), a VPN tunnel will be
established if the peer uses any of the configured IKE groups.
For example:
·
On the ACM:
·
ACM configured with IKE groups group_1 and group_2
·
ACM configures peer with group_1
·
On the peer:
·
If peer is configured to use group_1, a tunnel will establish (peer’s config-
uration matches the ACM’s configuration for the peer).
·
If the peer is configured to use group_2, a tunnel will establish (peer’s
configuration does not match the ACM’s configuration for the peer, but
does match one of the groups configured on the ACM).
·
If the peer is configured to use group_3, a tunnel will fail to establish
because the ACM is not configured with group_3.
