102
6620-3201
4.43 Confi gure
>
IPSec
>
DPD
When an IPSec tunnel is not receiving packets, the unit will send an IKE DPD request at regular
intervals. If no response is received to the DPD request, more requests are sent at a shorter interval
until either the maximum outstanding requests allowed is reached or a response is received. If no
response is received to the con
fi
gured maximum requests, the IPSec SA’s are removed.
Note:
IKE DPD requests require that an IKE SA is present. If one is not present, the DPD request will fail.
To help ensure that an IKE SA exists with a lifetime at least as great as the IPSec lifetime, the unit
creates new IKE SA’s whenever the desire IPSec SA lifetime exceeds the lifetime of an existing IKE
SA, and attempts to negotiate a lifetime for the IKE SA that is 60 seconds longer than the desired
lifetime of the IPSec SA.
Using the Web Page(s)
Request interval on healthy link:
This parameter de
fi
nes the interval at which DPD requests on a link that is deemed to be healthy.
Request interval on suspect link:
This parameter de
fi
nes the interval at which DPD requests on a link that is deemed to be suspect.
Tunnel inactivity timer (s):
This parameter de
fi
nes the period of time for inactivity on a tunnel before it is deemed to be suspect,
i.e. if there is no activity on a healthy link for the time period de
fi
ned in this parameter, the link is then
deemed to be suspect.
Remove IPsec SA’s after this many failed DPD requests:
This parameter de
fi
nes the maximum number of DPD requests that will be sent without receiving a
response before the IPSec SA’s are removed.
Using Text Commands
From the command line, use the
dpd
command to con
fi
gure or display DPD settings.
To display current settings for DPD enter the command:
dpd <instance> ?
where
<instance>
is 0.
To change the value of a parameter use the command in the format:
dpd 0 <parameter> <value>
The parameters and values are:
Parameter
Values
Equivalent Web Parameter
failint
number
Request interval on suspect link
inact
number
Tunnel inactivity timer (s)
maxfail number
Remove IPSec SA’s after this
many failed DPD requests
okint
number
request interval on healthy link
For example, to set the Tunnel inactivity timer to 2 minutes you would enter:
dpd 0 inact 120
