Dead peer detection

Notice a dead peer

Lesson 14 of 20 · 11 min · Module 4: Keeping the tunnel up

A tunnel has no cable to unplug. When the other gateway restarts, this one keeps encrypting packets for a peer that no longer has the keys.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Explain why a restarted peer causes a long outage
Configure dead peer detection
Estimate the outage from the DPD interval

The idea

After a restart the peer has forgotten every SA. This gateway still holds them and keeps sending traffic that the peer silently discards. Dead peer detection (DPD) sends a small probe when the tunnel is quiet; after a few unanswered probes the gateway deletes the SAs and negotiates new ones. Without DPD the gap lasts until the SA expires.

dpd 15

01Why the outage is so long without DPD

The child SA lives for an hour. If the peer restarts ten minutes in, this gateway has fifty minutes of lifetime left and no reason to doubt its SA. Users see a tunnel that is "up" and passes nothing.

02How DPD shortens it

With dpd 10, the gateway probes every 10 seconds when no traffic arrives. Three missed probes, about 30 seconds, and it declares the peer dead and renegotiates. In this lab the Output tab estimates the outage for one peer restart.

03DPD on real devices

IKEv2 calls it a liveness check; the configuration still says DPD. Very short intervals cause false alarms on poor links, so 10 to 30 seconds is usual.

# FortiGate
config vpn ipsec phase1-interface
    edit "to-branch"
        set dpd on-idle
        set dpd-retryinterval 10
        set dpd-retrycount 3
    next
end

# Cisco IOS
crypto ikev2 profile BRANCH
 dpd 10 3 periodic

# strongSwan (swanctl.conf)
connections {
  branch {
    dpd_delay = 10s
  }
}

Your turn

The branch gateway restarted last week and the offices were cut off for 50 minutes. Add dead peer detection so that an outage of this kind lasts at most 60 seconds. Do not probe more often than every 5 seconds.

What the checks look for

Dead peer detection is on
An outage after a peer restart lasts at most 60 seconds
The probes are not more frequent than every 5 seconds
The tunnel is up and stable

Try it in the editor →

Take this with you

DPD turns an outage of up to one SA lifetime into one of a few probe intervals. Use it on every tunnel, with an interval of 10 to 30 seconds.

Go a little further

Try dpd 30 and read the estimated outage. Decide which interval you would choose for a link that sometimes loses packets for a few seconds.