DPD example

In unstable or unreliable network access conditions with high packet loss and jitter, look for the following signs for high DPD sensitivity:

• FortiClient fails to connect to IPsec VPN.
• When you view the FortiGate IKE debug log, you see that FortiOS sends R_U_THERE to FortiClient, but there is no reply, and it times out.

• You see the following keywords in the log:

  [2025-06-27 11:00:19.2073601 UTC-04:00] [3872:28148] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=1
  [2025-06-27 11:00:34.2724427 UTC-04:00] [3872:28148] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=1
  [2025-06-27 11:00:59.5257183 UTC-04:00] [3872:28148] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=1
  [2025-06-27 11:01:09.5165906 UTC-04:00] [3872:28148] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=1
  [2025-06-27 11:01:14.5274611 UTC-04:00] [3872:28148] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=2
  [2025-06-27 11:01:19.5395036 UTC-04:00] [3872:28148] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=3
  [2025-06-27 11:01:19.5406340 UTC-04:00] [3872:28148] [FortiIKE  1537   debug] DPD: remote seems to be dead
  [2025-06-27 11:01:58.7842043 UTC-04:00] [32224:1548] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=1
  [2025-06-27 11:02:03.7878441 UTC-04:00] [32224:1548] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=2
  [2025-06-27 11:02:08.7913275 UTC-04:00] [32224:1548] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=3
  [2025-06-27 11:02:08.7918472 UTC-04:00] [32224:1548] [FortiIKE  1537   debug] DPD: remote seems to be dead
  [2025-06-27 11:02:41.4692064 UTC-04:00] [7672:3696] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=1
  [2025-06-27 11:02:46.4155996 UTC-04:00] [7672:3696] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=2
  [2025-06-27 11:02:51.4222846 UTC-04:00] [7672:3696] [FortiIKE  1531   debug] DPD monitoring....dpd_fails=3
  [2025-06-27 11:02:51.4233503 UTC-04:00] [7672:3696] [FortiIKE  1537   debug] DPD: remote seems to be dead

You can reduce the DPD sensitivity by increasing the values for counter and interval on both FortiClient and FortiGate. These values are not negotiated and are independent from each other.

FortiGate	Use the following FortiOS CLI commands: config vpn ipsec phase1-interface edit <your IPsec VPN> set dpd-retrycount <configure a higher number> set dpd-retryinterval <configure a higher number> next end
FortiClient	Using the following XML configuration: <ipsecvpn> <connections> <connection> <ike_settings> <dpd>1</dpd> <dpd_retry_count>configure a higher number</dpd_retry_count> <dpd_retry_interval>configure a higher number</dpd_retry_interval>