DPD example

In unstable or unreliable network access conditions with high packet loss and jitter, look for the following signs for high DPD sensitivity:

• FortiClient fails to connect to IPsec VPN.
• When you view the FortiGate IKE debug log, you see that FortiOS sends R_U_THERE to FortiClient, but there is no reply, and it times out.

You can reduce the DPD sensitivity by increasing the values for counter and interval on both FortiClient and FortiGate. These values are not negotiated and are independent of each other.

FortiGate	Use the following FortiOS CLI commands: config vpn ipsec phase1-interface edit <your IPsec VPN> set dpd-retrycount <configure a higher number> set dpd-retryinterval <configure a higher number> next end
FortiClient	Using the following XML configuration: <ipsecvpn> <connections> <connection> <ike_settings> <dpd>1</dpd> <dpd_retry_count>configure a higher number</dpd_retry_count> <dpd_retry_interval>configure a higher number</dpd_retry_interval>