topic Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey in General Topics

The DPD is "not persistent" and is only triggered by a Phase 2 rekey

MP18 — Sat, 04 May 2019 16:34:46 GMT

I was reading this KB article about DPD

does this mean that say when phase 1 is down or its lifetime expires will DPD will come into play?

when when phase 1 is red and phase 2 about to expire rekey will happen for phase 2 then DPD will come into play?

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

reaper — Tue, 07 May 2019 08:09:46 GMT

hi @MP18

Which article exactly?

please read this one: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFaCAK

DPD is used to detect if the peer device still has a valid IKE-SA. Periodically, it will send a “ISAKMP R-U-THERE” packet to the peer, which will respond back with an “ISAKMP R-U-THERE-ACK” acknowledgement.

so to both your questions: no

DPD is used to check on a healthy tunnel from the moment it is established

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

MP18 — Wed, 08 May 2019 03:13:35 GMT

On system log i see if i filter via

( subtype eq vpn ) and ( severity eq low)

description contains 'IKE phase-1 SA is down determined by DPD.' ) and ( eventid eq ike-nego-p1-dpd-dn )

Does this mean that if phase 1 is down DPD will inform us?

Curious to understand this log?

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

reaper — Wed, 08 May 2019 07:49:17 GMT

this means the remote end was not able to respond to the R-U-THERE packet

this is like a heartbeat but with a little more 'intelligence': a ping heartbeat may be replied to by a system that is in a crashed state, while a isakmp r-u-there requires the host to lookup it's SA and formulate a reply. if DPD determines the remote end did not reply, the remote peer is identified as down

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

MP18 — Thu, 09 May 2019 05:24:36 GMT

so does this mean that even if phase 1 is up and for some reason it is normail to see this message?

when we do not get DPD ask from neighbour device can we assume that phase 1 is down?

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

MP18 — Fri, 10 May 2019 16:40:26 GMT

Please answer my last question

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

reaper — Fri, 10 May 2019 22:09:26 GMT

If phase 1 is up and you get a DPD error, phase 1 will not stay up for long anymore as there is an SA mismatch or the remote peer is down
If the remote end stops sending DPD heartbeats, it has likely torn down the tunnel, or has died

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

MP18 — Sat, 11 May 2019 05:29:48 GMT

Many Thanks Reaper