The DPD is "not persistent" and is only triggered by a Phase 2 rekey

[MP18]

I was reading this KB article about DPD

does this mean that say when phase 1 is down or its lifetime expires will DPD will come into play?

or 

when when phase 1 is red and phase 2 about to expire rekey will happen for phase 2 then DPD will come into play?

[reaper]

hi @MP18 

Which article exactly?

please read this one: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFaCAK

DPD is used to detect if the peer device still has a valid IKE-SA. Periodically, it will send a “ISAKMP R-U-THERE” packet to the peer, which will respond back with an “ISAKMP R-U-THERE-ACK” acknowledgement.

so to both your questions: no

DPD is used to check on a healthy tunnel from the moment it is established

[MP18]

On system log i see if i filter via

( subtype eq vpn ) and ( severity eq low)

description contains 'IKE phase-1 SA is down determined by DPD.' ) and ( eventid eq ike-nego-p1-dpd-dn )

Does this mean that if phase 1 is down DPD will inform us?

Curious to understand this log?

[reaper · Accepted solution]

this means the remote end was not able to respond to the R-U-THERE packet

this is like a heartbeat but with a little more 'intelligence': a ping heartbeat may be replied to by a system that is in a crashed state, while a isakmp r-u-there requires the host to lookup it's SA and formulate a reply. if DPD determines the remote end did not reply, the remote peer is identified as down

[MP18]

so does this mean that even if phase 1 is up and for some reason it is normail to see this message?

when we do not get DPD ask from neighbour device can we assume that phase 1 is down?

[MP18]

Please answer my last question

[reaper · Accepted solution]

If phase 1 is up and you get a DPD error, phase 1 will not stay up for long anymore as there is an SA mismatch or the remote peer is down
If the remote end stops sending DPD heartbeats, it has likely torn down the tunnel, or has died

[MP18]

Many Thanks Reaper