The DPD is "not persistent" and is only triggered by a Phase 2 rekey

Reply
Highlighted
Cyber Elite

The DPD is "not persistent" and is only triggered by a Phase 2 rekey

 

I was reading this KB article about DPD

 

 

does this mean that say when phase 1 is down or its lifetime expires will DPD will come into play?

 

or 

 

when when phase 1 is red and phase 2 about to expire rekey will happen for phase 2 then DPD will come into play?

MP
Tags (1)

Accepted Solutions
Highlighted
L7 Applicator

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

this means the remote end was not able to respond to the R-U-THERE packet

 

this is like a heartbeat but with a little more 'intelligence': a ping heartbeat may be replied to by a system that is in a crashed state, while a isakmp r-u-there requires the host to lookup it's SA and formulate a reply. if DPD determines the remote end did not reply, the remote peer is identified as down

reaper - PANgurus.com
I drink and I know things

View solution in original post

Highlighted
L7 Applicator

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

If phase 1 is up and you get a DPD error, phase 1 will not stay up for long anymore as there is an SA mismatch or the remote peer is down
If the remote end stops sending DPD heartbeats, it has likely torn down the tunnel, or has died
reaper - PANgurus.com
I drink and I know things

View solution in original post


All Replies
Highlighted
L7 Applicator

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

hi @MP18 

Which article exactly?

 

please read this one: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFaCAK

 

DPD is used to detect if the peer device still has a valid IKE-SA. Periodically, it will send a “ISAKMP R-U-THERE” packet to the peer, which will respond back with an “ISAKMP R-U-THERE-ACK” acknowledgement.

 

so to both your questions: no

DPD is used to check on a healthy tunnel from the moment it is established

reaper - PANgurus.com
I drink and I know things
Highlighted
Cyber Elite

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

On system log i see if i filter via

 

( subtype eq vpn ) and ( severity eq low)

 

description contains 'IKE phase-1 SA is down determined by DPD.' ) and ( eventid eq ike-nego-p1-dpd-dn )

 

Does this mean that if phase 1 is down DPD will inform us?

 

Curious to understand this log?

MP
Highlighted
L7 Applicator

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

this means the remote end was not able to respond to the R-U-THERE packet

 

this is like a heartbeat but with a little more 'intelligence': a ping heartbeat may be replied to by a system that is in a crashed state, while a isakmp r-u-there requires the host to lookup it's SA and formulate a reply. if DPD determines the remote end did not reply, the remote peer is identified as down

reaper - PANgurus.com
I drink and I know things

View solution in original post

Highlighted
Cyber Elite

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

so does this mean that even if phase 1 is up and for some reason it is normail to see this message?

 

when we do not get DPD ask from neighbour device can we assume that phase 1 is down?

MP
Highlighted
Cyber Elite

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

Please answer my last question

MP
Highlighted
L7 Applicator

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

If phase 1 is up and you get a DPD error, phase 1 will not stay up for long anymore as there is an SA mismatch or the remote peer is down
If the remote end stops sending DPD heartbeats, it has likely torn down the tunnel, or has died
reaper - PANgurus.com
I drink and I know things

View solution in original post

Highlighted
Cyber Elite

Re: The DPD is "not persistent" and is only triggered by a Phase 2 rekey

Many Thanks Reaper

MP
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!