Troubleshooting Tip: Unexpected DPD added on the FGCP secondary after creating a tunnel on the primary unit

Description

This article describes an issue where adding an IPsec tunnel on the FGCP (Active-Passive) primary unit causes the DPD to be added to a tunnel on the secondary unit where DPD was not configured.

Scope

FortiOS v7.x.

Solution

This issue occurs when the tunnel type is set to dynamic. In this case, the DPD settings (dpd and dpd-interval), which are not configured on the primary unit, are incorrectly added to the secondary unit.

1. When a tunnel without DPD configured is added to the primary unit, the secondary unit synchronizes the configuration through the ha_daemon process.

Tunnel configuration on the primary unit:

config vpn ipsec phase1-interface
    edit "N8_TEST4000_1"
        set type dynamic
        set interface "TO_INTERNET"
        set ike-version 2
        set peertype one
        set net-device disable
        set proposal aes256-sha256
        set peerid "N8_TEST4000_1"
        set psksecret *
    next
end

CLI debugging on the secondary unit:

2026-06-22 16:02:18 0: config vpn ipsec phase1-interface
2026-06-22 16:02:18 0: edit "N8_TEST4000_1"
2026-06-22 16:02:18 0: unset psksecret
2026-06-22 16:02:18 0: unset peerid
2026-06-22 16:02:18 0: clear proposal
2026-06-22 16:02:18 0: unset net-device
2026-06-22 16:02:18 0: unset peertype
2026-06-22 16:02:18 0: unset ike-version
2026-06-22 16:02:18 0: unset interface
2026-06-22 16:02:18 0: unset type
2026-06-22 16:02:18 0: set type dynamic
2026-06-22 16:02:18 0: set interface "TO_INTERNET"
2026-06-22 16:02:18 0: set ike-version 2
2026-06-22 16:02:18 0: set peertype one
2026-06-22 16:02:18 0: set net-device disable
2026-06-22 16:02:18 0: select proposal aes256-sha256
2026-06-22 16:02:18 0: set peerid "N8_TEST4000_1"
2026-06-22 16:02:18 0: set psksecret *
2026-06-22 16:02:18 0: next
2026-06-22 16:02:18 0: end

2. However, after the tunnel configuration is synchronized by HA, the configuration on the secondary unit appears as shown below.

Take particular note of 'set dpd on-idle' and 'set dpd-retryinterval 60'.

show vpn ipsec phase1-interface N8_TEST4000_1
path=vpn.ipsec, objname=phase1-interface, tablename=N8_TEST4000_1, size=2960
config vpn ipsec phase1-interface
    edit "N8_TEST4000_1"
        set type dynamic
        set interface "TO_INTERNET"
        set ike-version 2
        set peertype one
        set net-device disable
        set proposal aes256-sha256
        set dpd on-idle
        set peerid "N8_TEST4000_1"
        set psksecret *
        set dpd-retryinterval 60
    next
end

As a result, the configuration mismatch may cause the HA status to change to out-of-sync.

As a workaround, manually update the configuration to synchronize the mismatched settings.

This issue will be fixed in FortiOS v8.0.1.