Forticlient IPSec VPN remains connected

hello

please refer to the document related to Dead Peer Detection (DPD) 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-A-FortiGate-is-not-initiating-DPD-probes/ta-p/194437

If there is incoming data traffic on ANY phase 2 selector from the IKE peer, FortiGate WILL NOT send DPD_R_U_THERE under any circumstance. 
 
If phase1 configuration has 'set dpd on-idle': FortiGate will send DPD_R_U_THERE if it does not receive any IPsec (data) traffic from the remote peer. If multiple IPsec (phase 2) selectors are configured but only one has incoming data traffic, no DPD will be sent. If no IPsec SA is available, FortiGate WILL send DPD. 
 
If phase1 configuration has 'set dpd on-demand': This is the default configuration. The behavior is like DPD 'idle', but with the additional requirement that FortiGate will only send the DPD_R_U_THERE if it has also sent data traffic over the IPsec tunnel during the previous DPD interval.
The device does not check whether the incoming traffic is related to the outgoing traffic. If there is incoming traffic on one phase2 selector and outgoing on another, FortiGate WILL NOT send DPD_R_U_THERE. If no phase2 selector is available, FortiGate WILL NOT send DPD. 

Hi Shashwati,

thanks for reply and for link about dpd.

My issue is not related to dpd but to the missing disconnect from client to fortigate.

Let me explain better:

1) I start connection from forticlient IPSec to Fortigate

2) Connection is esablished and I see it fortigate management.

3) THen I hit "disconnect" on client

4) After a couple of seconds client report Disconnected

If I then look at fortigate managemnet, I still see the connection as established. COnnection closes only after DPD (and fortigate report this).

I see this when I use a "full tunnel" vpn.

If VPN is a split-tunnel, then hitting disconnect on client causes both closure on client and fortigate.

I think that when establishing a full tunnel disconnect packets are sent WITHIN the tunnel (I see them with wireshark sniffing the virtual adapter).

I guess I did something wrong because I can't believe this is the default behaviour .

Thanks

Thank you so much for sharing link.

Can you please elaborate on this?   I am having a similar issue, but in my research, I am not finding any setting that would appear to communicate this to the Fortigate.