wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels

Forum|Forum|19 days ago
May 28, 2026
5 replies
165 views

I have a question, for NSE4 please.

wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. The
requirement is that FortiGate sends DPD probes only when there is no inbound traffic.
Which DPD mode on FortiGate meets this requirement?
A. Enabled
B. On Idle
C. Disabled
D. On Demand

dpd

Best answer by sjoshi

Hi @msfconsole

The correct answer is D on demand as question says dpd is sent only when there is no inbound traffic

DPD:
Disable: FortiGate never sends DPD probes to the remote peer, but responds to DPD probes received
On-idle: FortiGate sends DPD probes when no traffic is observed in the tunnel (outbound or inbound).
On-demand: FortiGate sends DPD probes if there is only outbound traffic through the tunnel, but no inbound. On-demand is the default setting.

Refer:

Toshi_Esumi

SuperUser

I would say ‘B’. But on-idle doesn’t cause sending keepalives if it still has outbound traffic.
Tricky question.

Toshi

msfconsoleAuthor

Visitor II

hey @Toshi_Esumi

thanx bro

DZ

Toshi_Esumi

SuperUser

You’re NOT in the middle of the test and cheating, right?

Toshi

sjoshiAnswer

Staff

Hi @msfconsole

The correct answer is D on demand as question says dpd is sent only when there is no inbound traffic

DPD:
Disable: FortiGate never sends DPD probes to the remote peer, but responds to DPD probes received
On-idle: FortiGate sends DPD probes when no traffic is observed in the tunnel (outbound or inbound).
On-demand: FortiGate sends DPD probes if there is only outbound traffic through the tunnel, but no inbound. On-demand is the default setting.

Refer:

Thanks, Salon