Technical Tip: FortiClient Disconnecting dial-up VPN Intermittently due to DPD

[mhemambika]

Description	The article describes the intermittent disconnection of FortiClient from dialup VPN due to DPD (Dead Peer Detection).
Scope	FortiGate, FortiClient.
Solution	There have been instances where FortiClient experiences random disconnections from the dial-up VPN. Diagram: User PC--------Dial up VPN ----------------port7-------FortiGate. The IKE debug information is as follows: ike V=root:0:ASCL-VPN_0:343765: recv IPsec SA delete, spi count 1 --> FortiGate is receiving the notification to remove the connection from the user station. ike V=root:0:ASCL-VPN_0: deleting IPsec SA with SPI d55d2270 ike V=root:0:ASCL-VPN_0:ASCL-VPN: deleted IPsec SA with SPI d55d2270, SA count: 0 ike V=ASCL-VPN:0:ASCL-VPN:1775094: del route 10.10.50.1/255.255.255.255 tunnel 10.10.50.1 oif ASCL-VPN(54) metric 15 priority 1 ike V=root:0:ASCL-VPN_0: sending SNMP tunnel DOWN trap for ASCL-VPN ike V=root:0:ASCL-VPN_0: remote selector down event 10.10.50.1 (devidx=54) ike V=root:0:ASCL-VPN_0: user 'userAbc@gmail.com' 10.10.50.1 del ike V=root:0:ASCL-VPN_0:ASCL-VPN: delete ike V=root:0: comes 106.222.225.29:13953->192.168.15.1:4500,ifindex=15,vrf=0,len=112.... Dead Peer Detection (DPD) in VPN is a system that ensures the availability of an IKE peer in an IPsec VPN connection. It assists in identifying when a peer stops responding or becomes unavailable, enabling the VPN devices to immediately restore the connection before it expires. DPD periodically communicates with the peers to confirm their availability and preserve the stability of the VPN tunnel. The FortiGate receives a notification to remove the connection from the user station. In such cases, disabling DPD on both the firewall and FortiClient can resolve these issues. To disable the DPD in IPsec VPN, run the below commands: config vpn ipsec phase1-interface     edit <tunnel-name>         set dpd disable end