How Dead Peer Detection Works???

[bwolters]

I have been up and down the site trying to figure out how the inner workings of DPD works. What I am trying to get at is when DPD can' t ping the host its directed to does it basically create a " phantom" static route that changes the distance or priority to 1999 or how does it accomplish telling itself that the Interface is down? Please let me know if I am making any sense and any light shed on the issue would be very much appreciated. Thanks

[romanr]

DPD will only tell you if there is a remote IKE responding and nothing further! There is no direct relationship between dpd and routing! What do you exactly want to accomplish? Br, Roman

[ede_pfau]

Unfortunately, there are 2 DPD constructs in FortiOS: - Dead Gateway Detection in Network>Interface - DPD in IPsec VPN The first monitors connectivity across an interface. If enough pings have been lost it deletes the route(s) using this interface from the Forwarding Table (which is populated by scanning the Routing Table). The second monitors the state of an IPsec tunnel. If a tunnel down event is detected the SAs associated with the tunnel are destroyed. This helps in getting the tunnel up quickly: assume the old SA is still regarded as valid when the remote side tries to re-establish a tunnel after it broke off. An SA mismatch would happen and prevent the tunnel from coming up. HTH.

[bwolters]

When our clients primary ISP goes down(remote location), we are attempting to route the internet traffic back down the internal interface and back to HQ and out the MPLS DIA. We have the learned BGP route but our snag right now is how to make this happen automatically so the satellite office barely knows its ISP is not online. Thinking that dead peer detection may help us accomplish this. I posted in the VPN board because i figured you guys knew the most about DPD I apoligize if I should have posted somewhere else.

[ede_pfau]

BTW, many forum members read across all boards, so posting in a wrong forum a) won' t help but b) won' t matter neither. Yes, DGD (dead gateway detection) will most likely speed up your routing in case of link failures. The FGT can only detect hardware link failures by itself (and it will) but a link loss may occur at the next hop while the link still is up and running. Ping server monitoring was made for this.

[bwolters]

Thank you for your help, clarified a few things not very well documented in the cookbook or easy to find on KB. Thanks Again.

[rwpatterson]

Also if you feel up to it, use a routing protocol like OSPF and when one link goes down, ECM routing will seamlessly move all traffic to the working link (faster, if I may add) behind the scenes as well.