Setting The Nat Keepalive Timer; Configuring A Dpd Detector; Disabling Next Payload Field Check - HP A6600 Configuration Manual

Setting the NAT keepalive timer

If IPsec traffic must pass through NAT security gateways, you must configure the NAT traversal function.
If no packet travels across an IPsec tunnel in a certain period of time, the NAT mapping may get aged
and be deleted, disabling the tunnel beyond the NAT gateway from transmitting data to the intended
end. To prevent NAT mappings from being aged, an ISAKMP SA behind the NAT security gateway
sends NAT keepalive packets to its peer at a certain interval to keep the NAT session alive.
To set the NAT keepalive timer:
To do...
1. Enter system view.
2. Set the NAT keepalive
interval.

Configuring a DPD detector

DPD irregularly detects dead IKE peers. It works as follows:
When the local end sends an IPsec packet, it checks the time the last IPsec packet was received
1.
from the peer.
If the time interval exceeds the DPD interval, it sends a DPD hello to the peer.
2.
If the local end receives no DPD acknowledgement within the DPD packet retransmission interval, it
3.
retransmits the DPD hello.
If the local end still receives no DPD acknowledgement after having made the maximum number of
4.
retransmission attempts (two by default), it considers the peer already dead, and it clears the IKE
SA and the IPsec SAs based on the IKE SA.
DPD enables an IKE entity to check the liveliness of its peer only when necessary. It generates less traffic
than the keepalive mechanism, which exchanges messages periodically.
To configure a DPD detector:
To do...
1. Enter system view.
2. Create a DPD detector and
enter its view.
Set the DPD interval.
3.
Set the DPD packet
4.
retransmission interval.

Disabling next payload field check

The next payload field is in the generic payload header of the last payload of the IKE negotiation
message (the message comprises multiple payloads). According to the protocol, this field must be 0 if the
payload is the last payload of the packet. However, it may be set to other values on some brands of
devices. For interoperability, disable the checking of this field.
Command...
system-view
ike sa nat-keepalive-timer interval
seconds
Command...
system-view
ike dpd dpd-name
interval-time interval-time
time-out time-out
293
Remarks
—
Required
20 seconds by default
Remarks
—
Required
Optional
10 seconds by default
Optional
5 seconds by default