Cli Configuration; Ipsec Phase1 - Fortinet FortiGate FortiGate-60M Administration Manual

VPN

CLI configuration

ipsec phase1

FortiGate-60M Administration Guide
This section provides information about features that must be configured through CLI
commands. CLI commands provide additional network options that cannot be
configured through the web-based manager. For complete descriptions and examples
of how to use CLI commands, see the FortiGate CLI Reference Guide.
In the web-based manager, the Dead Peer Detection option can be enabled when you
define advanced Phase 1 options. The config vpn ipsec phase1 CLI command
supports additional options for specifying a long and short idle time, a retry count, and
a retry interval.
Command syntax pattern
config vpn ipsec phase1
edit <name_str>
set <keyword> <variable>
end
config vpn ipsec phase1
edit <name_str>
unset <keyword>
end
ipsec phase1 command keywords and variables
Keywords and
variables
dpd-idlecleanup
<seconds_integer>
dpd-idleworry
<seconds_integer>
01-28007-0144-20041217
Description
The DPD long idle setting when dpd is set
to enable. Set the time, in seconds, that a
link must remain unused before the local
VPN peer pro-actively probes its state. After
this period of time expires, the local peer
will send a DPD probe to determine the
status of the link even if there is no traffic
between the local peer and the remote
peer. The dpd-idlecleanup range is 100
to 28 800 and must be greater than the
dpd-idleworry setting.
The DPD short idle setting when dpd is set
to enable. Set the time, in seconds, that a
link must remain unused before the local
VPN peer considers it to be idle. After this
period of time expires, whenever the local
peer sends traffic to the remote VPN peer it
will also send a DPD probe to determine
the status of the link. The dpd-idleworry
range is 1 to 300.
To control the length of time that the
FortiGate unit takes to detect a dead peer
with DPD probes, use the dpdretrycount
and dpd-retryinterval keywords.
CLI configuration
Default Availability
300 All models.
seconds
dpd must
be set to
enable.
10 All models.
seconds
dpd must
be set to
enable.
271