Cradlepoint COR IBR350 Manual page 73

Perfect Forward Secrecy (PFS): Enabling this feature will require IKE to generate a new set of keys in Phase 2 rather than using the same key
generated in Phase 1. Additionally, with this option enabled the new keys generated in Phase 2 are exchanged in an encrypted session. Enabling this
feature affords the policy greater security.
Key Lifetime: The lifetime of the generated keys of Phase 2 of the IPsec negotiation from IKE. After the time has expired, IKE will renegotiate a new set
of Phase 2 keys.
Phase 2 has the same selection of Encryption, Hash, and DH Groups as Phase 1, but you are restricted to only one DH Group. Phase 2 and Phase 1
selections do not have to match.
Add/Edit Tunnel – Dead Peer Detection
Dead Peer Detection (DPD) defines how the router will detect when one end of the IPsec session loses connection while a policy is in use.
Connection Idle Time: Configure how long the router will allow an IPsec session to be idle before beginning to send Dead Peer Detection (DPD)
packets to the peer machine. (Default: 30 seconds. Range: 10 – 3600 seconds.)
Request Frequency allows you to adjust the delay between these DPD packets. (Default: 15 seconds. Range: 2 – 30 seconds.)
Maximum Requests: Specify how many requests to send at the selected time interval before the tunnel is considered dead. (Default: 5. Range: 2 –
10.)
Failback Retry Period: If you have VPN tunnel failover/failback enabled (see below), set the time period between each check on the primary network
after failover. (Default: 10 seconds. Range: 5 – 60 seconds.)
Failover Tunnel and Failback Tunnel: Use these settings to create two tunnels – one as the primary tunnel and one as the backup tunnel. To
configure tunnel failover/failback, complete the following steps:
1. Create two tunnels: one for primary and one for backup. Make sure that both tunnels have the same Remote Network and that both have Dead
Peer Detection enabled.
2. Choose one to be the primary tunnel. Open the editor for this tunnel and make sure Tunnel Enabled is selected. Then go to the Dead Peer
Detection page. Under Failover Tunnel select the other tunnel you have created.
3. Open the editor for the failover tunnel. Make sure Tunnel Enabled is not selected. On the Dead Peer Detection page, set the Failback Tunnel
to your primary tunnel.