Dead Peer Detection (DPD) is a method that allows detection of unreachable Internet Key Exchange (IKE) peers. Follow below post to understand dead peer detection in detail.
What is dead peer detection (DPD)?
Configure Dead peer detection in Cisco ASA firewall.
Cisco routers support two DPD types: On-demand DPD and Periodic DPD:
crypro isakmp keepalive <threshold> <retry-interval> {[on-demand] | periodic}
In case of on-demand DPD a router sends its R-U-THERE message to a peer if there is a traffic to send to the peer and the peer was idle for <threshold> seconds (i.e. there was no traffic from the peer for <threshold> seconds). On-demand DPD was introduced in IOS 12.2(8)T and the implementation has changed multiple times since then.
In case of periodic DPD a router sends its R-U-THERE messages at regular intervals. It doesn’t take into consideration traffic coming from peer. This is the only Cisco platform that supports true periodic DPD. Periodic DPD was introduced in IOS 12.3(7)T and the implementation has changed multiple times since then.
Specifically, in the DDTS CSCin76641 (IOS 12.3(09.08)T) a decision was made to not send R-U-THERE request when the periodic DPD is configured and a traffic is received from the peer. Finally, it has reverted to the original behavior. See DDTS CSCsh12853 (12.4(13.11)T 12.4(11)T02 12.4(09)T05 12.4(06)T08) for details.
Periodic DPD can improve convergence in some scenarios.
DPD is disabled by default on Cisco routers. The default mode is “on-demand” if not specified.
If the peer doesn’t respond with the R-U-THERE-ACK the router starts retransmitting R-U-THERE messages every <retry-interval> seconds with a maximum of five retransmissions. After that the peer is declared dead.
You cannot specify the number of retries on Cisco routers.
Also, it is possible to configure DPD in ISAKMP profiles. The caveat, however, is that there are no “periodic” and “on-demand” configuration options. So, the ISAKMP profile will inherit global setting. I.e., if you enable periodic DPD globally, all your ISAKMP profiles will operate in “periodic” DPD mode with profile-specific DPD timers.
crypto isakmp profile QQQ keepalive <interval> retry <retry-interval>
Another caveat is that you cannot disable DPD completely. DPD is always negotiated, even if not configured or disabled in ISAKMP profile with “no keepalive”. In this case the router will answer DPD requests with R-U-THERE-ACK, but will not initiate DPD requests with R-U-THERE (“one-way” mode).
In brief, on routers we have the following:
- true periodic DPD and on-demand DPD
- DPD cannot be completely disabled
- one-way mode is supported and is the default mode
- retry interval can be configured
- retry count cannot be configured and equals to five