DPD is a monitoring function used to determine liveliness of the Security-SA (Security Association and IKE, Phase 1)

DPD is used to detect if the peer device still has a valid IKE-SA. Periodically, it will send a “ISAKMP R-U-THERE” packet to the peer, which will respond back with an “ISAKMP R-U-THERE-ACK” acknowledgement.

The Palo Alto Networks does not currently have a log associated with DPD packets, but can be detected in a debug packet capture. The following is a PCAP from a peer device:

The DPD query and delay interval can be configured when DPD is enabled on the Palo Alto Networks device. DPD will tear down the SA once it realizes the peer is no longer responding

Note: The DPD is “not persistent” and is only triggered by a Phase 2 rekey. This means if Phase 2 is up, Palo Alto Networks will not check to see if IKE-SA is active. To get Phase 2 to trigger a rekey, and trigger the DPD to validate the Phase 1 IKE-SA, enable tunnel monitoring.

Tunnel Monitoring

Tunnel Monitoring is used to verify connectivity across an IPSec tunnel. If a tunnel monitor profile is created it will specify one of two action options if the tunnel is not available: Wait Recover or Fail Over.

• Wait Recover tells the firewall to wait for the tunnel to recover and not take additional action
• Fail Over will force traffic to a back-up path if one is available

In both cases, the firewall will try to negotiate new IPSec keys to accelerate the recovery.

A threshold option can be set to specify the number of heartbeats to wait before taking the specified action. The range is between 2 and 100 and the default is 5. The interval between heartbeats can also be configured. The range is between 2 and 10 and the default is 3.

Once the tunnel monitoring profile is created, as shown below, select it and enter the IP address of the remote end to be monitored.