DPD example
This section provides an example of a non-default IPsec VPN configuration. You can use this configuration if FortiClient fails to connect to IPSec VPN, and you see the following symptom:
- When you view the FortiGate IKE debug log, you see that FortiOS sends
R_U_THEREto FortiClient, but there is no reply, and it times out.
In this case, you can increase the FortiGate DPD wait time and/or enable FortiClient IPSec multi-thread mode. However, it is recommended not to enable FortiClient IPSec multi-thread mode if it is not necessary. You must make changes to the FortiGate configuration and the FortiClient configuration.
To configure FortiGate:
-
Increase the FortiGate DPD wait time by using the following FortiOS CLI:
config vpn ipsec phase1-interface
edit <your IPSec VPN>
set dpd-retrycount <give it a bigger number>
set dpd-retryinterval <give it a bigger number>
To configure FortiClient:
- Enable multi-thread mode on FortiClient by using XML:
<ipsecvpn>
<connections>
<connection>
<name>your IPSec VPN</name>
<ike_settings>
<xauth>
<use_otp>1</use_otp>