Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

XML Reference Guide

DPD example

This section provides an example of a non-default IPsec VPN configuration. You can use this configuration if FortiClient fails to connect to IPSec VPN, and you see the following symptom:

  • When you view the FortiGate IKE debug log, you see that FortiOS sends R_U_THERE to FortiClient, but there is no reply, and it times out.

In this case, you can increase the FortiGate DPD wait time and/or enable FortiClient IPSec multi-thread mode. However, it is recommended not to enable FortiClient IPSec multi-thread mode if it is not necessary. You must make changes to the FortiGate configuration and the FortiClient configuration.

To configure FortiGate:
  1. Increase the FortiGate DPD wait time by using the following FortiOS CLI:

    config vpn ipsec phase1-interface

    edit <your IPSec VPN>

    set dpd-retrycount <give it a bigger number>

    set dpd-retryinterval <give it a bigger number>

To configure FortiClient:
  1. Enable multi-thread mode on FortiClient by using XML:

    <ipsecvpn>

    <connections>

    <connection>

    <name>your IPSec VPN</name>

    <ike_settings>

    <xauth>

    <use_otp>1</use_otp>

DPD example

This section provides an example of a non-default IPsec VPN configuration. You can use this configuration if FortiClient fails to connect to IPSec VPN, and you see the following symptom:

  • When you view the FortiGate IKE debug log, you see that FortiOS sends R_U_THERE to FortiClient, but there is no reply, and it times out.

In this case, you can increase the FortiGate DPD wait time and/or enable FortiClient IPSec multi-thread mode. However, it is recommended not to enable FortiClient IPSec multi-thread mode if it is not necessary. You must make changes to the FortiGate configuration and the FortiClient configuration.

To configure FortiGate:
  1. Increase the FortiGate DPD wait time by using the following FortiOS CLI:

    config vpn ipsec phase1-interface

    edit <your IPSec VPN>

    set dpd-retrycount <give it a bigger number>

    set dpd-retryinterval <give it a bigger number>

To configure FortiClient:
  1. Enable multi-thread mode on FortiClient by using XML:

    <ipsecvpn>

    <connections>

    <connection>

    <name>your IPSec VPN</name>

    <ike_settings>

    <xauth>

    <use_otp>1</use_otp>