Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
All Products
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Web Application Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • Web Application / API Protection
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions
    • All Products

    XML Reference Guide

    Home FortiClient 7.4.5 XML Reference Guide
    7.4.5
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.13
    7.2.12
    7.2.11
    7.2.10
    7.2.9
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.14
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.5
    6.2.4
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.0.10
    6.0.9
    6.0.8
    6.0.7
    6.0.6
    6.0.5
    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0

    DPD example

    DPD example

    In unstable or unreliable network access conditions with high packet loss and jitter, look for the following signs for high DPD sensitivity:

    • FortiClient fails to connect to IPsec VPN.
    • When you view the FortiGate IKE debug log, you see that FortiOS sends R_U_THERE to FortiClient, but there is no reply, and it times out.

    • You see keywords similar to the following in the log:

      [2025-10-29 16:17:02.3689080 UTC-07:00] [13412:856] [iked  2364    info] ikev2 create server success
...
[2025-10-29 16:17:02.3939415 UTC-07:00] [13412:856] [iked  1155   debug] config_getstatic: dpd_enabled 1
[2025-10-29 16:17:02.3939430 UTC-07:00] [13412:856] [iked  1157   debug] config_getstatic: dpd_check_interval 5
[2025-10-29 16:17:02.3939449 UTC-07:00] [13412:856] [iked  1158   debug] config_getstatic: dpd_retry_count 10
...
 
[2025-10-29 16:17:40.1481546 UTC-07:00] [13412:856] [iked  446    info] Informational(1) spi=0xc83fcd30b5ed3339:  send INFORMATIONAL req 9 peer 192.168.100.1:4500 local 192.168.100.111:50412, 80 bytes , NAT-T
[2025-10-29 16:17:40.1481628 UTC-07:00] [13412:856] [iked  504   debug] sendtofrom: send from 192.168.100.111 to 192.168.100.1
[2025-10-29 16:17:40.1488877 UTC-07:00] [13412:856] [iked  1466    info] ikev2_msg_dispose: dequeue retransmit msg, msg_id: 9
[2025-10-29 16:17:40.1488999 UTC-07:00] [13412:856] [iked  1237   debug] ikev2_negotiation_recv: updated SA to peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:17:40.1489020 UTC-07:00] [13412:856] [iked  2358    info] ikev2_init_recv: Receive message with id: 9
[2025-10-29 16:17:40.1489042 UTC-07:00] [13412:856] [iked  2391    info] <== INFORMATIONAL reply
 
[2025-10-29 16:17:50.1398645 UTC-07:00] [13412:856] [iked  446    info] Informational(1) spi=0xc83fcd30b5ed3339:  send INFORMATIONAL req 10 peer 192.168.100.1:4500 local 192.168.100.111:50412, 80 bytes , NAT-T
[2025-10-29 16:17:50.1398746 UTC-07:00] [13412:856] [iked  504   debug] sendtofrom: send from 192.168.100.111 to 192.168.100.1
[2025-10-29 16:17:50.1407480 UTC-07:00] [13412:856] [iked  1466    info] ikev2_msg_dispose: dequeue retransmit msg, msg_id: 10
[2025-10-29 16:17:50.1407641 UTC-07:00] [13412:856] [iked  1237   debug] ikev2_negotiation_recv: updated SA to peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:17:50.1407671 UTC-07:00] [13412:856] [iked  2358    info] ikev2_init_recv: Receive message with id: 10
[2025-10-29 16:17:50.1407700 UTC-07:00] [13412:856] [iked  2391    info] <== INFORMATIONAL reply
 
[2025-10-29 16:18:00.1448143 UTC-07:00] [13412:856] [iked  446    info] Informational(1) spi=0xc83fcd30b5ed3339:  send INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412, 80 bytes , NAT-T
[2025-10-29 16:18:00.1448246 UTC-07:00] [13412:856] [iked  504   debug] sendtofrom: send from 192.168.100.111 to 192.168.100.1
 
[2025-10-29 16:18:00.1449108 UTC-07:00] [13412:856] [iked  520    info] ikev2_msg_send: enqueue request, msg_id: 11
 
[2025-10-29 16:18:02.1503937 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 1 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:07.1518140 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 2 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:12.1418452 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 3 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:17.1487448 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 4 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:22.1560107 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 5 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:27.1754173 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 6 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:32.1770519 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 7 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:37.1788013 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 8 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:42.2001021 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 9 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:47.2002767 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 10 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
 
[2025-10-29 16:18:52.1920136 UTC-07:00] [13412:856] [iked  1659   debug] ikev2_msg_retransmit_timeout: retransmit limit reached for req 11
[2025-10-29 16:18:52.1921247 UTC-07:00] [13412:856] [iked  646    info] spi=0xc83fcd30b5ed3339: sa_free: retransmit limit reached
[2025-10-29 16:18:52.1921420 UTC-07:00] [13412:856] [iked  194   debug] SA deleted: SPI 0x261d20fa
[2025-10-29 16:18:52.1921652 UTC-07:00] [13412:856] [iked  1466    info] ikev2_msg_dispose: dequeue retransmit msg, msg_id: 11
 
[2025-10-29 16:18:52.7939176 UTC-07:00] [13412:856] [iked  605   debug] config_doreset: flushing policies
[2025-10-29 16:18:52.7939327 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC7768FE70
[2025-10-29 16:18:52.7939371 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC7768FEC0
[2025-10-29 16:18:52.7939392 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC77690EB0
[2025-10-29 16:18:52.7939508 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC77690FA0
[2025-10-29 16:18:52.7939535 UTC-07:00] [13412:856] [iked  327   debug] config_free_flows: free 0x000001FC77F41930
[2025-10-29 16:18:52.7939572 UTC-07:00] [13412:856] [iked  612   debug] config_doreset: flushing SAs
[2025-10-29 16:18:52.7939588 UTC-07:00] [13412:856] [iked  665   debug] config_doreset: flushing users
[2025-10-29 16:18:52.8026337 UTC-07:00] [13412:856] [iked  712    info] ikev2 exiting, pid 13412
[2025-10-29 16:18:52.8026476 UTC-07:00] [13412:856] [iked  1418    info] trace stopped

    You can reduce the DPD sensitivity by increasing the values for counter and interval on both FortiClient and FortiGate. These values are not negotiated and are independent of each other.

    FortiGate Use the following FortiOS CLI commands:

    config vpn ipsec phase1-interface

    edit <your IPsec VPN>

    set dpd-retrycount <configure a higher number>

    set dpd-retryinterval <configure a higher number>

    next

    end
    FortiClient

    Using the following XML configuration:

    <ipsecvpn>

    <connections>

    <connection>

    <ike_settings>

    <dpd>1</dpd>

    <dpd_retry_count>configure a higher number</dpd_retry_count>

    <dpd_retry_interval>configure a higher number</dpd_retry_interval>
    Previous
    Next

    DPD example

    DPD example

    In unstable or unreliable network access conditions with high packet loss and jitter, look for the following signs for high DPD sensitivity:

    • FortiClient fails to connect to IPsec VPN.
    • When you view the FortiGate IKE debug log, you see that FortiOS sends R_U_THERE to FortiClient, but there is no reply, and it times out.

    • You see keywords similar to the following in the log:

      [2025-10-29 16:17:02.3689080 UTC-07:00] [13412:856] [iked  2364    info] ikev2 create server success
...
[2025-10-29 16:17:02.3939415 UTC-07:00] [13412:856] [iked  1155   debug] config_getstatic: dpd_enabled 1
[2025-10-29 16:17:02.3939430 UTC-07:00] [13412:856] [iked  1157   debug] config_getstatic: dpd_check_interval 5
[2025-10-29 16:17:02.3939449 UTC-07:00] [13412:856] [iked  1158   debug] config_getstatic: dpd_retry_count 10
...
 
[2025-10-29 16:17:40.1481546 UTC-07:00] [13412:856] [iked  446    info] Informational(1) spi=0xc83fcd30b5ed3339:  send INFORMATIONAL req 9 peer 192.168.100.1:4500 local 192.168.100.111:50412, 80 bytes , NAT-T
[2025-10-29 16:17:40.1481628 UTC-07:00] [13412:856] [iked  504   debug] sendtofrom: send from 192.168.100.111 to 192.168.100.1
[2025-10-29 16:17:40.1488877 UTC-07:00] [13412:856] [iked  1466    info] ikev2_msg_dispose: dequeue retransmit msg, msg_id: 9
[2025-10-29 16:17:40.1488999 UTC-07:00] [13412:856] [iked  1237   debug] ikev2_negotiation_recv: updated SA to peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:17:40.1489020 UTC-07:00] [13412:856] [iked  2358    info] ikev2_init_recv: Receive message with id: 9
[2025-10-29 16:17:40.1489042 UTC-07:00] [13412:856] [iked  2391    info] <== INFORMATIONAL reply
 
[2025-10-29 16:17:50.1398645 UTC-07:00] [13412:856] [iked  446    info] Informational(1) spi=0xc83fcd30b5ed3339:  send INFORMATIONAL req 10 peer 192.168.100.1:4500 local 192.168.100.111:50412, 80 bytes , NAT-T
[2025-10-29 16:17:50.1398746 UTC-07:00] [13412:856] [iked  504   debug] sendtofrom: send from 192.168.100.111 to 192.168.100.1
[2025-10-29 16:17:50.1407480 UTC-07:00] [13412:856] [iked  1466    info] ikev2_msg_dispose: dequeue retransmit msg, msg_id: 10
[2025-10-29 16:17:50.1407641 UTC-07:00] [13412:856] [iked  1237   debug] ikev2_negotiation_recv: updated SA to peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:17:50.1407671 UTC-07:00] [13412:856] [iked  2358    info] ikev2_init_recv: Receive message with id: 10
[2025-10-29 16:17:50.1407700 UTC-07:00] [13412:856] [iked  2391    info] <== INFORMATIONAL reply
 
[2025-10-29 16:18:00.1448143 UTC-07:00] [13412:856] [iked  446    info] Informational(1) spi=0xc83fcd30b5ed3339:  send INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412, 80 bytes , NAT-T
[2025-10-29 16:18:00.1448246 UTC-07:00] [13412:856] [iked  504   debug] sendtofrom: send from 192.168.100.111 to 192.168.100.1
 
[2025-10-29 16:18:00.1449108 UTC-07:00] [13412:856] [iked  520    info] ikev2_msg_send: enqueue request, msg_id: 11
 
[2025-10-29 16:18:02.1503937 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 1 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:07.1518140 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 2 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:12.1418452 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 3 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:17.1487448 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 4 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:22.1560107 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 5 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:27.1754173 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 6 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:32.1770519 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 7 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:37.1788013 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 8 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:42.2001021 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 9 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
[2025-10-29 16:18:47.2002767 UTC-07:00] [13412:856] [iked  1633    info] spi=0xc83fcd30b5ed3339:  retransmit 10 INFORMATIONAL req 11 peer 192.168.100.1:4500 local 192.168.100.111:50412
 
[2025-10-29 16:18:52.1920136 UTC-07:00] [13412:856] [iked  1659   debug] ikev2_msg_retransmit_timeout: retransmit limit reached for req 11
[2025-10-29 16:18:52.1921247 UTC-07:00] [13412:856] [iked  646    info] spi=0xc83fcd30b5ed3339: sa_free: retransmit limit reached
[2025-10-29 16:18:52.1921420 UTC-07:00] [13412:856] [iked  194   debug] SA deleted: SPI 0x261d20fa
[2025-10-29 16:18:52.1921652 UTC-07:00] [13412:856] [iked  1466    info] ikev2_msg_dispose: dequeue retransmit msg, msg_id: 11
 
[2025-10-29 16:18:52.7939176 UTC-07:00] [13412:856] [iked  605   debug] config_doreset: flushing policies
[2025-10-29 16:18:52.7939327 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC7768FE70
[2025-10-29 16:18:52.7939371 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC7768FEC0
[2025-10-29 16:18:52.7939392 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC77690EB0
[2025-10-29 16:18:52.7939508 UTC-07:00] [13412:856] [iked  315   debug] config_free_proposals: free 0x000001FC77690FA0
[2025-10-29 16:18:52.7939535 UTC-07:00] [13412:856] [iked  327   debug] config_free_flows: free 0x000001FC77F41930
[2025-10-29 16:18:52.7939572 UTC-07:00] [13412:856] [iked  612   debug] config_doreset: flushing SAs
[2025-10-29 16:18:52.7939588 UTC-07:00] [13412:856] [iked  665   debug] config_doreset: flushing users
[2025-10-29 16:18:52.8026337 UTC-07:00] [13412:856] [iked  712    info] ikev2 exiting, pid 13412
[2025-10-29 16:18:52.8026476 UTC-07:00] [13412:856] [iked  1418    info] trace stopped

    You can reduce the DPD sensitivity by increasing the values for counter and interval on both FortiClient and FortiGate. These values are not negotiated and are independent of each other.

    FortiGate Use the following FortiOS CLI commands:

    config vpn ipsec phase1-interface

    edit <your IPsec VPN>

    set dpd-retrycount <configure a higher number>

    set dpd-retryinterval <configure a higher number>

    next

    end
    FortiClient

    Using the following XML configuration:

    <ipsecvpn>

    <connections>

    <connection>

    <ike_settings>

    <dpd>1</dpd>

    <dpd_retry_count>configure a higher number</dpd_retry_count>

    <dpd_retry_interval>configure a higher number</dpd_retry_interval>
    Previous
    Next