IKE Keepalive and DPD

[yongl]

Hello,

r1#show crypto isakmp sa detail

Codes: C - IKE configuration mode, D - Dead Peer Detection

K - Keepalives, N - NAT-traversal

X - IKE Extended Authentication

psk - Preshared key, rsig - RSA signature

renc - RSA encryption

Question:

1. What are the differences between Keepalives(Code K) and Dead Peer Detection(Code D) as shown above ?

2. How to enable these features ?

[mhussein]

This feature was introduces as of IOS 12.3(7)T

crypto isakmp keepalive seconds periodic

With the "periodic" key word, DPD keepalives are sent every x seconds.

I believe keepalives (code K) are more of a "heartbeat" unidirectional messages, while DPD is a negotiated protocol that provides for an earlier detection of dead peers.

I hope someone from Cisco comments on this.

References:

1. IPSec Dead Peer Detection Periodic

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123newft/123t/123t_7/gtdpmo.htm

2. RFC 3706 Detecting Dead IKE Peers

ftp://ftp.rfc-editor.org/in-notes/rfc3706.txt

Regards,

Mustafa