R211x-HP Flexfabric 11900 Security Command Reference

230
undo ike dpd interval
Default
IKE DPD is disabled.
Views
System view
Predefined user roles
network-admin
mdc-admin
Parameters
interval interval-seconds: Specifies a period of time in seconds. The value range is from 1 to 300.
• If the on-demand keyword is specified, this parameter specifies the number of seconds during
which no IPsec packet is received before DPD is triggered if the local end has IPsec traffic to send.
• If the periodic keyword is specified, this parameter specifies a DPD triggering interval.
retry seconds: Specifies the number of seconds between DPD retries if the DPD message fails. The value
for the second argument is from 1 to 60 seconds, and it defaults to 5 seconds.
on-demand: Sends DPD messages on demand.
periodic: Sends DPD messages at regular intervals.
Usage guidelines
DPD is triggered periodically or on-demand. The on-demand mode is recommended when the device
communicates with a large number of IKE peers. For an earlier detection of dead peers, use the
periodical triggering mode, which consumes more bandwidth and CPU.
When DPD settings are configured in both IKE profile view and system view, the DPD settings in IKE
profile view apply. If DPD is not configured in IKE profile view, the DPD settings in system view apply.
It is a good practice to set the triggering interval longer than the retry interval so that a DPD detection
does not occur during a DPD retry.
Examples
# Configure DPD to be triggered every 10 seconds and every 5 seconds between retries if the peer does
not respond.
<Sysname> system-view
[Sysname] ike dpd interval 10 retry 5 on-demand
Related commands
dpd
ike identity
Use ike identity to specify the global identity used by the local end during IKE negotiations.
Use undo ike identity to remove the configuration and restore the default.
Syntax
ike identity { address { ipv4-address | ipv6 ipv6-address } | dn | fqdn [ fqdn-name ] | user-fqdn
[ user-fqdn-name ] }