topic Re: What value does DPD have on timeout? in Firewall and Security Management

What value does DPD have on timeout?

raquinog — Tue, 25 Aug 2020 23:30:07 GMT

I have a S2S VPN with AWS, where I did the setting of the DPD value as indicated by their AWS best practices. (by default in R80.xx version it is enabled)

The AWS administrator indicates that it has configured the value "DPD Timeout (seconds) with value 30".

The AWS administrator ask me that on the Checkpoint side, which value has the same parameter "DPD Timeout" configured. However, I have already been looking for this value and I cannot find where the value is specified.

Does anyone know what DPD Timeout value does the Checkpoint use?

additional disconnections continue to occur in the VPN with AWS.
If from my side I generate traffic the VPN the tunnel is UP, however, if AWS tries to generate traffic it is not able to establish the VPN tunnel again.

Re: What value does DPD have on timeout?

PhoneBoy — Fri, 28 Aug 2020 00:36:12 GMT

I'll be honest, I've never seen a timeout setting related to DPD.
Did you happen to configure a "permanent tunnel" which may be what you want here?
See Scenario 5 here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108600

Re: What value does DPD have on timeout?

_Val_ — Fri, 28 Aug 2020 07:25:39 GMT

AWS cannot initiate the tunnel, it has to be always open from CP side. Look into sk108600, specifically Scenario 5, for resolution steps. Timeout value does not matter, you just need to configure keep-alive properly, as the case specifies.

Re: What value does DPD have on timeout?

Timothy_Hall — Fri, 28 Aug 2020 13:03:50 GMT

I think DPD reuses the "life sign" timers located here in the SmartConsole: