Check Point DPD (Dead Peer Detection) - Questions

[Marcel_Gramalla]

Hi all,

I have two questions regarding the Dead Peer Detection between our Check Point Cluster and other existing VPN connections to non-Check Point Gateways.

1. Does enabling DPD (Responder Mode) has any impact on existing VPN connections? Can I enable it "on-the-fly" without having any disconnects to the VPN? I haven't found an answer on that yet.

2. If I change a VPN community with non-Check Point Gateways to "Permanent Tunnels" in order to active DPD with GuiDBedit does this have any impact on existing connections?

Thanks in advance for any help

[Jerry]

quickly though:

Ad.1 - it will re-estab SA/SPI indeed
Ad.2. - it will re-estab the tunnel

ps. any changes to the proxy-id or any crypt.conf params will re-key and re-estab SA/SPI

[Marcel_Gramalla]

Thanks for the quick reply. That means that we have to announce it so that if there is any issue our partners know about it.

[Jerry]

it will in 100% impact/affect an existing tunnel(s) so yes, that should be announced and planed for so called "maintenance window" 🙂

cheers

[Ravindra_Katrag]

Is there any way to check if DPD is enabled?

[Nick_Doropoulos · Accepted solution]

Yes, there is. You can check with the GuiDBedit tool under Network Objects >> network_objects:

I hope this helps.

[Ravindra_Katrag]

Thank you

[Nick_Doropoulos]

My pleasure!

[nagaraja_cs]

Can we achieve VPN redundancy with 3rd party Gateways by enabling DPD(In R80.10 or R80.20) ?