Netopia 3346N-ENT User Guide (en)

Download
Internet Key Exchange (IKE) IPsec Key Management for VPNs   6-15
Netopia Firmware Version 8.6.1 provides a new Dead Peer Detection mechanism. An IPsec IP net inter face 
sends ICMP ping requests to a specific IP address on a Remote Member network. The ping is periodic, and 
the reply is expected within a cer tain amount of time. If the ICMP reply does not arrive within that time, the 
peer is considered dead, the current phase 2 SAs are torn down, and the IKE SA star ts a new phase 1 
negotiation, followed by the normal phase 2 negotiation, thereafter.
When you toggle Dead Peer Detection to Yes (on), new options appear.
Ping host allows you to specify the host IP address of the host to ping, and from which replies will be 
expected.
This field is only available if you have previously configured, and committed, remote network IP data in the 
Add Network Configuration screen under Advanced IP Profile Options. See 
Ping retry interval and Ping reply timeout options appear.
The defaults are 5 seconds and 90 seconds, respectively. You may adjust these to suit your network’s 
tolerances.
Note:
• ICMP Dead Peer Detection is not available when using manual re-keying.
• ICMP Dead Peer Detection does not initiate a series of phase 2 exchanges upon detecting a dead peer; it 
instead initiates a new phase 1 negotiation, followed by a new phase 2 negotiation once contact with the peer 
has been re-established.
• If you are using Multiple Network IPsec, the IP address of the ICMP Dead Peer Detection mechanism must be 
constrained to the set of network ranges defined for the IPsec profile.
Press Escape to return to the Add or Change Connection Profile screen, and select IP Profile Parameters.
If you enable IKE key management the IP Profile Parameters screen appears.
                             Advanced IPsec Options
         SA Lifetime seconds:               28800
         SA Lifetime Kbytes:                0
         Perfect Forward Secrecy:           Yes
         Dead Peer Detection:               Yes
         Ping host:                         1.1.1.1
         Ping retry interval:               5
         Ping reply timeout:                90