fortigate-ipsec-40-mr3

Auto Key phase 1 parameters Defining IKE negotiation parameters
NAT cannot be performed on IPsec packets in ESP tunnel mode because the packets do
not contain a port number. As a result, the packets cannot be demultiplexed. To work
around this, the FortiGate unit provides a way to protect IPsec packet headers from NAT
modifications. When the Nat-traversal option is enabled, outbound encrypted packets
are wrapped inside a UDP IP header that contains a port number. This extra
encapsulation allows NAT devices to change the port number without modifying the
IPsec packet directly.
To provide the extra layer of encapsulation on IPsec packets, the Nat-traversal option
must be enabled whenever a NAT device exists between two FortiGate VPN peers or a
FortiGate unit and a dialup client such as FortiClient. On the receiving end, the FortiGate
unit or FortiClient removes the extra layer of encapsulation before decrypting the packet.
NAT keepalive frequency
When a NAT device performs network address translation on a flow of packets, the NAT
device determines how long the new address will remain valid if the flow of traffic stops
(for example, the connected VPN peer may be idle). The device may reclaim and reuse a
NAT address when a connection remains idle for too long.
To work around this, when you enable NAT traversal specify how often the FortiGate unit
sends periodic keepalive packets through the NAT device in order to ensure that the NAT
address mapping does not change during the lifetime of a session. To be effetive, the
keepalive interval msut be smaller than the session lifetime value used by the NAT device.
The keepalive packet is a 138-byte ISAKMP exchange.
Dead peer detection
Sometimes, due to routing issues or other difficulties, the communication link between a
FortiGate unit and a VPN peer or client may go down—packets could be lost if the
connection is left to time out on its own. The FortiGate unit provides a mechanism called
Dead Peer Detection (DPD), sometimes referred to as gateway detection or ping server,
to prevent this situation and reestablish IKE negotiations automatically before a
connection times out: the active phase 1 security associations are caught and
renegotiated (rekeyed) before the phase 1 encryption key expires.
By default, DPD sends probe messages every five seconds by default (see dpdretryinterval
in the FortiGate CLI Reference). If you are experiencing high network
traffic, you can experiment with increasing the ping interval. However longer intervals will
require more traffic to detect dead peers which will result in more traffic.
In the web-based manager, the Dead Peer Detection option can be enabled when you
define advanced phase 1 options. The config vpn ipsec phase1 CLI command
supports additional options for specifying a retry count and a retry interval.
For more information about these commands and the related config router
gwdetect CLI command, see the FortiGate CLI Reference.
For example, enter the following CLI commands to configure dead peer detection on the
existing IPsec Phase1 configuration called test to use 15 second intervals and to wait
for 3 missed attempts before declaring the peer dead and taking action.
config vpn ipsec phase1
edit test
set dpd enable
set dpd-retryinveral 15
set dpd-retrycount 3
next
end
FortiOS Handbook v3: IPsec VPNs
01-434-112804-20120111 53
http://docs.fortinet.com/