Shulou(Shulou.com)06/01 Report--

It takes a specified time or a specified amount of traffic for ipsec sa ike sa to be reestablished. If the tunnel at one end is interrupted, the other end may not be aware of it, resulting in impassable * * traffic. The use of dpd technology is equivalent to a heartbeat message. When the dpd message of the peer cannot be received in the specified period, delete the ipsec-related tunnel and re-initiate tunnel negotiation, the tunnel outage time can be reduced. Note: 1. In practice, it is found that end an is not configured with dpd,b, so that the dpd message sent by side a cannot be responded, dpd failure is generated, and tunnel negotiation is reinitiated. However, side b thinks that * tunnel is normal. Tunnel status up, resulting in network failure. In this case, you need to enable dpd detection on both sides, or disable dpd detection on both ends.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.