Setting Keepalive Timers - HP 12500 Series Configuration Manual

Step
11. Enable the NAT traversal
function for IPsec/IKE.
12. Set the subnet types of the
two ends.
13. Apply a DPD detector to the
IKE peer.
NOTE:
After modifying the configuration of an IPsec IKE peer, execute the reset ipsec sa and reset ike sa
commands to clear existing IPsec and IKE SAs. Otherwise, SA re-negotiation will fail.

Setting keepalive timers

IKE maintains the link status of an ISAKMP SA by keepalive packets. Generally, if the peer is configured
with the keepalive timeout, you must configure the keepalive packet transmission interval on the local end.
If the peer receives no keepalive packet during the timeout interval, the ISAKMP SA is tagged with the
TIMEOUT tag (if it does not have the tag), or deleted along with the IPsec SAs it negotiated (when it has
the tag already).
The keepalive timeout configured at the local end must be longer than the keepalive interval configured
at the remote end. Since it seldom occurs that more than three consecutive packets are lost on a network,
the keepalive timeout can be configured to be three times of the keepalive interval.
To set the keepalive timers:
Step
1. Enter system view.
2. Set the ISAKMP SA keepalive
interval.
3. Set the ISAKMP SA keepalive
timeout.
Command
nat traversal
•
Set the subnet type of the local
end:
local { multi-subnet |
single-subnet }
•
Set the subnet type of the peer
end:
peer { multi-subnet |
single-subnet }
dpd dpd-name
Command
system-view
ike sa keepalive-timer interval
seconds
ike sa keepalive-timer timeout
seconds
202
Remarks
Optional.
Required when a NAT gateway is
present in the VPN tunnel
constructed by IPsec/IKE.
Disabled by default.
Optional.
The default subnet type is
single-subnet.
Use these two commands only
when the device is working
together with a NetScreen
device.
Optional.
No DPD detector is applied to an
IKE peer by default.
For more information about DPD
configuration, see "Configuring a
DPD detector."
Remarks
N/A
No keepalive packet is sent by
default.
No keepalive packet is sent by
default.