IPsec Dead Peer Detection Periodic Message Option
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
Contents
IPsec Dead Peer Detection Periodic Message OptionLast Updated: July 25, 2011
The IPsec Dead Peer Detection Periodic Message Option feature is used to configure the router to query the liveliness of its Internet Key Exchange (IKE) peer at regular intervals. The benefit of this approach over the default approach (on-demand dead peer detection) is earlier detection of dead peers.
Finding Feature InformationYour software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required. Prerequisites for IPsec Dead Peer Detection PeriodicMessage OptionBefore configuring the IPsec Dead Peer Detection Periodic Message Option feature, you should have the following:
Restrictions for IPsec Dead Peer Detection PeriodicMessage OptionUsing periodic DPD potentially allows the router to detect an unresponsive IKE peer with better response time when compared to on-demand DPD. However, use of periodic DPD incurs extra overhead. When communicating to large numbers of IKE peers, you should consider using on-demand DPD instead. Information About IPsec Dead Peer DetectionPeriodic Message Option
How DPD and Cisco IOS Keepalive Features WorkDPD and Cisco IOS keepalives function on the basis of the timer. If the timer is set for 10 seconds, the router sends a âhelloâ message every 10 seconds (unless, of course, the router receives a âhelloâ message from the peer). The benefit of IOS keepalives and periodic DPD is earlier detection of dead peers. However, IOS keepalives and periodic DPD rely on periodic messages that have to be sent with considerable frequency. The result of sending frequent messages is that the communicating peers must encrypt and decrypt more packets. DPD also has an on-demand approach. The contrasting on-demand approach is the default. With on-demand DPD, messages are sent on the basis of traffic patterns. For example, if a router has to send outbound traffic and the liveliness of the peer is questionable, the router sends a DPD message to query the status of the peer. If a router has no traffic to send, it never sends a DPD message. If a peer is dead, and the router never has any traffic to send to the peer, the router does not discover this until the IKE or IPsec security association (SA) has to be rekeyed (the liveliness of the peer is unimportant if the router is not trying to communicate with the peer). On the other hand, if the router has traffic to send to the peer, and the peer does not respond, the router initiates a DPD message to determine the state of the peer. Using the IPsec Dead Peer Detection Periodic Message OptionWith the IPsec Dead Peer Detection Periodic Message Option feature, you can configure your router so that DPD messages are âforcedâ at regular intervals. This forced approach results in earlier detection of dead peers. For example, if a router has no traffic to send, a DPD message is still sent at regular intervals, and if a peer is dead, the router does not have to wait until the IKE SA times out to find out. If you want to configure the DPD periodic message option, you should use the crypto isakmp keepalive command with the periodic keyword. If you do not configure the periodic keyword, the router defaults to the on-demand approach.
Using DPD and Cisco IOS Keepalive Featureswith Multiple Peers in the Crypto MapDPD and IOS keepalive features can be used in conjunction with multiple peers in the crypto map to allow for stateless failover. DPD allows the router to detect a dead IKE peer, and when the router detects the dead state, the router deletes the IPsec and IKE SAs to the peer. If you configure multiple peers, the router switches over to the next listed peer for a stateless failover. Using DPD in an Easy VPN Remote ConfigurationDPD can be used in an Easy VPN remote configuration. See the section Configuring DPD for an Easy VPN Remote. How to Configure IPsec Dead Peer Detection PeriodicMessage Option
Configuring a Periodic DPD Message
SUMMARY STEPS
DETAILED STEPS Configuring DPD and Cisco IOS Keepalives with Multiple Peersin the Crypto MapTo configure DPD and IOS keepalives to be used in conjunction with the crypto map to allow for stateless failover, perform the following steps. This configuration causes a router to cycle through the peer list when it detects that the first peer is dead. DETAILED STEPS
Configuring DPD for an Easy VPN RemoteTo configure DPD in an Easy VPN remote configuration, perform the following steps. This configuration also causes a router to cycle through the peer list when it detects that the first peer is dead.
DETAILED STEPS
Verifying That DPD Is EnabledDPD allows the router to clear the IKE state when a peer becomes unreachable. If DPD is enabled and the peer is unreachable for some time, you can use the clear crypto session command to manually clear IKE and IPsec SAs. The debug crypto isakmp command can be used to verify that DPD is enabled. DETAILED STEPS
Configuration Examples for IPsec Dead Peer DetectionPeriodic Message Option
Site-to-Site Setup with Periodic DPD Enabled ExampleThe following configurations are for a site-to-site setup with no periodic DPD enabled. The configurations are for the IKE Phase 1 policy and for the IKE preshared key. IKE Preshared Keycrypto isakmp key kd94j1ksldz address 10.2.80.209 255.255.255.0 crypto isakmp keepalive 10 periodic crypto ipsec transform-set esp-3des-sha esp-3des esp-sha-hmac crypto map test 1 ipsec-isakmp set peer 10.2.80.209 set transform-set esp-3des-sha match address 101 ! ! interface FastEthernet0 ip address 10.1.32.14 255.255.255.0 speed auto crypto map test ! Easy VPN Remote with DPD Enabled ExampleThe following configuration tells the router to send a periodic DPD message every 30 seconds. If the peer fails to respond to the DPD R_U_THERE message, the router resends the message every 20 seconds (four transmissions altogether). crypto isakmp keepalive 30 20 periodic crypto ipsec client ezvpn ezvpn-config connect auto group unity key preshared mode client peer 10.2.80.209 ! ! interface Ethernet0 ip address 10.2.3.4 255.255.255.0 half-duplex crypto ipsec client ezvpn ezvpn-config inside ! interface FastEthernet0 ip address 10.1.32.14 255.255.255.0 speed auto crypto ipsec client ezvpn ezvpn-config outside Verifying DPD Configuration Using the debug crypto isakmp Command ExampleThe following sample output from the debug crypto isakmp command verifies that IKE DPD is enabled: *Mar 25 15:17:14.131: ISAKMP:(0:1:HW:2):IKE_DPD is enabled, initializing timers To see that IKE DPD is enabled (and that the peer supports DPD): when periodic DPD is enabled, you should see the following debug messages at the interval specified by the command: *Mar 25 15:18:52.107: ISAKMP:(0:1:HW:2): sending packet to 10.2.80.209 my_port 500 peer_port 500 (I) QM_IDLE *Mar 25 15:18:52.107: ISAKMP:(0:1:HW:2):purging node 899852982 *Mar 25 15:18:52.111: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_IM_ALIVE *Mar 25 15:18:52.111: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE The above message corresponds to sending the DPD R_U_THERE message. *Mar 25 15:18:52.123: ISAKMP (0:268435457): received packet from 10.2.80.209 dport 500 sport 500 Global (I) QM_IDLE *Mar 25 15:18:52.123: ISAKMP: set new node -443923643 to QM_IDLE *Mar 25 15:18:52.131: ISAKMP:(0:1:HW:2): processing HASH payload. message ID = -443923643 *Mar 25 15:18:52.131: ISAKMP:(0:1:HW:2): processing NOTIFY R_U_THERE_ACK protocol 1 spi 0, message ID = -443923643, sa = 81BA4DD4 *Mar 25 15:18:52.135: ISAKMP:(0:1:HW:2): DPD/R_U_THERE_ACK received from peer 10.2.80.209, sequence 0x9 *Mar 25 15:18:52.135: ISAKMP:(0:1:HW:2):deleting node -443923643 error FALSE reason "informational (in) state 1" *Mar 25 15:18:52.135: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_PEER, IKE_INFO_NOTIFY *Mar 25 15:18:52.135: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE The above message corresponds to receiving the acknowledge (ACK) message from the peer. Router# *Mar 25 15:47:35.335: ISAKMP: set new node -90798077 to QM_IDLE *Mar 25 15:47:35.343: ISAKMP:(0:1:HW:2): sending packet to 10.2.80.209 my_port 500 peer_port 500 (I) QM_IDLE *Mar 25 15:47:35.343: ISAKMP:(0:1:HW:2):purging node -90798077 *Mar 25 15:47:35.347: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_IM_ALIVE *Mar 25 15:47:35.347: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Mar 25 15:47:36.611: ISAKMP:(0:1:HW:2):purging node 1515050537 *Mar 25 15:47:37.343: ISAKMP:(0:1:HW:2):incrementing error counter on sa: PEERS_ALIVE_TIMER *Mar 25 15:47:37.343: ISAKMP: set new node -1592471565 to QM_IDLE *Mar 25 15:47:37.351: ISAKMP:(0:1:HW:2): sending packet to 10.2.80.209 my_port 500 peer_port 500 (I) QM_IDLE *Mar 25 15:47:37.351: ISAKMP:(0:1:HW:2):purging node -1592471565 *Mar 25 15:47:37.355: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE *Mar 25 15:47:37.355: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Mar 25 15:47:39.355: ISAKMP:(0:1:HW:2):incrementing error counter on sa: PEERS_ALIVE_TIMER *Mar 25 15:47:39.355: ISAKMP: set new node 1758739401 to QM_IDLE *Mar 25 15:47:39.363: ISAKMP:(0:1:HW:2): sending packet to 10.2.80.209 my_port 500 peer_port 500 (I) QM_IDLE *Mar 25 15:47:39.363: ISAKMP:(0:1:HW:2):purging node 1758739401 *Mar 25 15:47:39.367: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE *Mar 25 15:47:39.367: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Mar 25 15:47:41.367: ISAKMP:(0:1:HW:2):incrementing error counter on sa: PEERS_ALIVE_TIMER *Mar 25 15:47:41.367: ISAKMP: set new node 320258858 to QM_IDLE *Mar 25 15:47:41.375: ISAKMP:(0:1:HW:2): sending packet to 10.2.80.209 my_port 500 peer_port 500 (I) QM_IDLE *Mar 25 15:47:41.379: ISAKMP:(0:1:HW:2):purging node 320258858 *Mar 25 15:47:41.379: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE *Mar 25 15:47:41.379: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Mar 25 15:47:43.379: ISAKMP:(0:1:HW:2):incrementing error counter on sa: PEERS_ALIVE_TIMER *Mar 25 15:47:43.379: ISAKMP: set new node -744493014 to QM_IDLE *Mar 25 15:47:43.387: ISAKMP:(0:1:HW:2): sending packet to 10.2.80.209 my_port 500 peer_port 500 (I) QM_IDLE *Mar 25 15:47:43.387: ISAKMP:(0:1:HW:2):purging node -744493014 *Mar 25 15:47:43.391: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE *Mar 25 15:47:43.391: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_P1_COMPLETE *Mar 25 15:47:45.391: ISAKMP:(0:1:HW:2):incrementing error counter on sa: PEERS_ALIVE_TIMER *Mar 25 15:47:45.391: ISAKMP:(0:1:HW:2):peer 10.2.80.209 not responding! *Mar 25 15:47:45.391: ISAKMP:(0:1:HW:2):peer does not do paranoid keepalives. *Mar 25 15:47:45.391: ISAKMP:(0:1:HW:2):deleting SA reason "peers alive" state (I) QM_IDLE (peer 10.2.80.209) input queue 0 *Mar 25 15:47:45.395: ISAKMP: Unlocking IPSEC struct 0x81E5C4E8 from delete_siblings, count 0 *Mar 25 15:47:45.395: %CRYPTO-5-SESSION_STATUS: Crypto tunnel is DOWN. Peer 10.2.80.209:500 Id: 10.2.80.209 *Mar 25 15:47:45.399: ISAKMP: set new node -2061951065 to QM_IDLE *Mar 25 15:47:45.411: ISAKMP:(0:1:HW:2): sending packet to 10.2.80.209 my_port 500 peer_port 500 (I) QM_IDLE *Mar 25 15:47:45.411: ISAKMP:(0:1:HW:2):purging node -2061951065 *Mar 25 15:47:45.411: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_TIMER, IKE_TIMER_PEERS_ALIVE *Mar 25 15:47:45.411: ISAKMP:(0:1:HW:2):Old State = IKE_P1_COMPLETE New State = IKE_DEST_SA *Mar 25 15:47:45.415: ISAKMP:(0:1:HW:2):deleting SA reason "peers alive" state (I) QM_IDLE (peer 10.2.80.209) input queue 0 *Mar 25 15:47:45.415: ISAKMP: Unlocking IKE struct 0x81E5C4E8 for isadb_mark_sa_deleted(), count 0 *Mar 25 15:47:45.415: ISAKMP: Deleting peer node by peer_reap for 10.2.80.209: 81E5C4E8 *Mar 25 15:47:45.415: ISAKMP:(0:1:HW:2):deleting node -1067612752 error TRUE reason "peers alive" *Mar 25 15:47:45.415: ISAKMP:(0:1:HW:2):deleting node -114443536 error TRUE reason "peers alive" *Mar 25 15:47:45.419: ISAKMP:(0:1:HW:2):deleting node 2116015069 error TRUE reason "peers alive" *Mar 25 15:47:45.419: ISAKMP:(0:1:HW:2):deleting node -1981865558 error TRUE reason "peers alive" *Mar 25 15:47:45.419: ISAKMP:(0:1:HW:2):Input = IKE_MESG_INTERNAL, IKE_PHASE1_DEL *Mar 25 15:47:45.419: ISAKMP:(0:1:HW:2):Old State = IKE_DEST_SA New State = IKE_DEST_SA *Mar 25 15:47:45.419: ISAKMP: received ke message (4/1) *Mar 25 15:47:45.419: ISAKMP: received ke message (3/1) *Mar 25 15:47:45.423: ISAKMP: ignoring request to send delete notify (no ISAKMP sa) src 10.1.32.14 dst 10.2.80.209 for SPI 0x3A7B69BF *Mar 25 15:47:45.423: ISAKMP:(0:1:HW:2):deleting SA reason "" state (I) MM_NO_STATE (peer 10.2.80.209) input queue 0 *Mar 25 15:47:45.423: ISAKMP:(0:1:HW:2):deleting node -1067612752 error FALSE reason "" *Mar 25 15:47:45.423: ISAKMP:(0:1:HW:2):deleting node -114443536 error FALSE reason "" *Mar 25 15:47:45.423: ISAKMP:(0:1:HW:2):deleting node 2116015069 error FALSE reason "" *Mar 25 15:47:45.427: ISAKMP:(0:1:HW:2):deleting node -1981865558 error FALSE reason "" *Mar 25 15:47:45.427: ISAKMP:(0:1:HW:2):Input = IKE_MESG_FROM_PEER, IKE_MM_EXCH *Mar 25 15:47:45.427: ISAKMP:(0:1:HW:2):Old State = IKE_DEST_SA New State = IKE_DEST_SA The above message shows what happens when the remote peer is unreachable. The router sends one DPD R_U_THERE message and four retransmissions before it finally deletes the IPsec and IKE SAs. DPD and Cisco IOS Keepalives Used in Conjunction with Multiple Peers in a Crypto Map ExampleThe following example shows that DPD and Cisco IOS keepalives are used in conjunction with multiple peers in a crypto map configuration when IKE is used to establish the security associations (SAs). In this example, an SA could be set up to the IPsec peer at 10.0.0.1, 10.0.0.2, or 10.0.0.3. crypto map green 1 ipsec-isakmp set peer 10.0.0.1 set peer 10.0.0.2 set peer 10.0.0.3 set transform-set txfm match address 101 DPD Used in Conjunction with Multiple Peers for an Easy VPN Remote ExampleThe following example shows that DPD is used in conjunction with multiple peers in an Easy VPN remote configuration. In this example, an SA could be set up to the IPsec peer at 10.10.10.10, 10.2.2.2, or 10.3.3.3. crypto ipsec client ezvpn ezvpn-config connect auto group unity key preshared mode client peer 10.10.10.10 peer 10.2.2.2 peer 10.3.3.3 Additional ReferencesMIBsTechnical Assistance
Feature Information for IPsec Dead Peer Detection Periodic Message OptionThe following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R) Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental. |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||