If this post was helpful, please mark this post as an 'Accepted Solution'.

The ICMP traffic fails, the VPN is considered down. Of the tunnel (such as a server), along with specifying the source IP address of the ICMP traffic. The SRX to send ICMP traffic either to the peer gateway, or to another destination on the other end As it's route-based VPN, there are no traffic. The remote end (PAN) is seeing the VPN go down for up to 50 minutes, whereas the SRX side is seeing a traffic selector issue but if it's the initiator, the tunnel is up as far as the SRX is concerned. Internet Control Message Protocol (ICMP) to determine if the VPN is up. SRX380 version - 20.2R3.9 (JTAC recommended) It's a route-based VPN which carries multiple subnets. VPN monitoring is not an Ipsec standard feature, but it utilizes One issue with DPD is that it doesn’t necessarily mean the underlying VPN is up and running, just Is VPN Monitor a better choice? If pings from VPN Monitor fail, will the tunnel be declared dead more quickly- or does the system still wait for the Dead Peer Detection to trigger?īottom line question- what is the best practice for (a) discovering a dead tunnel more quickly than 10-20 seconds, (b) without needless false 'dead' alarms that will trigger a route change? Problem is, if Dead Peer Detection is set to declare death after a single missed response, we risk needlessly flapping our tunnel routes every time a single 'check for up' packet is lost. I'm looking for a way to more quickly determine when a VPN is declared 'down' so OSPF can respond a lot more quickly to LEGITIMATE outages- within a few seconds at most. So this means at least (10 second interval x 2 tries) 20 seconds before an unresponsive tunnel is declared dead and OSPF changes the route (to a less desirable tunnel). The minimum check interval in VPN Dead Peer Detection is 10 seconds, and we want to check at least twice before the tunnel is declared dead. What is the difference between 'VPN Monitor' and VPN 'Dead Peer Detection'?

Juniper vpn monitor vs dpd