Lecture 106: VPN Dead Peer Detection (DPD)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:09
- 来源：Udemy Lecture 26077832
- Slide 数量：3
- 画面切换：00:29、01:58
扫描说明
逐条检查了 Udemy 页面中的 123 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 5:09 的视频。依据标题、DPD 活性检测流程和 DPD 配置要点三个独立幻灯片，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. DPD 的作用
时间范围：00:00–00:29
总结 / Summary
中文
失效对等体检测（Dead Peer Detection, DPD）用于判断 IPsec VPN 对端是否仍然存活。它可帮助站点到站点 VPN（Site-to-Site VPN）及时识别故障，以便切换到备用隧道、备用网络路径，或出于安全原因清理已经失效的连接。
English
Dead Peer Detection determines whether the remote IPsec VPN peer is still alive. It helps a Site-to-Site VPN detect failures promptly so that traffic can fail over to another tunnel or network path, or the stale connection can be cleared for security reasons.
Transcript
00:00 Hello, and welcome to this lecture,
00:01 Dead Peer Detection, that is DPD.
00:04 Now, DPD is a mechanism
00:05 through which you can detect the problem
00:08 in your VPN connection
00:09 whether the other end is working or not.
00:12 And this is important because many times probably
00:15 you want to fail-over to another channel
00:18 or another network for your VPN connection
00:21 or for sometimes, maybe you want to
00:23 close that connection due to security reasons.
00:26 So DPD helps you to address that problem.
2. R-U-THERE 活性检测流程
时间范围：00:29–01:58
总结 / Summary
中文
DPD 是在 IKE 第一阶段（IKE Phase 1）由 VPN 对等体协商的可选能力。启用后，AWS 侧虚拟私有网关（Virtual Private Gateway, VGW）每 10 秒向客户网关（Customer Gateway, CGW）发送一次 R-U-THERE 消息，并等待 R-U-THERE-ACK。若连续三次没有响应，默认 30 秒后 DPD 超时并在隧道级别判定对端失效。
English
DPD is an optional capability negotiated by the VPN peers during IKE Phase 1. When enabled, the AWS Virtual Private Gateway sends an R-U-THERE message to the Customer Gateway every 10 seconds and waits for an R-U-THERE-ACK. Three consecutive unanswered requests produce the default 30-second timeout and mark the peer dead at the tunnel level.
Transcript
00:29 So, you know this architecture
00:31 we are talking about the same setup all the time.
00:34 But then if you talk about the DPD,
00:37 it's a method to detect liveliness
00:38 of your IPSec VPN connection.
00:41 Now, what that means is,
00:43 on AWS side of the VPN connection
00:45 and on CGW side of the VPN connection
00:48 if you configure the DPD,
00:50 that means it's optional settings.
00:52 And this is decided during
00:54 the phase one of IPSec negotiation.
00:57 So VPN peers can decide that
01:00 whether they want to use DPD or not.
01:02 Now if DPD is enabled
01:04 then what AWS side of the virtual private gateway does is
01:07 it sends something called (R-U-THERE) DPD message
01:11 to the customer gateway every 10 seconds.
01:14 And then it would wait for an acknowledgement
01:17 R-U-THERE-ACK.
01:19 And it would check if there is no response
01:22 from the other end for three consecutive time,
01:25 that means in 30 seconds,
01:27 that's the default timeout.
01:29 Essentially it will terminate your VPN tunnel.
01:31 It works at tunnel level.
01:33 Now, how it works?.
01:35 As I said,
01:36 VGW will send R-U-THERE messages continuously
01:39 and your customer gateway should response to those messages.
01:43 Now, if customer gateway
01:45 for some reason is not responding to your DPD packets
01:48 for three consecutive times.
01:50 The VGW will terminate the tunnel
01:53 that's what the DPD is.
01:55 Now, few more things you need to understand
01:56 about the DPD is that.
3. DPD 超时动作与 Idle Timeout
时间范围：01:58–05:09
总结 / Summary
中文
DPD 超时后默认执行清除（Clear）：删除安全关联（Security Association, SA）、结束 IPsec IKE 会话、停止隧道并清除路由；也可配置重启（Restart）以重新发起 IKE 第一阶段，或选择无动作（None）。默认超时为 30 秒，可调得更高；DPD 消息使用 UDP 500，采用 NAT 穿越（NAT Traversal, NAT-T）时使用 UDP 4500。动态路由（dynamic routing）场景中的客户路由器必须支持 DPD。DPD 检查的是对端活性，与空闲超时（idle timeout）不同；后者可因长期无业务流量终止仍健康的隧道，可通过调整空闲时间或周期性 ICMP ping 保活。
English
The default DPD timeout action is Clear: delete the Security Associations, end the IPsec IKE session, stop the tunnel, and clear routes. Restart can reinitiate IKE Phase 1, while None takes no action. The default timeout is 30 seconds and can be increased; DPD uses UDP 500 or UDP 4500 with NAT-T. Customer routers using dynamic routing must support DPD. DPD checks peer liveliness and is distinct from idle timeout, which can terminate a healthy but inactive tunnel; idle settings or periodic ICMP pings can keep it active.
Transcript
01:58 By default, when DPD occurs,
02:00 your gateway would delete the security associations,
02:04 which it creates during the IPSec handshake
02:06 and during that process
02:08 the alternate IPSec tunnel can be used.
02:11 If you have configured both the tunnel
02:12 in Active-Active mode.
02:15 Now, default DPD timeout is 30 seconds,
02:17 but then you can set it higher than the 30 seconds.
02:21 DPD uses UDP port 500 and in case of NAT traversal,
02:26 port 4500 to send this DPD packages,
02:30 so make sure that these ports are enabled.
02:32 Now, when DPD occurs,
02:34 that means when the DPD timeout occurs,
02:37 there are three actions that you can set
02:40 on AWS side of the VPN connection.
02:43 You can say that, when DPD occurs,
02:44 maybe you clear the connection.
02:46 That means in the IPSec session,
02:48 stop the tunnel and clear the routes.
02:50 Or you can say restart the IPSec IKE phase one,
02:54 or take no action. So this is up to you,
02:56 how you configure it, but the default action
02:58 is to clear everything,
03:00 that means you end your IPSec tunnel.
03:02 Customer, which uses the Dynamic Routing
03:05 must support the DPD at their router.
03:08 That means if your router does not support DPD
03:11 and you are using Dynamic Routing using BGP,
03:13 then that router won't be able
03:15 to make the connection with AWS or VGW.
03:19 DPD is about checking the health of your VPN tunnel.
03:23 But for inactivity of your tunnel,
03:26 in the sense that if you're not sending any data
03:29 across your tunnel, even though the tunnels are up,
03:31 everything is working,
03:32 but there is no server on either side
03:35 which is continuously or which is sending the data through
03:37 that tunnel, now this is called idle connection.
03:40 Now, there is a setting called default idle timeout
03:44 on customer gateway side of it.
03:46 And if you set that timeout time,
03:48 there is no packet flowing during that timeout period
03:51 then also your VPN tunnel is terminated.
03:54 Now,
03:55 if you're using a Cisco router or Juniper,
03:57 there are various values you can set.
03:59 Like maybe a 30 minutes or one hour or two hour.
04:02 And when this timeout occurs, in that case,
04:07 you have to re-establish the VPN connection.
04:09 Now, one workaround for this is
04:11 to have some hosts on either side,
04:13 which is continuously sending some ping request
04:17 to other hosts in at other end of the VPN
04:20 that makes sure there is always some data flowing
04:22 through the VPN tunnel.
04:23 And then your term connection won't be terminated.
04:27 So that's some of the way in which
04:29 you can keep your tunnel up and running all the time.
04:32 So, that's it for this lecture.
04:34 Just quickly,
04:36 DPD is Dead Peer Detection and it is used to
04:39 check the liveliness of your VPN tunnel.
04:42 If you decide to use DPD, then on AWS side,
04:44 it will continuously send R-U-THERE packets.
04:47 And if there is no response to three consecutive requests,
04:50 the AWS by default will terminate the VPN tunnel.
04:54 You can set different action,
04:56 like a restart or none,
04:57 but the default is to clear the connection.
04:59 So that's it about DPD important for your exam
05:03 to have a fail-over scenarios.
05:05 So remember this,
05:06 thanks for watching.
整讲总结 / Overall Summary
中文
失效对等体检测（DPD）通过周期性 R-U-THERE/R-U-THERE-ACK 交换判断 IPsec 对端是否存活，默认每 10 秒探测一次，连续三次失败后在 30 秒超时。管理员可选择清除、重启或不处理，并需区分 DPD 故障检测与因无业务流量触发的空闲超时（idle timeout）。
English
Dead Peer Detection checks IPsec peer liveliness through periodic R-U-THERE and R-U-THERE-ACK exchanges. By default it probes every 10 seconds and times out after three failures, or 30 seconds. Administrators can clear, restart, or ignore the timeout and must distinguish DPD failure detection from an idle timeout caused by a lack of user traffic.
返回顶部 ↑