Business Community > Routers > Problem with Dead Peer Detection (DPD)
< Routers

Problem with Dead Peer Detection (DPD)

Problem with Dead Peer Detection (DPD)

Problem with Dead Peer Detection (DPD)
Problem with Dead Peer Detection (DPD)
2 weeks ago - last edited a week ago
Tags: #VPN #IPTV
Model: ER707-M2  
Hardware Version:
Firmware Version: 1.20

I'm in China and do Client-to-LAN connections (iPhone and Windows PC) to a ER707-M2 L2TP/IPsec server in Europe. I have to manually reconnect all the time, very annoying. Log says "DPD detection times out. IPsec connection was disconnected". 

 

I can disable DPD in LAN-to-LAN mode but not in Client-to-LAN mode. Also have DPD as an option for IKEv2 but that works only for iPhone and not for Windows. Anyone know how I can disable DPD when in L2TP/IPsec Client-to-LAN mode?

 

I was a bit surprised to see Great Firewall didn't block VPN so I plan to buy TP-Link routers when I'm back in Europe and prepare a LAN-to-LAN connection. For the router in Europe I would like to have IGMP Proxy and IGMP Snooping as well.  Archer BE230 has that but can two BE230 be set up as LAN-to-LAN with L2TP/IPsec? If not I assume I can use Omada ER706W but for IPTV it only has "IGMP v2/v3 Proxy, Custom Mode, Bridge Mode" so I'm not sure it will handle my IPTV subscription.

  0      
 
  0      
 
#1
Options
2 Accepted Solutions
Re:Problem with Dead Peer Detection (DPD)-Solution
2 weeks ago - last edited a week ago

Hi @HPF 

Thanks for posting in our business forum.

Before answering the question, some facts about the GFW and the experiences we had with the users who pass through the GFW.

GFW will monitor every VPN connection. It will automatically adapt, learn and recognize the VPN if it is not allowed.

If you are connecting a server outside the GFW, it is likely to be blocked after some time. It'd work for some time but will be eventually terminated if it is not licensed by the government. Chinese government issues and authorizes the VPN connections and will not block them. Any person or organization should apply for an international connection. Especially the VPN usage.

We are not able to resolve this issue or masquerade the VPN tunnel as the pattern is obvious anyway. Even if you can connect now, it does not mean you will in the future. We are not able to provide any guarantee or suggestions for passing through the GFW. And we cannot guarantee the product will suit the VPN use case involving GFW as this product is not targeted at the Chinese market.

 

DPD seems to be a feature of your client. Not on the router(server) side.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
  1  
  1  
#2
Options
Re:Problem with Dead Peer Detection (DPD)-Solution
2 weeks ago - last edited a week ago

Hi @HPF 

Thanks for posting in our business forum.

HPF wrote

  @Clive_A BTW, one more thing. In LAN-to-LAN mode, L2TP over IPsec, is DPD enabled? If it is how will the routers reconnect? 

I think it is enabled like the IPsec which is enabled by default. But this cannot be changed as the reason remains the same as the previous reply.

In L2TP, there is no initiator and responder configuration. But they use the IPsec as the encryption for the tunnel. So, some parameters would remain the same as the IPsec.

When you set both IPsec sites with the initiator, it'd work fine, too. So, it doesn't pose a problem. I believe both are initiators if they are in L2TP(over IPsec). When the SA time is reached, they'll reestablish or maintain the tunnel. 

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
  1  
  1  
#9
Options
10 Reply
Re:Problem with Dead Peer Detection (DPD)-Solution
2 weeks ago - last edited a week ago

Hi @HPF 

Thanks for posting in our business forum.

Before answering the question, some facts about the GFW and the experiences we had with the users who pass through the GFW.

GFW will monitor every VPN connection. It will automatically adapt, learn and recognize the VPN if it is not allowed.

If you are connecting a server outside the GFW, it is likely to be blocked after some time. It'd work for some time but will be eventually terminated if it is not licensed by the government. Chinese government issues and authorizes the VPN connections and will not block them. Any person or organization should apply for an international connection. Especially the VPN usage.

We are not able to resolve this issue or masquerade the VPN tunnel as the pattern is obvious anyway. Even if you can connect now, it does not mean you will in the future. We are not able to provide any guarantee or suggestions for passing through the GFW. And we cannot guarantee the product will suit the VPN use case involving GFW as this product is not targeted at the Chinese market.

 

DPD seems to be a feature of your client. Not on the router(server) side.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
  1  
  1  
#2
Options
Re:Problem with Dead Peer Detection (DPD)
2 weeks ago - last edited 2 weeks ago

  @Clive_A  It will not disconnect as long as I work so I don't think it's GFW but DPD. iPhone will disconnect after maybe 5 minutes of inactivity. Windows PC takes longer, maybe as much as 15 minutes. The error log is on the server side in Europe. I do not get any alerts on client side (China).

 

 

Same problem here probably outside GFW. 

https://community.tp-link.com/en/business/forum/topic/608624

  0  
  0  
#3
Options
Re:Problem with Dead Peer Detection (DPD)
2 weeks ago - last edited 2 weeks ago

Hi @HPF 

Thanks for posting in our business forum.

HPF wrote

  @Clive_A  It will not disconnect as long as I work so I don't think it's GFW but DPD. iPhone will disconnect after maybe 5 minutes of inactivity. Windows PC takes longer, maybe as much as 15 minutes. The error log is on the server side in Europe. I do not get any alerts on client side (China).

 

 

Same problem here probably outside GFW. 

https://community.tp-link.com/en/business/forum/topic/608624

For the GFW, I am stating the disclaimer. If there is a further issue down the road, we are not able to provide help on the unknown disconnection. You won't be getting any logs or errors on the client side(inside China). It is either the server's no response, or the connection suddenly disconnects(due to the server's no response).

 

So is it IPsec or L2TP over IPsec?

You have this option if you are an IPsec server.

L2TP over IPsec, you don't have the option to configure any of the IPsec-related settings as they are preset.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  0  
  0  
#4
Options
Re:Problem with Dead Peer Detection (DPD)
2 weeks ago

  @HPF It's "L2TP over IPsec". I tried IPSec and configure IKE parameters but Windows PC wouldn't connect.

 

If I set up a LAN-to-LAN connection (Europe-China) using two Omada routers can I use "L2TP over IPsec" and if yes, will I still have the DPD problem? The L2TP over IPsec works really nice, it's fast and I don't share public IP with hundreds (if not thousands) of others.

  0  
  0  
#5
Options
Re:Problem with Dead Peer Detection (DPD)
2 weeks ago

Hi @HPF 

Thanks for posting in our business forum.

HPF wrote

  @HPF It's "L2TP over IPsec". I tried IPSec and configure IKE parameters but Windows PC wouldn't connect.

 

If I set up a LAN-to-LAN connection (Europe-China) using two Omada routers can I use "L2TP over IPsec" and if yes, will I still have the DPD problem? The L2TP over IPsec works really nice, it's fast and I don't share public IP with hundreds (if not thousands) of others.

If you gonna set up the LAN-to-LAN, use the IPsec instead of the L2TP over IPsec.

DPD can be customized on the IPsec VPN and it is the best type to create a Site-to-Site.

 

As long as it is L2TP over IPsec, the IPsec-related settings are preset and cannot be modified.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  0  
  0  
#6
Options
Re:Problem with Dead Peer Detection (DPD)
2 weeks ago - last edited 2 weeks ago

  @HPF OK, I'll have to test if IPSec works. I was surprised to see L2TP/IPSec worked. Hope IPSec works just as well. Thanks for help.

  0  
  0  
#7
Options
Re:Problem with Dead Peer Detection (DPD)
2 weeks ago

  @Clive_A BTW, one more thing. In LAN-to-LAN mode, L2TP over IPsec, is DPD enabled? If it is how will the routers reconnect? 

  0  
  0  
#8
Options
Re:Problem with Dead Peer Detection (DPD)-Solution
2 weeks ago - last edited a week ago

Hi @HPF 

Thanks for posting in our business forum.

HPF wrote

  @Clive_A BTW, one more thing. In LAN-to-LAN mode, L2TP over IPsec, is DPD enabled? If it is how will the routers reconnect? 

I think it is enabled like the IPsec which is enabled by default. But this cannot be changed as the reason remains the same as the previous reply.

In L2TP, there is no initiator and responder configuration. But they use the IPsec as the encryption for the tunnel. So, some parameters would remain the same as the IPsec.

When you set both IPsec sites with the initiator, it'd work fine, too. So, it doesn't pose a problem. I believe both are initiators if they are in L2TP(over IPsec). When the SA time is reached, they'll reestablish or maintain the tunnel. 

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
Recommended Solution
  1  
  1  
#9
Options
Re:Problem with Dead Peer Detection (DPD)
a week ago

  @Clive_A I replaced the Windows PC with a Mac Mini M4 today. I use cabled USB A keyboard and mouse connected to a USB C-to-USB A hub.  Neither keyboard or mouse would wake up the Mac Mini so I disabled sleep. Mac Mini stay connected all the time so I suspect the problem had something to do with iPhone and Windows PC power saving modes.  BTW; I also had to enable Mac Mini "Send all traffic over VPN connection" to make the VPN it work.

  1  
  1  
#10
Options
Re:Problem with Dead Peer Detection (DPD)
a week ago

Hi @HPF 

Thanks for posting in our business forum.

HPF wrote

  @Clive_A I replaced the Windows PC with a Mac Mini M4 today. I use cabled USB A keyboard and mouse connected to a USB C-to-USB A hub.  Neither keyboard or mouse would wake up the Mac Mini so I disabled sleep. Mac Mini stay connected all the time so I suspect the problem had something to do with iPhone and Windows PC power saving modes.  BTW; I also had to enable Mac Mini "Send all traffic over VPN connection" to make the VPN it work.

OK. Something typical in the OS today. For the sake of the power saving strategy to prolong their powered-on status.

Not surprised to learn about this. I had and have a hard time with the power saving some time. It takes a lot of research to address them.

Best Regards! If you are new to the forum, please read: Howto - A Guide to Use Forum Effectively. Read Before You Post. Look for a model? Search your model NOW Official and Beta firmware. NEW features! Subscribe for the latest update! ☛Download Beta Here☚ ☛ ★ Configuration Guide ★ ☚ ☛ ★ Knowledge Base ★ ☚ ☛ ★ Troubleshooting ★ ☚ ● Be kind and nice. ● Stay on the topic. ● Post details. ● Search first. ● Please don't take it for granted. ● No email confidentiality should be violated. ● S/N, MAC, and your true public IP should be mosaiced.
  1  
  1  
#11
Options

Information

Helpful: 0

Views: 280

Replies: 10

Tags

VPN IPTV
Related Articles
Support for multiple VLANs on WAN Port at Router ER707-M2
830 0
 L2TP VPN connection drop with Error: Dead Peer Detection (Client-to-site VPN)
1191 1
how to get Tunnel Peer IP address
285 0
Android VPN Client IP-SEC IKEv2 supported at ER707-M2 ???
3212 0
Omada VPN without Admin rights?
1596 0
ER707-M2 VPN IPSec Internet access
399 0
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.