dpd packet receive if-related enable
Function
The dpd packet receive if-related enable command enables the function that checks whether the interface that receives DPD packets is the interface that establishes an IPSec SA.
The undo dpd packet receive if-related enable command disables the function that checks whether the interface that receives DPD packets is the interface that establishes an IPSec SA.
By default, the function that checks whether the interface that receives DPD packets is the interface that establishes an IPSec SA is disabled.
Usage Guidelines
Usage Scenario
When IPSec policies with different names and the same parameters have been applied to multiple interfaces of the device, the interface that receives encrypted traffic is not the interface that establishes an IPSec SA during an interface switchover. If you want the two interfaces to be the same, run the dpd packet receive if-related enable command to enable the function that checks whether the interface that receives DPD packets is the interface that establishes an IPSec SA. If the two interfaces are different, DPD packets are discarded and the DPD detection result becomes abnormal. This causes the IPSec SA to be deleted and triggers IKE re-negotiation.
Precautions
This function applies only to the scenario where IPSec policies have been applied to physical interfaces.
