LogID 0101037128: IPsec Phase 1 SA Deleted due to DPD Timeout
Transient WAN jitter or packet loss drops 3 consecutive Dead Peer Detection (DPD) keepalives, prompting the FortiOS IKE daemon to tear down the entire IPsec Phase 1 Security Association and discard all subordinate Phase 2 tunnels.
Technical Root Cause Analysis
FortiOS IPsec tunnels implement Dead Peer Detection (DPD, RFC 3706) to ascertain whether a remote peer gateway is still operational when no transit data is flowing. Under default configurations or aggressive SD-WAN provisioning templates, DPD operates in on-demand mode with a retry count of 3 and an interval of 5 seconds (set dpd-retrycount 3, set dpd-retryinterval 5).
When a brief ISP congestion event, packet reordering burst, or upstream carrier BGP reconvergence drops just 3 UDP port 500/4500 DPD ACK packets within a 15-second window, the ike daemon's dpd_mgr declares the peer dead. It executes an immediate hard teardown of the Phase 1 SA, logs event LogID 0101037128, and removes all associated Phase 2 hardware encryption keys (SPIs) from the NP6/NP7 ASIC. This collapses SD-WAN overlay paths, triggers dynamic routing reconvergence loops (BGP/OSPF flaps), and results in 30 to 90 seconds of total traffic blackholing while IKE performs initial main/aggressive mode negotiation.
Affected Firmware & Blast Radius Matrix
| FortiOS Branch | DPD Default Behavior | Vulnerability Scope | Recommended Tuning |
|---|---|---|---|
| FortiOS 7.0 | on-demand (3 retries @ 5s) | High: Drops tunnels during 15s jitter | Switch to on-idle (5 retries @ 10s) |
| FortiOS 7.2 | on-demand (3 retries @ 5s) | High: Flaps SD-WAN SLA rules | Switch to on-idle (5 retries @ 10s) |
| FortiOS 7.4 | on-demand (3 retries @ 5s) | High: Trigger ADVPN shortcut re-learn | Switch to on-idle (5 retries @ 10s) |
| FortiOS 7.6 | on-idle (adaptive fallback) | Tolerant: Auto-dampening applied | Verify peer compatibility |
Topology Impact: Affects all FortiGate site-to-site IPsec tunnels, Hub-and-Spoke ADVPN topologies, and SD-WAN overlay overlays traversing commercial internet transit or 5G/LTE wireless WAN circuits.
Step 01: Free Verification CLI (Safe Read-Only)
Execute these diagnostic commands to verify current IKE gateway states, count DPD timeout log events, and inspect active Phase 1 SA lifetimes:
Diagnostic Commands
# 1. Check active IKE Phase 1 gateway status and DPD counters
diagnose vpn ike gateway list name <tunnel_name>
# 2. Filter system event logs for LogID 0101037128 occurrences
execute log display | grep "0101037128"
# 3. View real-time IKE daemon operational status
diagnose vpn ike status
# 4. Check active Phase 2 IPsec tunnel hardware offload state
diagnose vpn tunnel list name <tunnel_name>Remediation & Workaround Steps (Teaser Preview)
Follow the complete step-by-step remediation guide in the Ferrite interactive platform:
Frequently Asked Questions
The IKE daemon transmits Dead Peer Detection queries to the remote IPsec peer. If 3 consecutive queries go unanswered due to WAN packet loss or carrier routing jitter, the firewall deletes the Phase 1 SA.
In 'on-demand' mode, DPD queries are sent whenever there is egress traffic waiting to be transmitted. In 'on-idle' mode, DPD queries are only sent if NO inbound or outbound traffic has traversed the tunnel for the interval duration.
No. Changing DPD parameters via FortiOS CLI updates the running phase1 configuration dynamically without terminating active Phase 1 or Phase 2 SAs.