VPN - crypto keepalive

The crypto keepalive feature is part of what is known as the IPSec Dead Peer Detection (DPD) Periodic Message Option. This feature is used to configure the router to query the liveliness of its Internet Key Exchange (IKE) peer at regular intervals. The benefit of this approach over the default approach (on-demand dead peer detection) is earlier detection of dead peers.

If you want to configure the DPD periodic message option, you should use the crypto isakmp keepalive command with the periodic keyword. If you do not configure the periodic keyword, the router defaults to the on-demand approach.

Note that when the crypto isakmp keepalive command is configured, the Cisco IOS software negotiates the use of Cisco IOS keepalives or DPD, depending on which protocol the peer supports.

The syntax for the command is the following:

crypto isakmp keepalive seconds [retry-seconds] [periodic | on-demand]