An administrator wants to configure Dead Peer Detection (DPD) on IPSEC VPN for detecting dead tunnels. The requirement is that FortiGate sends DPD probes only when no traffic is observed in the…

The 'Disabled' mode completely turns off DPD, preventing any detection of dead tunnels.

The 'On Demand' mode sends DPD probes when traffic needs to be sent and the peer is unresponsive, which is different from proactively checking an idle tunnel.

The 'Enabled' mode typically implies DPD is always active and sends probes at regular intervals, regardless of traffic, which does not match the requirement.

FortiGate's 'On Idle' DPD mode is specifically designed to send DPD probes only when the IPSec tunnel has been inactive for a specified period without any user data traffic. This mode efficiently conserves resources by not sending probes during active traffic while still detecting dead peers when the tunnel is unused.