The utility wants an IPsec tunnel between the NOC and a substation to tear down automatically if the peer stops responding, rather than staying up as a stale, unusable security association that field technicians assume is still working. Which IPsec feature accomplishes this?
Select an answer to reveal the explanation.
Short Explanation
Dead peer detection is the IPsec equivalent of a periodic 'are you still there?' check between the two FortiGates. If the substation stops answering, the NOC side tears the tunnel down instead of leaving a zombie connection that looks fine on paper but silently drops every packet sent into it.
Full Explanation
Dead peer detection (DPD) is the mechanism specifically designed to detect an unresponsive IPsec peer by sending periodic keepalive probes, and to tear down and optionally attempt to rebuild the security association if the peer fails to respond within the configured interval and retry count. This directly solves the described problem: without DPD, a security association can remain in the FortiGate's tables as 'established' even though the substation side has gone dark, silently blackholing traffic until something else notices. Perfect Forward Secrecy is a cryptographic property ensuring that a compromised long-term key cannot be used to derive past session keys; it has nothing to do with detecting whether a peer is currently reachable, so describing it as a reachability check misattributes an unrelated security feature. Phase 2 selectors define which traffic is considered interesting for encryption and do not have any built-in expiration tied to peer reachability — a phase 2 SA has its own rekey lifetime, but that is a scheduled renegotiation, not a reachability probe, and it would not necessarily catch a peer that goes silent mid-lifetime. NAT traversal (NAT-T) is a mechanism that encapsulates IKE and ESP traffic in UDP so IPsec can function through a NAT device; it does not perform peer-reachability monitoring or automatic failover to a backup gateway, so attributing rerouting behavior to it is incorrect. To confirm DPD is active and working, check 'config vpn ipsec phase1-interface' for the dpd setting and review 'diagnose vpn ike gateway list', which reports the DPD state and last probe result for each gateway.