ASA dead-peer-detection behaviour

binelipetrov · ‎03-03-2009

ASA is by default sending DPD R_U_THERE packets and expecting R_U_THERE_ACK packets from peer.

My question is: in which moment ASA is sending DPD packets? Is this "always on" behavior or ASA is starting sending DPD packets once it stops receiving encrypted traffic over the tunnel from the peer? In this case, what is the idleness period or idleness criteria?

Thanks

Ivan Martinon · ‎03-03-2009

DPD's are sent only when there is no traffic flowing through the tunnel, the values are defined under the tunnel group that affects this lan to lan/remote access

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/i3.html#wp1842584