Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

Green

Debugging Dead Peer Detection (dpd) on ASA

Is there a similar command for ASA like "isakmp log #" in a pix?

Also, from what I have read about dpd in asa, you can specify the idle value in seconds, which specifies how long tunnel can be idle before dpd starts, as well as a retry value in seconds which is the number of seconds between retries. The question is, can you configure how many retries can fail before the peer is considered to be down? If not, what is the default? Is it 1?

Thanks

1 REPLY
Green

Re: Debugging Dead Peer Detection (dpd) on ASA

Found answer to one of my questions, debug crypto isakmp 7 will display dpd messages. It also looks like the pix retries 4 times before peer is considered down.

The problem is, my tunnel between asa and pix is flapping every so often for no apparent reason. It usually comes right back up after it is torn down. From this log in pix it appears asa is not replying to dpd r u there request from pix.

peer 1.1.1.1 , DPD_TX

peer 1.1.1.1 , DPD_TX

peer 1.1.1.1 , DPD_TX

peer 1.1.1.1 , DPD_TX

peer 1.1.1.1 , DPD_FAIL

peer 1.1.1.1 , DELETE_ALL_SPIS

Should I increase idle time for dpd messages? I do need the pix at remote end to failover to second asa peer if main asa connection fails. I assume making the idle time longer would also make that failover process take longer.

Any help would be appreciated.

How did this post get rated 5.0 by myself???

1059
Views
5
Helpful
1
Replies
CreatePlease to create content