Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.


Debugging Dead Peer Detection (dpd) on ASA

Is there a similar command for ASA like "isakmp log #" in a pix?

Also, from what I have read about dpd in asa, you can specify the idle value in seconds, which specifies how long tunnel can be idle before dpd starts, as well as a retry value in seconds which is the number of seconds between retries. The question is, can you configure how many retries can fail before the peer is considered to be down? If not, what is the default? Is it 1?



Re: Debugging Dead Peer Detection (dpd) on ASA

Found answer to one of my questions, debug crypto isakmp 7 will display dpd messages. It also looks like the pix retries 4 times before peer is considered down.

The problem is, my tunnel between asa and pix is flapping every so often for no apparent reason. It usually comes right back up after it is torn down. From this log in pix it appears asa is not replying to dpd r u there request from pix.

peer , DPD_TX

peer , DPD_TX

peer , DPD_TX

peer , DPD_TX

peer , DPD_FAIL


Should I increase idle time for dpd messages? I do need the pix at remote end to failover to second asa peer if main asa connection fails. I assume making the idle time longer would also make that failover process take longer.

Any help would be appreciated.

How did this post get rated 5.0 by myself???

CreatePlease to create content