Site-To-Site VPN DPD detection

[Stephen Sisson]

Hello everyone

We need your help with our Site-To-Site VPN

We have a VPN site-to-site connection the remote client has implemented DPD on their side and requesting we do the same on our Cisco 5505 ASA firewall. 

My Question; is this recommended by Cisco if not please give a complete reason why, we can summit to upper management for review

Can you help me with the commands/Syntax for adding this to our Cisco 5505 ASA firewall running IOS version 8.45; will this bring the tunnel down while we configure this DPD?

Thank you

[Richard Burts]

DPD is a feature that you can enable or disable, if you choose, on the ASA. Since it is enabled by default on the ASA we can probably deduce that Cisco probably does recommend this feature.

You can see this link for an interesting discussion of DPD including DPD on ASA with some mention of the commands to use on ASA

https://supportforums.cisco.com/document/32546/dead-peer-detection

I would not expect that configuring DPD would bring down an active tunnel, assuming that the peer for the tunnel is, in fact, alive and active.

HTH

Rick

[Stephen Sisson]

Hello Richard, thanks for the quick response

Can you explain how to configure this from the ASDM GUI for version 8.4.5

Thank you Sir

[Richard Burts · Accepted solution]

Part of what may be generating some confusion is terminology. We have been talking about Dead Peer Detection and probably you have looked in the documentation for that. When I look for that I do not find much. But another name for DPD is ISAKMP keepalives. And this page is where you can enable/disable ISAKMP keepalives for a site to site tunnel.

HTH

Rick

[Stephen Sisson]

Yes Sir, confusion while reading all the many documents on the internet, you made this so easy

Thank you Sir - all you help

[Richard Burts]

I am glad that my response was helpful. Thank you for using the rating system to mark this question as answered. That makes it easier for other readers in the forum to find helpful information.

HTH

Rick

[ChakoMwendapole5185]

Hi

thank so much on the distinction of DPD vs ISAKMP keepalives.

However i want to activate DPD/ISAKMP from a Cisco Linux firepower NGFW. Assist me to navigate to the correct screen.