Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

DPD timeout value !

hi all, i am faced with a difficult situation but a very common 1 though. i have 1 hub router and 1 spoke router with 2 WAN links. Wimax and DSL. i am using gre tunnels to run ospf between spoke and hub. i have used ospf costing to turn 1 link into primary and other to backup. so far my network is working fine. now i am deploying site to site vpn, now as you can see that since i have 2 seperate WAN links and i need vpn on both of them so at spoke end, i will be using two peer statements right ?

crypto map my 10 ipsec-isakmp

mat address 111

set peer (primary WAN ip of hub)

set peer (secondary WAN ip of hub)

set transform-set sample

Now everything is working fine. I am having issue when my major links go down. Isakmp takes TOO much time to shift to secondary link. this is my sample ping

R4#ping source rep 100

Type escape sequence to abort.

Sending 100, 100-byte ICMP Echos to, timeout is 2 seconds:

Packet sent with a source address of


I need to reduce this time to as minimum as possible. This is a very common design so plz guide me. pls note the following

1)hub router is 3845 running advseck9 IOS

2)spoke router is 1841 running advseck9 IOS

i am using simple site to site VPN, i cant use DMVPN coz we discussed this scenario with CCIE security and he agreed that DMVPN will be too complex to handle in our scenario since number of spokes are more then 150. but they are divided in 3 ospf areas, 1 hub for each area and handling almost 50 spokes.

Pls guide me i think this has to do with DPD but i dont see much effect of it.


Re: DPD timeout value !

The DPD (dead peer detection) timeout parameter specifies the timeout value in seconds. The DPD timer is used to determine if a DPD packet needs to be sent to the peer. The DPD timer is reset every time a Cisco SSL Tunnel Protocol (CSTP) frame is received from the peer. Valid values for the DPD interval for client and gateway are 0 (disabled) to 3600 seconds. Default is 300 seconds.

To configure the dead peer detection (DPD) timer value for the gateway or client, use the "svc dpd-interval" command in webvpn group policy configuration mode. To remove a DPD timer value from the policy group configuration, use the no form of this command. Reduce the timeout value using this command.

Re: DPD timeout value !

You can ocnfigure isakmp keepalives as per the following:

Please do it on both sides.



New Member

Re: DPD timeout value !

Dear Farrukh, thanks alot for the feedback but i knew how to enable it actually what i was asking as to when a router will declare the peer dead ? i.e. what is the dead timer if u say, anyway using the debug and using the RFC i got it working.

Thanks alot anyways guys :-) pls look at my another query

CreatePlease to create content