topic Hi Sankar, in Network Security

How to check Dead connection Detection is enabled or not in asa firewall

sankar.ramoju — Wed, 13 Mar 2019 01:16:06 GMT

Hi,

please share me the command to check Dead Connection Detection is enabled or not in ASA firewall.

Thnaks
sankar

Hi Sankar,

Aditya Ganjoo — Thu, 27 Jul 2017 10:16:54 GMT

Hi Sankar,

You need to check the output of show service-policy from the ASA to see of DCD is in effect.

More info:

http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/conns_connlimits.html#wp1080752

Regards,

Aditya

Please rate helpful and mark correct answers

Hi Suresh,Thanks for the

sankar.ramoju — Thu, 27 Jul 2017 10:24:55 GMT

Hi Suresh,

Thanks for the quick reply.

actually, i got a mail from my client.

" would you ask your network guys to check the DCD (Dead Connection Detection) config on your firewall at the DC end of the VPN Tunnel - e.g. has DCD been enabled, and if so what is the setting

".

which output should I give to my client?

Thnaks,
sankar

Hi Sankar,

Aditya Ganjoo — Thu, 27 Jul 2017 10:33:52 GMT

Hi Sankar,

My name is Aditya 🙂

To check this you would need to go the tunnel group config of the VPN peer.

sh run all tunnel-group <IP>

Check the ipsec-attributes and it will show you the keepalive (DPD) values.

Regards,

Aditya

Please rate helpful and mark correct answers

Hi Aditya,Thanks for your

sankar.ramoju — Thu, 27 Jul 2017 11:03:47 GMT

Hi Aditya,

Thanks for your quick replies.

Actually, we have a VPN Tunnel between our DC and the client location. previously everything working fine. 20days back my client has changed their firewall. Then onwards we are facing some packet loss issue and sometimes we are able to telnet their ips and some times not able connect to their ips through vpn tunnel. In asa logs, I have observed syn timeout problem. but the client is saying everything fine at their end, they suspected some problem with my DC firewall configuration.

Now, he is asking about Dead Connection Detection is enabled or not, if it enabled what is the setting you did in your firewall.

If it's a VPN-Tunnel then it's a Dead Peer Detection right. but my client is asking about Dead Connection Detection. I am confused to reply my client mail.

so I am thinking to share both DCD and DPD settings to my client.

can you please suggest me what is the correct reply to my client.

Thanks,
sankar