Debugging Dead Peer Detection (dpd) on ASA

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-25-2007 09:01 AM - edited 03-11-2019 02:24 AM
Is there a similar command for ASA like "isakmp log #" in a pix?
Also, from what I have read about dpd in asa, you can specify the idle value in seconds, which specifies how long tunnel can be idle before dpd starts, as well as a retry value in seconds which is the number of seconds between retries. The question is, can you configure how many retries can fail before the peer is considered to be down? If not, what is the default? Is it 1?
Thanks
- Labels:
-
NGFW Firewalls

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
01-26-2007 12:02 PM
Found answer to one of my questions, debug crypto isakmp 7 will display dpd messages. It also looks like the pix retries 4 times before peer is considered down.
The problem is, my tunnel between asa and pix is flapping every so often for no apparent reason. It usually comes right back up after it is torn down. From this log in pix it appears asa is not replying to dpd r u there request from pix.
peer 1.1.1.1 , DPD_TX
peer 1.1.1.1 , DPD_TX
peer 1.1.1.1 , DPD_TX
peer 1.1.1.1 , DPD_TX
peer 1.1.1.1 , DPD_FAIL
peer 1.1.1.1 , DELETE_ALL_SPIS
Should I increase idle time for dpd messages? I do need the pix at remote end to failover to second asa peer if main asa connection fails. I assume making the idle time longer would also make that failover process take longer.
Any help would be appreciated.
How did this post get rated 5.0 by myself???
