Debugging Dead Peer Detection (dpd) on ASA

acomiskey · ‎01-25-2007

Is there a similar command for ASA like "isakmp log #" in a pix?

Also, from what I have read about dpd in asa, you can specify the idle value in seconds, which specifies how long tunnel can be idle before dpd starts, as well as a retry value in seconds which is the number of seconds between retries. The question is, can you configure how many retries can fail before the peer is considered to be down? If not, what is the default? Is it 1?

Thanks

acomiskey · ‎01-26-2007

Found answer to one of my questions, debug crypto isakmp 7 will display dpd messages. It also looks like the pix retries 4 times before peer is considered down.

The problem is, my tunnel between asa and pix is flapping every so often for no apparent reason. It usually comes right back up after it is torn down. From this log in pix it appears asa is not replying to dpd r u there request from pix.

peer 1.1.1.1 , DPD_TX

peer 1.1.1.1 , DPD_FAIL

peer 1.1.1.1 , DELETE_ALL_SPIS

Should I increase idle time for dpd messages? I do need the pix at remote end to failover to second asa peer if main asa connection fails. I assume making the idle time longer would also make that failover process take longer.

Any help would be appreciated.

How did this post get rated 5.0 by myself???