6 years later - this post is still relevant. I was trying to join a 2702 to a 9800 CL for 'ISE 3.1 Sandbox v1.1' on dcloud and received the below:   *Jun 2 10:00:39.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 198.19.11.10 peer_p...

icmp permit any outside  

Try adding:policy-map global_policyclass inspection_default inspect icmp

As far as I'm aware, there are two methods for implementing redundant VPNs on an ASA.    1) If your 3rd parties support a route based VPN - configure VTIs and overly unicast BGP. You can then weight a preferred path, and prepend a less desirable one ...