About scott-johanson

The BPA is one of the best ways of measuring your current configuration against best practices and to see if you are utilizing all the features you purchased. If you need help understanding the Best Practice Assessment Report, please look at the link provided.  https://www.paloaltonetworks.com/resources/videos/bpa-demo ... View more

DPD is not supported on Cisco. This is a Palo Alto feature. You will see that in the ike logs.    Overview Dead Peer Detection (DPD) refers to functionality documented in RFC 3706, which is a method of detecting dead Internet Key Exchange (IKE/Phase1) peers. Tunnel Monitoring is a Palo Alto Networks proprietary feature that verifies traffic is successfully passing across the IPSEC tunnel in question by sending a PING down the tunnel to the configured destination. Tunnel monitoring can be used in conjunction with “Monitor Profiles” to bring down the tunnel interface allowing routing to update to allow traffic to route across secondary routes. Tunnel monitoring does not require DPD. Dead Peer Detection must be either active or disabled on both sides of the tunnel, having one side with DPD enabled and one side with it disabled can cause VPN reliability issues.   https://live.paloaltonetworks.com/t5/Configuration-Articles/Dead-Peer-Detection-and-Tunnel-Monitoring/ta-p/61371   ... View more