Cisco Cisco ASA 5580 Adaptive Security Appliance

Page 12 of 16

Dead Peer Detection (DPD)

Dead peer detection (DPD) helps ensure that the ASA gateway or the AnyConnect client can quickly detect a

condition where the peer is not responding and the connection has failed.

Server-side DPD should be disabled, as it prevents the device from sleeping. However, client-side DPD should be

enabled, as it enables the client to determine when the tunnel is terminated due to a lack of network connectivity.

Split-Tunnel Policy

The split-tunnel feature allows administrators to specify which traffic (based on destination subnets) traverses the

VPN tunnel and which goes in the clear. An associated feature, split DNS, defines which DNS traffic is eligible for

resolution over the VPN tunnel and which DNS traffic should be handled by the endpoint DNS resolver.

Full-Tunnel Policy

For Jabber and AnyConnect deployments, full tunnel is the most secure option. With this feature enabled, all the

traffic from all the applications on the device is sent over the VPN tunnel to the ASA gateway (Figure 5). However,

it could result in latency for all the applications and drain the battery more quickly on mobile devices.

Figure 5. Full-Tunnel Policy

Administrators can optionally enable the Local LAN Access

feature to enable local printing and local network

drive mapping.

Split-Include Policy with Network Access Control List (ACL)

Some organizations would like to limit the traffic that is sent over the VPN tunnel due to bandwidth concerns. In

addition, they would like to restrict the VPN session to the Jabber application.

The split-include policy on the Cisco ASA can be used to specify which traffic is encrypted and sent via the VPN

tunnel based on the destination IP address of the traffic.

Administrators will have to include the IP subnets of the Cisco Unified Communications Manager cluster, directory

server, and Trivial File Transfer Protocol (TFTP) server. The Jabber client needs peer-to-peer media connections

with any IP phone or soft phone on the corporate network. Hence, the split-include policy should include the

corporate network IP address range. Sometimes the IP space of a large company is not contiguous because of

acquisitions and other events, so this configuration may not be applicable for all deployments.

DPD:

Local LAN access: