<br><br><div class="gmail_quote">On Fri, Oct 24, 2008 at 8:46 PM, Peter McGill <span dir="ltr"><<a href="mailto:petermcgill@goco.net">petermcgill@goco.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
Anirudh,<br>
<br>
Short answer: Not using DPD, but perhaps with monitoring scripts.<br>
Long answer:<br>
<br>
You can easily monitor ipsec auto --up/--down by providing a wrapper<br>
script to record the intended up/down status.<br>
Using KLIPS & DPD you can use ipsec eroute to determine actual status.<br>
Should be a method for NETKEY too, but I still use KLIPS.<br>
You can also scan the recent logs to determine why/who shut down the tunnel.<br>
Although if the tunnel goes down via DPD timeout then I can't think of<br>
any way to determine which end went down, only if one end disconnected<br>
properly could you determine which end, via logs or by comparing intended<br>
status to actual status using above described scripts.<br>
<br>
If you want more specific help, try describing more what your trying to do.</blockquote></div>Basically, for logging purposes.<br>Also, I am trying to do a manual failover by starting a tunnel over a backup interface<br>
and I do not want both ends of the tunnel to be the initiators.<br><br>Thanks,<br>-anirudh<br>