<br><br><div class="gmail_quote">On Thu, Nov 6, 2008 at 10:46 PM, Paul Wouters <span dir="ltr"><<a href="mailto:paul@xelerance.com">paul@xelerance.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div class="Ih2E3d">On Thu, 6 Nov 2008, Anirudh Kamatgi wrote:<br>
<br>
> I have a gateway-gateway tunnel setup using OpenSwan version 2.6.16 and have<br>
> DPD enabled with dpddelay=60, dpdtimeout=120 and dpdaction=hold.<br>
> I am facing a problem when I bring one end of the tunnel down( ipsec auto<br>
> --down 'tunnel name' followed by ipsec auto --delete 'tunnel name' ).<br>
<br>
</div>Using --down *informs* the other end that the tunnel is going down. it<br>
is not the same as crashing or unplugging the machine.</blockquote><div>So, I understand that dpd is not involved when --down is used, but in case of crashing or unplugging the machine,<br>the remote end detects that the tunnel is down thro dpd.<br>
Thanks for clarifying. <br></div><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>
<div class="Ih2E3d"><br>
> The tunnel is obviously not established because there is no line containing<br>
> "IPsec SA established" anywhere in the output of ipsec auto --status.<br>
<br>
</div>It will also not be able to re-establish, since you --delete'ed the<br>
connection.</blockquote><div>Sorry, I was not clear. I was looking at the logs on the other machine, lets call it B( i.e not the machine<br>where I --delete'ed the connection ). On B, it looks like the IPSec SA was deleted but the ISAKMP SA is still<br>
not deleted.<br></div><font color="#888888"></font><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><font color="#888888"><br>
Paul<br>
</font></blockquote></div><br>