<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
I'm running openswan 2.6.22. So which of the dpdaction options should
I use?<br>
<ul>
<li>clear?</li>
<li>restart?</li>
<li>restart_by_peer?</li>
<li>hold?</li>
</ul>
I want whichever one will cause a peer to tear down its KLIPS policies
and actively seek out the other peer(s) to re-establish the connection
regardless of where the fault occurred. Does any of those options do
that? From the docs, it smells like restart is a subset of
restart_by_peer (hence why I chose the latter). If not, then perhaps
the docs should be clarified in this regard.<br>
<br>
At any rate, any suggestions, Paul?<br>
<br>
Cheers.<br>
<br>
<br>
David McCullough wrote:
<blockquote cite="mid:20091007212933.GA4584@securecomputing.com"
type="cite">
<pre wrap="">Jivin Paul Wouters lays it down ...
</pre>
<blockquote type="cite">
<pre wrap="">On Wed, 7 Oct 2009, Diego Rivera wrote:
</pre>
<blockquote type="cite">
<pre wrap="">However, if the tunnel is up and one of the nodes disappears - due to an
outage, machine crash, whatever - then I have a problem that I can't
really find a solution for: the tunnel is dead, but the KLIPS policies
still remain in place.
</pre>
</blockquote>
<pre wrap="">And it prevents plaintext packets from accidentally lekaing out.
</pre>
<blockquote type="cite">
<pre wrap="">The only solution is to manually jump into the box and restart the IPSec
service, forcing the policies to be taken down, to be re-added when the
tunnel is back up. This is manageable, but less than ideal.
My perception of how this should really function is that when the peer
is found to be down (we do have DPD configured on both ends so this
</pre>
</blockquote>
<pre wrap="">DPD should do the trick.
</pre>
<blockquote type="cite">
<pre wrap="">However, this isn't happening and I'm not sure if it's due to
misconfiguration (perhaps I should use dpdaction=clear instead of
restart_by_peer?), or due to a software defect in OpenSWAN. Any
</pre>
</blockquote>
<pre wrap="">restart_by_peer means the equivalent of auto=add. You wait on the other
end to connect. Which should work if your other end would be using DPD,
but if both ends use restart_by_peer, neither end will restart the
connectin.
</pre>
</blockquote>
<pre wrap=""><!---->
That wasn't my impression. It should basically be the same as restart,
except that all tunnels to the same peer will be taken down at the same time
to be restarted. I am fairly sure there is an "initiate" call in the code
path for when this happens. If it doesn't do this I am in trouble :-)
Which version of openswan are you running ?
Cheers,
Davidm
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<style type="text/css">
p { margin: 0; }
</style>
<div style="font-family: Arial; font-size: 10pt; color: rgb(0, 0, 0);">
<font size="1"> Diego Rivera<br>
Director / System Operations<br>
Roundbox Global : <span
style="font-style: italic; color: rgb(102, 102, 102);">enterprise :
technology : genius</span><br>
------------------------------------------------------------------------------------------------------------------<br>
Avenida 11 y Calle 7-9, Barrio Amón, San José, Costa Rica<br>
tel: +1 (404) 567-5000 ext. 2147 | cel: +(506) 8393-0772 | fax: +(506)
2258-3695<br>
email: <a href="mailto:diego.rivera@rbxglobal.com">diego.rivera@rbxglobal.com</a>
| <a href="http://www.rbxglobal.com">www.rbxglobal.com</a><br>
------------------------------------------------------------------------------------------------------------------<br>
</font> </div>
</div>
</body>
</html>