<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Yes, but the problem with that approach is that the ping error may be
due to a misconfiguration, it may be due to a routing defect, a
bandwidth overload in the tunnel (i.e. tunnel is up but the ping gets
out-prioritized), it may be due to any of 1000 reasons. Thus, if the
ping fails, you might actually tear down a VPN that's working properly
to try to bring it back up again - i.e. the problem might be with the
ping.<br>
<br>
Thus, in these cases, I'd rather use more VPN-centric methods that will
really trigger action when something is actually wrong with the VPN
(like DPD, for instance). Else, when the ping test fails, I'll have to
perform some fairly elaborate logic to ensure that it is indeed a
condition that I should attempt to re-establish the tunnel under.<br>
<br>
Still, thanks for the advice!<br>
<br>
Cheers!<br>
<br>
Erich Titl wrote:
<blockquote cite="mid:4ACD843B.30705@think.ch" type="cite">
<pre wrap="">Hi
Diego Rivera wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I will do more testing on this on the weekend (when I can dispose of the
systems more freely). Thanks for all your help though!
I'll most certainly make sure to keep you in the loop with whatever I
find - worst case, we'll document for posterity in case others run into
the same hiccup. Best case, we find a cure - and who wouldn't like that? :)
</pre>
</blockquote>
<pre wrap=""><!---->
If everything fails....
I am running FreeSWan/OpenSWan tunnels for a number of years now and had
my share with unreliable tunnels. I had pretty good success to
reestablish failed connections by runnning a script in the background
which periodically checks the connectivity to the peer, actually it
checks the response to an ICMP echo sent to the inside interface of the
remote network. It needed a bit fiddeling with iproute2 but it was worth
the effort. I found it reacted a lot faster than any DPD stuff and did
not depend on its implementation.
cheers
Erich
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<style type="text/css">
p { margin: 0; }
</style>
<div style="font-family: Arial; font-size: 10pt; color: rgb(0, 0, 0);">
<font size="1"> Diego Rivera<br>
Director / System Operations<br>
Roundbox Global : <span
style="font-style: italic; color: rgb(102, 102, 102);">enterprise :
technology : genius</span><br>
------------------------------------------------------------------------------------------------------------------<br>
Avenida 11 y Calle 7-9, Barrio Amón, San José, Costa Rica<br>
tel: +1 (404) 567-5000 ext. 2147 | cel: +(506) 8393-0772 | fax: +(506)
2258-3695<br>
email: <a href="mailto:diego.rivera@rbxglobal.com">diego.rivera@rbxglobal.com</a>
| <a href="http://www.rbxglobal.com">www.rbxglobal.com</a><br>
------------------------------------------------------------------------------------------------------------------<br>
</font> </div>
</div>
</body>
</html>