[Openswan Users] RE: DPD
shilang at greenpacket.com
Thu Aug 10 05:36:52 EDT 2006
Thanks very much for the explanation.
If Site-to-site VPN, one site is behind NAT and if NAT changes the public IP
for that site mapping, or this site is located in the PPPoE dial-up case.
The dpdaction should be which one?
From: Paul Wouters [mailto:paul at xelerance.com]
Sent: Thursday, August 10, 2006 10:23 AM
To: Shi Lang
Cc: users at openswan.org
Subject: RE: DPD
On Thu, 10 Aug 2006, Shi Lang wrote:
> Both sites, I set auto=start, dpdaction I set both = clear or hold before,
> none of them works when I unplug the cable and wait for the timeout 120s,
> re-plugin, won't be re-established.
> dpdaction=restart I did not try it, you mean for unplug cable case I need
> use the restart for dpdaction? In which situation restart is needed to be
> used? Thanks
>From the man page:
dpdaction When a DPD enabled peer is declared dead, what
should be taken. hold (default) means the eroute will
put into %hold status, while clear means the eroute
SA with both be cleared. dpdaction=clear is really
usefull on the server of a Road Warrior config.
And the man page is missing dpdaction=restart, which means to try and bring
the connection up again. hold is used to passively prevent packets from
sent to the now broken tunnel. clear is used for roadwarriors, and basically
"forgets" all the information about the IP address that had the tunnel that
> I found a typo mistake in README.DPD file (openswan-2.4.6): (
> The original:
> There are two dpdaction there, should be dydaction, dpddelay and
More information about the Users