[strongSwan] How to overcome the dpd re-transmission task for IKE_DELETE task?
nandanator at gmail.com
Mon Jul 21 14:38:33 CEST 2014
Thank you for your response.
What are the pro's and con's of introducing such immediate delete of IKE_SA?
On Mon, Jul 21, 2014 at 3:24 PM, Martin Willi <martin at strongswan.org> wrote:
> > Is there any other way to administratively shutdown the connection
> > using IKE_DELETE, overriding the dpd re-transmission task?
> "ipsec down" tries to gracefully close the tunnel, sending a DELETE
> message. As there is a DPD exchange in progress, with IKEv2 and a window
> size == 1, that message has to be queued.
> One could just remove the IKE_SA state without notification, but this is
> not what "ipsec down" does. Unfortunately, there is currently no
> mechanism to immediately delete such an IKE_SA.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Users