vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

ipsec_closeaction: added recommendation for closeaction options

Browse Source 
Added VPN IPSec connection-type recommendation for the close-action and
dpd settings.
For example close-action restart should not be added on both peers
This commit is contained in:
srividya0208 2022-12-22 01:06:10 -05:00
parent aade883e24
commit b6b86f1946
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
docs/_static/images/IPSec_close_action_settings.jpg vendored Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 61 KiB

19
docs/configuration/vpn/site2site_ipsec.rst
View File

@ -353,7 +353,7 @@ Key Parameters:
* ``dead-peer-detection action = clear | hold | restart`` - R_U_THERE
notification messages(IKEv1) or empty INFORMATIONAL messages (IKEv2)
are periodically sent in order to check the liveliness of theIPsec peer. The
are periodically sent in order to check the liveliness of the IPsec peer. The
values clear, hold, and restart all activate DPD and determine the action to
perform on a timeout.
With ``clear`` the connection is closed with no further actions taken.
@ -367,6 +367,17 @@ Key Parameters:
values). A closeaction should not be used if the peer uses reauthentication or
uniqueids.
For a responder, close-action or dead-peer-detection must not be enabled.
For an initiator DPD with `restart` action, and `close-action 'restart'`
is recommended in IKE profile.
When the close-action option is set on the peers, the connection-type
of each peer has to considered carefully. For example, if the option is set
on both peers, then both would attempt to initiate and hold open multiple
copies of each child SA. This might lead to instability of the device or
cpu/memory utilization.
Below flow-chart could be a quick reference for the close-action
combination depending on how the peer is configured.
.. image:: /_static/images/IPSec_site-to-site_IKE_configuration.png
:width: 50%
:align: center
Similar combinations are applicable for the dead-peer-detection.