vyos/vyos-documentation
1
0
Fork 0
mirror of https://github.com/vyos/vyos-documentation.git synced 2025-10-26 08:41:46 +01:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #908 from srividya0208/close_action

Browse Source 
ipsec_closeaction: added recommendation for closeaction options
This commit is contained in:
Robert Göhler 2022-12-27 21:01:28 +01:00 committed by GitHub
commit c5ee22ef86
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

BIN
docs/_static/images/IPSec_close_action_settings.jpg vendored Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 61 KiB

19
docs/configuration/vpn/site2site_ipsec.rst
View File

@ -353,7 +353,7 @@ Key Parameters:
* ``dead-peer-detection action = clear | hold | restart`` - R_U_THERE * ``dead-peer-detection action = clear | hold | restart`` - R_U_THERE
notification messages(IKEv1) or empty INFORMATIONAL messages (IKEv2) notification messages(IKEv1) or empty INFORMATIONAL messages (IKEv2)
are periodically sent in order to check the liveliness of theIPsec peer. The are periodically sent in order to check the liveliness of the IPsec peer. The
values clear, hold, and restart all activate DPD and determine the action to values clear, hold, and restart all activate DPD and determine the action to
perform on a timeout. perform on a timeout.
With ``clear`` the connection is closed with no further actions taken. With ``clear`` the connection is closed with no further actions taken.
@ -367,6 +367,17 @@ Key Parameters:
values). A closeaction should not be used if the peer uses reauthentication or values). A closeaction should not be used if the peer uses reauthentication or
uniqueids. uniqueids.
For a responder, close-action or dead-peer-detection must not be enabled. When the close-action option is set on the peers, the connection-type
For an initiator DPD with `restart` action, and `close-action 'restart'` of each peer has to considered carefully. For example, if the option is set
is recommended in IKE profile. on both peers, then both would attempt to initiate and hold open multiple
copies of each child SA. This might lead to instability of the device or
cpu/memory utilization.
Below flow-chart could be a quick reference for the close-action
combination depending on how the peer is configured.
.. image:: /_static/images/IPSec_site-to-site_IKE_configuration.png
:width: 50%
:align: center
Similar combinations are applicable for the dead-peer-detection.