I can't remember where, but I do recall that in some docs I have read it recommends a small number of re-tries especially for road-warriors. This is because it would be unknown exactly which IP would be at the road-warrior end, so therefore unlimited retries is a waste of bandwidth.
I am testing this under a fixed / (hopefully by the end) dynamic case which is the road-warrior scenario. I agree that for testing a low number should be placed in the template, but I would like to see this user controllable from the UI. Persistent retries is ideal for Andy's standard setup of 2 fixed IPs with a permanent connection. Hugh Fox Sales Director www.drcauto.com drcauto now hosts support newsgroups: news://news.drcauto.com/drcauto.lt_toolkit news://news.drcauto.com/drcauto.smart_architect news://news.drcauto.com/drcauto.accurender_lt The same groups are accessible via your browser, go to: http://discussion.drcauto.com ----- Original Message ----- From: "Andy Worthington" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]>; "Hugh Fox" <[EMAIL PROTECTED]>; "e-smith-devinfo" <[EMAIL PROTECTED]> Sent: Monday, October 22, 2001 4:12 AM Subject: Re: [e-smith-devinfo] [DRAFT] FreeS/WAN rpm + Howto available > > cat /etc/e-smith/templates/etc/ipsec.conf/20Default > > conn %default > > # How persistent to be in (re)keying negotiations (0 means very). > > keyingtries=0 > > # How to authenticate gateways > > authby=rsasig > > > > As you mentioned, maybe the above 20Default entries need changing. > > > > keyingtries= default is '3'. As you mentioned '0' means never give up > > and you have reported appears to cause bad things to happen. Maybe this > > should be '10'. The rpm was previously set '0' so I have left all the > > previous settings intact and only changed those where the file locations > > were incorrect. > > > > >From the Freeswan docs: > > keyingtries > How persistent to be in (re)keying negotiations (0 means very). > For testing, you might wish to set this to some small number, perhaps even > to 1, to avoid wasting resources on incorrectly set up connections. In > production, it is often set to zero (retry forever). Keeping the connection > up is what machine resources are for, so if a connection is down you night > as well waste resources retrying as waste them by sitting idle. Of course > some caution should be exercised with this, since it can waste network > resources as well. > > > If you are testing this, as it says you might want to change it but if this > is in production use you will want the 0 set so it always tries to maintain > the connection so it is always up. > > Andy Worthington > > > -- > Please report bugs to [EMAIL PROTECTED] > Please mail [EMAIL PROTECTED] (only) to discuss security issues > Support for registered customers and partners to [EMAIL PROTECTED] > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > Archives by mail and http://www.mail-archive.com/devinfo%40lists.e-smith.org > > -- Please report bugs to [EMAIL PROTECTED] Please mail [EMAIL PROTECTED] (only) to discuss security issues Support for registered customers and partners to [EMAIL PROTECTED] To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] Archives by mail and http://www.mail-archive.com/devinfo%40lists.e-smith.org
