Sorry to appear sooooo inept, but could Andy or Darrell (or someone else <G> ) please let me know the commands to restart IPSec with new/amended template fragments.
Ta, Hugh Fox Sales Director www.drcauto.com drcauto now hosts support newsgroups: news://news.drcauto.com/drcauto.lt_toolkit news://news.drcauto.com/drcauto.smart_architect news://news.drcauto.com/drcauto.accurender_lt The same groups are accessible via your browser, go to: http://discussion.drcauto.com ----- Original Message ----- From: "Hugh Fox" <[EMAIL PROTECTED]> To: "Andy Worthington" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]>; "e-smith-devinfo" <[EMAIL PROTECTED]> Sent: Monday, October 22, 2001 9:08 AM Subject: Re: [e-smith-devinfo] [DRAFT] FreeS/WAN rpm + Howto available > I can't remember where, but I do recall that in some docs I have read it > recommends a small number of re-tries especially for road-warriors. > This is because it would be unknown exactly which IP would be at the > road-warrior end, so therefore unlimited retries is a waste of bandwidth. > > I am testing this under a fixed / (hopefully by the end) dynamic case which > is the road-warrior scenario. > > I agree that for testing a low number should be placed in the template, but > I would like to see this user controllable from the UI. > > Persistent retries is ideal for Andy's standard setup of 2 fixed IPs with a > permanent connection. > > Hugh Fox > Sales Director > www.drcauto.com > > drcauto now hosts support newsgroups: > news://news.drcauto.com/drcauto.lt_toolkit > news://news.drcauto.com/drcauto.smart_architect > news://news.drcauto.com/drcauto.accurender_lt > The same groups are accessible via your browser, go to: > http://discussion.drcauto.com > > > ----- Original Message ----- > From: "Andy Worthington" <[EMAIL PROTECTED]> > To: <[EMAIL PROTECTED]>; "Hugh Fox" <[EMAIL PROTECTED]>; > "e-smith-devinfo" <[EMAIL PROTECTED]> > Sent: Monday, October 22, 2001 4:12 AM > Subject: Re: [e-smith-devinfo] [DRAFT] FreeS/WAN rpm + Howto available > > > > > cat /etc/e-smith/templates/etc/ipsec.conf/20Default > > > conn %default > > > # How persistent to be in (re)keying negotiations (0 means > very). > > > keyingtries=0 > > > # How to authenticate gateways > > > authby=rsasig > > > > > > As you mentioned, maybe the above 20Default entries need changing. > > > > > > keyingtries= default is '3'. As you mentioned '0' means never give up > > > and you have reported appears to cause bad things to happen. Maybe this > > > should be '10'. The rpm was previously set '0' so I have left all the > > > previous settings intact and only changed those where the file locations > > > were incorrect. > > > > > > > >From the Freeswan docs: > > > > keyingtries > > How persistent to be in (re)keying negotiations (0 means very). > > For testing, you might wish to set this to some small number, perhaps even > > to 1, to avoid wasting resources on incorrectly set up connections. In > > production, it is often set to zero (retry forever). Keeping the > connection > > up is what machine resources are for, so if a connection is down you night > > as well waste resources retrying as waste them by sitting idle. Of course > > some caution should be exercised with this, since it can waste network > > resources as well. > > > > > > If you are testing this, as it says you might want to change it but if > this > > is in production use you will want the 0 set so it always tries to > maintain > > the connection so it is always up. > > > > Andy Worthington > > > > > > -- > > Please report bugs to [EMAIL PROTECTED] > > Please mail [EMAIL PROTECTED] (only) to discuss security issues > > Support for registered customers and partners to [EMAIL PROTECTED] > > To unsubscribe, e-mail: [EMAIL PROTECTED] > > For additional commands, e-mail: [EMAIL PROTECTED] > > Archives by mail and > http://www.mail-archive.com/devinfo%40lists.e-smith.org > > > > > > > -- > Please report bugs to [EMAIL PROTECTED] > Please mail [EMAIL PROTECTED] (only) to discuss security issues > Support for registered customers and partners to [EMAIL PROTECTED] > To unsubscribe, e-mail: [EMAIL PROTECTED] > For additional commands, e-mail: [EMAIL PROTECTED] > Archives by mail and http://www.mail-archive.com/devinfo%40lists.e-smith.org > > -- Please report bugs to [EMAIL PROTECTED] Please mail [EMAIL PROTECTED] (only) to discuss security issues Support for registered customers and partners to [EMAIL PROTECTED] To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] Archives by mail and http://www.mail-archive.com/devinfo%40lists.e-smith.org
