On Sat, 2 Jul 2016, Paul Wouters wrote:
Clearly we should be consistent independent of IKE version.
It all depends on what the meaning of auto=add with an ipsec auto --up
really means. Is this the same as "auto=start" meaning "always try to
keep this up"? If so, if the other end sends a delete, shouldn't we
immediately establish a new IKE SA, instead of waiting one minute?
And if the auto=add side sends an ipsec auto --down, does that mean it
will accept a request to immediately go up? That would also be weird.
So, I'm open for input :)
strongswan always deletes both IKE and IPsec SA's (with auto=add and
auto=start), meaning the endpoint configured with auto=start can be "shut
down" by the other endpoint. I do not think that is the correct behaviour.
Paul
_______________________________________________
Swan-dev mailing list
[email protected]
https://lists.libreswan.org/mailman/listinfo/swan-dev
