Hi I have two sites connected to each other where both sites have dynamic addresses. With auto=route, dpdaction=clear/restart and gre-tunnel established between the left/right subnets sending OSPF HELLO frequently the tunnel have been very robust and instantly self healing if either end goes down.
But a couple of days ago I got a new issue. The WAN IP on one of the sites changed, and the installed route traps didn't fire as the IPs in the ipsec policy now was wrong. This was with dpdaction=clear on both ends. I have a couple of questions: - Would dpdaction=restart look up the dyndns address again if this happens while the tunnel is up? - What if the IP-address changes after significant downtime somewhere in the WAN-network, so long that dpd gives up (is that after 5 retries?)? Is there some other way to update the installed route traps in the ipsec policy or set some refreshinterval for DNS-lookup without ipsec restart, which in this case would mean a separate script. Regards, Hans-Kristian Bakke
_______________________________________________ Users mailing list [email protected] https://lists.strongswan.org/mailman/listinfo/users
