Skip to content

Commit ef42918

Browse files
committed
VPN: IPsec: Advanced Settings - add some notes about dpd responsiveness, referring the upcoming charon options in the ipsec advanced settings
source: * https://docs.strongswan.org/docs/5.9/config/retransmission.html * https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html [dpd_timeout]
1 parent 0161ace commit ef42918

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

source/manual/vpnet.rst

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,16 @@ When a peer is assumed dead, an action may be specified, such as closing the CHI
202202
DPD is disabled by default, when using connections, make sure to specify a :code:`DPD delay (s)` > 0 to enable the feature.
203203
Actions may be specified on its children.
204204

205+
When using IKEv1 a :code:`dpdtimeout` can be specified to control when a peer is considered to be inaccesible.
206+
This setting has no effect on how IKEv2 handles retransmissions, in which case the general settings will be used as specified in the following `document <https://docs.strongswan.org/docs/5.9/config/retransmission.html>`__.
207+
208+
.. Warning::
209+
210+
By default for IKEv2 the timeout on connections triggering a dpd action takes at least a couple of minutes, when quicker interaction
211+
is needed the :code:`charon` retransmit timings should be changed which applies to all tunnels. These settings can
212+
be changed via the Advanced settings or when not yet supported on your version, a custom strongswan configuration.
213+
214+
205215

206216
.................................
207217
Implementation schemes

0 commit comments

Comments
 (0)