Project

General

Profile

Actions

Feature #12184

open

Allow user configuration of IKE retransmission

Added by Marcos Mendoza about 2 months ago. Updated about 2 months ago.

Status:
New
Priority:
Normal
Assignee:
-
Category:
IPsec
Target version:
-
Start date:
Due date:
% Done:

0%

Estimated time:
Plus Target Version:
Release Notes:
Default

Description

When using IKEv2, dpd_timeout is ignored and instead the global charon.retransmit_* is used to determine the timeout thresholds of the IKE connection. As is, the timeout can last for several minutes.

The retransmission options should be user-configurable. This would help, for example, in HA failover scenarios where a low retransmission timeout could result in a significantly quicker IPsec reconnection.

https://wiki.strongswan.org/projects/strongswan/wiki/ConnSection
https://wiki.strongswan.org/projects/strongswan/wiki/Retransmission
https://wiki.strongswan.org/projects/strongswan/wiki/Swanctlconf

Related issues:
https://redmine.pfsense.org/issues/5355

Actions #1

Updated by Marcos Mendoza about 2 months ago

The restransmit options could be put under "VPN / IPsec / Advanced Settings".

Actions

Also available in: Atom PDF