|
VyOS does not expose the strongSwan `connections.<conn>.unique`
parameter for site-to-site peers. The swanctl default is
`unique = no`, which only replaces existing SAs
if the new one carries `INITIAL_CONTACT`. With `dpd_action = restart`,
charon initiates new IKE_SAs without `INITIAL_CONTACT`,
so duplicates accumulate on every DPD timeout.
Previously the strongSwan `unique` connection policy could only be
driven by the global "disable-uniqreqids" option, which set it to
"never" for every connection. Site-to-site peers had no way to opt
into stricter enforcement on their own.
|
