summaryrefslogtreecommitdiff
path: root/docs/configuration/vpn/ipsec.rst
diff options
context:
space:
mode:
authorRobert Göhler <github@ghlr.de>2024-01-25 15:19:04 +0100
committerGitHub <noreply@github.com>2024-01-25 15:19:04 +0100
commit7d34dafb63d9746fb42c7e68f94dd716f2e7eba4 (patch)
treef7ba92c9a7ab456be371054581421a7f42b4ac69 /docs/configuration/vpn/ipsec.rst
parent7b23beeb3c3aea849f3663cf5dadbfeccb0c3029 (diff)
parent3c6bb1ec30319703ae96347369cd594077c4628a (diff)
downloadvyos-documentation-7d34dafb63d9746fb42c7e68f94dd716f2e7eba4.tar.gz
vyos-documentation-7d34dafb63d9746fb42c7e68f94dd716f2e7eba4.zip
Merge pull request #1253 from vyos/mergify/bp/sagitta/pr-1249
Updated DPD and close-action values in IPSEC (backport #1249)
Diffstat (limited to 'docs/configuration/vpn/ipsec.rst')
-rw-r--r--docs/configuration/vpn/ipsec.rst12
1 files changed, 7 insertions, 5 deletions
diff --git a/docs/configuration/vpn/ipsec.rst b/docs/configuration/vpn/ipsec.rst
index 31d4adc3..f0c6c723 100644
--- a/docs/configuration/vpn/ipsec.rst
+++ b/docs/configuration/vpn/ipsec.rst
@@ -49,9 +49,9 @@ VyOS IKE group has the next options:
* ``none`` set action to none (default);
- * ``hold`` set action to hold;
+ * ``trap`` installs a trap policy for the CHILD_SA;
- * ``restart`` set action to restart;
+ * ``start`` tries to immediately re-create the CHILD_SA;
* ``dead-peer-detection`` controls the use of the Dead Peer Detection protocol
(DPD, RFC 3706) where R_U_THERE notification messages (IKEv1) or empty
@@ -60,11 +60,13 @@ VyOS IKE group has the next options:
* ``action`` keep-alive failure action:
- * ``hold`` set action to hold (default)
+ * ``trap`` installs a trap policy, which will catch matching traffic
+ and tries to re-negotiate the tunnel on-demand;
- * ``clear`` set action to clear;
+ * ``clear`` closes the CHILD_SA and does not take further action (default);
- * ``restart`` set action to restart;
+ * ``restart`` immediately tries to re-negotiate the CHILD_SA
+ under a fresh IKE_SA;
* ``interval`` keep-alive interval in seconds <2-86400> (default 30);