diff options
Diffstat (limited to 'testing/tests/ikev1/dpd-restart/description.txt')
| -rw-r--r-- | testing/tests/ikev1/dpd-restart/description.txt | 20 |
1 files changed, 7 insertions, 13 deletions
diff --git a/testing/tests/ikev1/dpd-restart/description.txt b/testing/tests/ikev1/dpd-restart/description.txt index 0a309cf52..410d3d636 100644 --- a/testing/tests/ikev1/dpd-restart/description.txt +++ b/testing/tests/ikev1/dpd-restart/description.txt @@ -1,13 +1,7 @@ -The peer <b>carol</b> and <b>moon</b> both have dynamic IP addresses, so that the remote end -is defined symbolically by <b>right=%<hostname></b>. The ipsec starter resolves the -fully-qualified hostname into the current IP address via a DNS lookup (simulated by an -/etc/hosts entry). Since the peer IP addresses are expected to change over time, the option -<b>rightallowany=yes</b> will allow an IKE main mode rekeying to arrive from an arbitrary -IP address under the condition that the peer identity remains unchanged. When this happens -the old tunnel is replaced by an IPsec connection to the new origin. -<p> -In this scenario <b>moon</b> first initiates a tunnel to <b>carol</b>. After some time -the responder <b>carol</b> disconnects (simulated by iptables blocking IKE and ESP traffic). -<b>moon</b> detects via Dead Peer Detection (DPD) that the connection is down and tries to -reconnect. After a few seconds the firewall is opened again and the connection is -reestablished. +The roadwarrior <b>carol</b> sets up an IPsec tunnel connection to the gateway +<b>moon</b>. Both end points activate <b>Dead Peer Detection</b> (DPD) with a +polling interval of 10 s. When the network connectivity between <b>carol</b> +and <b>moon</b> is forcefully disrupted for a duration of 100 s, <b>moon</b> +clears the connection after 4 unsuccessful retransmits whereas <b>carol</b> +also takes down the connection but immediately tries to reconnect which succeeds +as soon as the connection becomes available again. |