RE: New issue 16: No packets from other end?

[email protected] writes:
> I agree we should try to recover from as many failures/changes
> as possible without making the protocol unreasonably complex. I
> think use of keepalives, which are needed anyway, for this purpose
> should not make the protocol any more complex than it already is.

Note, that NAT-T keepalives are not authenticated, and MUST NOT be
used to any other purpose than to keep the NAT mapping up. They MUST
NOT be used to give any indication whether the other end is up or not.
The sender of the keepalives, can stop sending them at any time, if it
detects that NAT does not need them, or it can put the TTL low enough
so that they never reach the final IKE destination, but do go through
the NAT. And the sender do not send keepalives if it has sent any ESP
packets lately to the other end, i.e the ESP packets also acts as
keepalives, the specific keepalive packets are only used if there is
no other traffic going through. 
-- 
[email protected]