MOPO and the 'ping' probes

As Paul asked for new voices during yesterday meeting... ;-)

I just wonder using 'ping' to test the reachability of a peer is correct. 

Pings will give a good indication in 95% of the use cases, but, due to ICMP rate limiting (to prevent DoS), due some security policy (denying ICMP or IPsec over UDP), ... there will be a disconnect in a couple of use cases between a ping exchange and an IKEv2 exchange.

In some cases, ping will go back and forth the peers while IKEv2 won't.

In some other cases, ping will not go back and forth the peers while IKEv2 will.

In short, use out-of-IKE probes only as a very rough estimate.

Hope this helps

-eric