Re: Dormant Mode?

Bill Sommerfeld wrote:

>In any event, if we create an operating mode in which NAT keepalives are
>no longer sent, then that will, IMHO, be more-or-less equivalent to a
>no-address-mode scheme --- if you suspend NAT keepalives for longer than
>the NAT's idle-session-destruction timer, you'll essentially lose
>incoming connectivity to the side which is behind that NAT it reasserts
>its presence.
>  
>
I'd prefer not to do this. But there may be a way to do
this without losing connectivity. Say, you open up another
UDP-level "connection" through the same pair of addresses,
and start increasing keepalive on that connection; when you
see a port/address change you record the last working keepalive
interval and use half of that as your regular IKE keepalive.
This scheme has a number of drawbacks, including the
assumption that NAT keepalive periods are static and that
it would have to be rerun every time you move. Perhaps
some of the other communities that have a need for NAT
traversal capability have found better solutions. Anyone?

--Jari