Re: Dormant Mode?

Jari,

> I'd prefer not to do this. But there may be a way to do
> this without losing connectivity. Say, you open up another
> UDP-level "connection" through the same pair of addresses,
> and start increasing keepalive on that connection; when you
> see a port/address change you record the last working keepalive
> interval and use half of that as your regular IKE keepalive.
> This scheme has a number of drawbacks, including the
> assumption that NAT keepalive periods are static and that
> it would have to be rerun every time you move. Perhaps
> some of the other communities that have a need for NAT
> traversal capability have found better solutions. Anyone?
>

This sounds like an acceptable way to estimate the NAT timeout, but I think 
it should probably be incorporated into STUN or something like that. It 
would be far better if the host could just ask the NAT what its timeout is, 
but we're not there yet.

It won't solve the problem of dormant mode hosts, though. If the keepalive 
originates at the VPN gateway, it will wake the host up. It has to somehow 
originate on the host side.

            jak