RE: RE: issue 34 -- ESP vs. IKE based NAT reboot detection

Stephane Beaulieu \(stephane\) writes:
> DPD's are only sent *if* one suspects that the peer is no longer
> receiving pkts.  What we've seen in the real world is that in a span of

Actually no, it is sent if you suspect the other peer is dead, and you
might suspect it being dead because multiple reasons. One reason is
the lack of packets from the other end. Another reason might be the
ICMP message or some other indication from the network.

So if you suspect the other peer is dead, you test it with DPD packet.
This handling is identical with normal IKEv2, and NAT-T, and both
alternative 1 and 3.

The only difference is that in alternative 3 you notice NAT box
booting (or NAT mapping disappearing) by the lack of packets from the
other end. I.e. you notice that you are not getting any responses back
thus you start DPD as normally, and with this DPD you also request the
other end to make sure that the IP address and port number the other
peer is using matches the ones in the NAT mapping.

> a 24 hour VPN RA connection, you'll probably only see about 20-100 DPD
> messages (which are usually clustered in groups during high web-usage
> times).

If there is traffic going on in both directions then you do not ever
see DPD packets. You only see DPD packets when you do not receive
packets from the other end (either it being dead or it being idle). 

> So, DPDs are not periodic.

True, the original description was misleading because of that.

> Having said that, I don't see why probes would need to be periodic
> either.  If you suspect the pkts aren't getting to your peer, then send
> the DPD/mobike probe.  Otherwise, don't send anything.  If we can agree
> on this, then I'm OK with probes.

This is the case with alternative 3. I.e. they are not periodic, they
are only sent when the host behind NAT (initiator) detects that it is
not receiving anything from the other end (perhaps because the NAT
reboot or something), and that DPD will then also be used to fix the
NAT mapping in the other peer (i.e. do the similar update that
alternative 1 does for all packets, here we simply explicitly request
the other end to fix the situation).
-- 
[email protected]