(racoon 839) Re: Problems with racoon and generate_policy on

Joerg Platte wrote:
> Hi!
>  
> I have a problem using linux kernel 2.6 and racoon 0.3.3 in a roadwarrior 
> setup. The server is configured to generate the policy for the roadwarrior 
> using "generate_policy on;". This works as expected for the first time. The 
> lifetimes for the ISAKMP-SA is one minute and for the IPsec-SA 5 minutes (for 
> testing purposes).
>  
> After approx. 4 minutes both a new ISAKMP-SA and a new IPsec-SA are 
> negotiated. But racoon does not generate a new or update the old policy. 
> Therefore, the policy is deleted with the old and no longer valid IPsec-SA. 
> This results in NO policy on the server and therefore a secure connection is 
> no longer possible.
>  
> How can I configure racoon to generate either a persistant policy or to alter 
> the lifetime of the existing policy?

Lifetime of generated policy is equal to lifetime of SA negotiated 
(which in your case should be aproximately 4 minutes).

If you want solution, look at (racoon 631). With patch there your 
generated policies will be regenerated.