Racoon site-to site

[VANHULLEBUS Yvan]

Hi all.


On Thu, Dec 17, 2009 at 11:01:00AM -0500, Mike Tancsa wrote:
[...]
> Another thing to try is
> sysctl -w net.key.preferred_oldsa=0

Yep, this is how most IPsec devices works and expects peers to work.


> Also, check and make sure you have dpd compiled into 
> ipsectools and make sure enabled.

Yes .... or no: misconfigured, or used in situations with important
loss, DPD can be worst than nothing....

The best would be to first understand the issue, then fix it, and only
after that consider finding useful DPD configuration regarding the
setup....


Yvan.