<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I have an IKEv2 conn with one end behind NAT:<br>
Nat'd (remote):<br>
conn nick-ikev2<br>
type=tunnel<br>
authby=secret<br>
auto=start<br>
left=10.20.40.248<br>
leftsourceip=192.168.20.1<br>
leftsubnet=192.168.20.0/24<br>
leftid=@clearos_in_clearvm<br>
right=my.fqdn<br>
rightsubnet=172.17.2.0/24<br>
rightid=@nick<br>
ikev2=insist<br>
dpdaction=restart<br>
dpdtimeout=120<br>
dpddelay=30<br>
<br>
Other (local) end:<br>
conn nick-ikev2<br>
type=tunnel<br>
authby=secret<br>
auto=add<br>
left=%any<br>
#left=209.90.117.194<br>
leftsubnet=192.168.20.0/24<br>
leftid=@clearos_in_clearvm<br>
right=%defaultroute<br>
rightsubnet=172.17.2.0/24<br>
rightsourceip=172.17.2.1<br>
rightid=@nick<br>
ikev2=insist<br>
dpdaction=restart<br>
dpdtimeout=120<br>
dpddelay=30<br>
rekey=no<br>
salifetime=9h<br>
ikelifetime=2h<br>
<br>
The tunnel comes up fine. If I then reload the conn at the local
end, the tunnel does not automatically reconnect until I do an
"ipsec auto --start nick-ikev2" at the remote end. Shouldn't the
tunnel be automatically reconnecting within 2 1/2 minutes (delay +
timeout)? Note it does not matter if left=%any or
left=209.90.117.194 - the results are the same.<br>
<br>
Using tcpdump at the remote end:<br>
tcpdump -nn -i eth0 'host 90.255.224.113 and (port 500 or port
4500)'<br>
<br>
This shows nothing at all, as if no DPD packets are being sent.
Obviously a similar tcpdump at the other end shows nothing being
received.<br>
<br>
Using libreswan-3.25-4.1.el7_6.x86_64.<br>
<br>
Regards,<br>
<br>
Nick<br>
</body>
</html>