Skip to content

Commit f39b256

Browse files
aapostoliukaapostoliuk
andauthored
ipsec: T7504: Added retransmission documentation (#1661)
Added retransmission documentation Co-authored-by: aapostoliuk <aapostoliuk@vyos.io>
1 parent 5507e18 commit f39b256

File tree

1 file changed

+45
-1
lines changed

1 file changed

+45
-1
lines changed

docs/configuration/vpn/ipsec/ipsec_general.rst

Lines changed: 45 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ every configured interval. The remote peer is considered unreachable
106106
if no response to these packets is received within the DPD timeout.
107107
In IKEv2, DPD sends messages every configured interval. If one request
108108
is not responded, Strongswan execute its retransmission algorithm with
109-
its timers. https://docs.strongswan.org/docs/5.9/config/retransmission.html
109+
its timers. `IKEv2 Retransmission`_
110110

111111
*****************
112112
Configuration IKE
@@ -306,3 +306,47 @@ Options
306306
.. cfgcmd:: set vpn ipsec options virtual-ip
307307

308308
Allows the installation of virtual-ip addresses.
309+
310+
IKEv2 Retransmission
311+
====================
312+
313+
If the peer does not respond on DPD packet, the router starts retransmission procedure.
314+
315+
The following formula is used to calculate the timeout:
316+
317+
.. code-block:: none
318+
319+
relative timeout = timeout * base ^ (attempts-1)
320+
321+
.. cfgcmd:: set vpn ipsec options retransmission attempts
322+
323+
Number of attempts before the peer is considered to be in the down state.
324+
Default value is **5**.
325+
326+
.. cfgcmd:: set vpn ipsec options retransmission base
327+
328+
Base number of exponential backoff. Default value is **1.8**.
329+
330+
.. cfgcmd:: set vpn ipsec options retransmission timeout
331+
332+
Timeout in seconds before the first retransmission. Default value is **4**.
333+
334+
Using the default values, packets are retransmitted as follows:
335+
336+
+-----------+-------------+------------------+------------------+
337+
| Attempts | Formula | Relative timeout | Absolute timeout |
338+
+-----------+-------------+------------------+------------------+
339+
| 1 | 4 * 1.8 ^ 0 | 4s | 4s |
340+
+-----------+-------------+------------------+------------------+
341+
| 2 | 4 * 1.8 ^ 1 | 7s | 11s |
342+
+-----------+-------------+------------------+------------------+
343+
| 3 | 4 * 1.8 ^ 2 | 13s | 24s |
344+
+-----------+-------------+------------------+------------------+
345+
| 4 | 4 * 1.8 ^ 3 | 23s | 47s |
346+
+-----------+-------------+------------------+------------------+
347+
| 5 | 4 * 1.8 ^ 4 | 42s | 89s |
348+
+-----------+-------------+------------------+------------------+
349+
| peer down | 4 * 1.8 ^ 5 | 76s | 165s |
350+
+-----------+-------------+------------------+------------------+
351+
352+

0 commit comments

Comments
 (0)