Can I recognise dead tunnels and shut them down?
There is no general mechanism to do this is in the IPsec protocols. From time to time, there is discussion on the IETF Working Group mailing list of adding a “keep-alive” mechanism (which some say should be called “make-dead”), but it is a fairly complex problem and no consensus has been reached on whether or how it should be done. The protocol does have optional delete-SA messages which one side can send when it closes a connection in hopes this will cause the other side to do the same. FreeS/WAN does not currently support these. In any case, they would not solve the problem since: • a gateway that crashes or hangs would not send the messages • the sender is not required to send them • they are not authenticated, so any receiver that trusts them leaves itself open to a denial of service attack • the receiver is not required to do anything about them • the receiver cannot acknowledge them; the protocol provides no mechanism for that • since they are not acknowledged, the sender cannot
