Re: [PATCH 1/2] ipsec: Add script to ensure VPNs are always on

[Tom Rymes <trymes@rymes.com>]

[-- Attachment #1: Type: text/plain, Size: 1149 bytes --]

On 02/05/2020 12:22 PM, Michael Tremer wrote:
> Hi,
> 
>> On 5 Feb 2020, at 17:19, Tom Rymes <trymes(a)rymes.com> wrote:

[snip]

>> OK, I see what you mean. May I suggest that we eliminate the distinction between "Always-On" and "On Demand" and just retain the time limit for inactivity? Tunnels set to have a limited time before being shut down to inactivity shouldn't be brought back up by the script and those that do not should be.
> 
> That would still change one more thing. We would then decide to always keep all tunnels up. I am not sure if that has any disadvantages for anyone really. But we would definitely have to drop the timeout, too, because otherwise the tunnel will be brought down and the script will bring it back up again shortly after.

Sorry for being unclear. There are currently eight options for 
"Inactivity Timeout", including "Unlimited". I would propose that the 
script you are adding should only bring back up tunnels whose Inactivity 
Timeout is set to "Unlimited". A tunnel with a timeout of one hour would 
time out, go down, and then the script should ignore it.

Does that make sense?

Tom