Enabling DPD traffic even when there is a traffic from peer

[piddalagi]

Dear Team,

I have some use-case where I want to send keep-alive traffic periodically even when there is traffic being received from peer. Is it possible in strongswan to achieve that?

[tobiasbrunner]

keep-alive traffic

What kind of keep-alive traffic are you referring to exactly? And what's the use case?

Is it possible in strongswan to achieve that?

No, NAT keepalives and DPDs are both not sent if there is traffic (outbound or inbound, respectively). You might want to consider sending regular traffic through the actual tunnel(s) (e.g. ping some remote host).

[piddalagi]

Thanks for the insight.
Shall I know why the packet INFORMATIONAL goes unencrypted?

[tobiasbrunner]

What do you mean?

[piddalagi]

I have stopped all traffic from both left and right devices on which IPSec is configured, because I wanted to see the keepalive traffic after DPD delay.
I was thinking that these packets will also be tunneled. So wanted to know why they are not tunneled?

18:45:01.147489 IP 10.0.1.1.4500 > 20.0.1.2.4500: NONESP-encap: isakmp: child_sa inf2
18:45:01.149583 IP 20.0.1.2.4500 > 10.0.1.1.4500: NONESP-encap: isakmp: child_sa inf2[I]
18:45:01.150869 IP 10.0.1.1.4500 > 20.0.1.2.4500: NONESP-encap: isakmp: child_sa inf2[R]
18:45:01.150916 IP 20.0.1.2.4500 > 10.0.1.1.4500: NONESP-encap: isakmp: child_sa inf2[IR]

[tobiasbrunner]

As I already wrote above, the DPDs are IKE packets exchanged between the IKE daemons. Encrypted and authenticated, but not sent through an IPsec SA, as there might not even be one.

[piddalagi]

Tobi, thank you for the information. We can close this discussion thread.