Allied Telesis RAPIER I - Manual (Page 170)

170 Enhancements to IPsec/VPN Release Note
Software Version 2.8.1
C613-10477-00 REV B
This feature provides an alternative to using heartbeat exchanges. Heartbeat
exchanges are more robust under denial of service attacks, and may be able to
detect the problem before any network traffic is lost; however heartbeat
exchanges may be incompatible with some third party equipment.
Command Changes
The following table summarises the modified commands:
Modifying the Message Retransmission Delay
This Software Version adds a new message retransmission option for ISAKMP
policies, by adding a new msgbackoff parameter. This provides a choice of
back-off patterns for ISAKMP policies which are configured to retransmit
messages.
■ When incremental is specified, the delay between retransmissions
increases in a linear manner, by twice the value set by the msgtimeout
parameter. That is, every retransmitted message is delayed by the last
delay time plus twice the msgtimeout value.
■ When none is specified, the delay between retransmissions is static. All
retransmissions are sent after the delay specified by the msgtimeout
parameter.
The default for the parameter is incremental. To set a back-off pattern for
ISAKMP messages, use the msgbackoff parameter in the commands:
create isakmp policy=name peer={ipv4add|ipv6add|any}
[msgbackoff={incremental|none}] [msgretrylimit=0..1024]
[msgtimeout=1..86400] [other parameters]
set isakmp policy=name [msgbackoff={incremental|none}]
[msgretrylimit=0..1024] [msgtimeout=1..86400]
[other parameters]
The default value for the msgretrylimit is now 8, and the default for the
msgtimeout
limit is now 4. ISAKMP policies created without changing the
defaults for these three parameters will have this message retransmission
pattern:
1. The router or switch sends the initial message.
2. The router or switch retransmits the message 4 seconds later.
3. If a second retransmission is needed, this occurs 8 seconds (twice the value
set by the msgtimeout parameter) after the first retransmission.
Command Change
create ipsec policy New respondbadspi parameter.
set ipsec policy New respondbadspi parameter.
show ipsec policy New Respond Bad SPI parameter in the output for a
specific policy.
show ipsec policy counter New inBadSpiResponse parameter in output.
show isakmp counters New badSpiRequests, badSpiFromKnownPeer,
badSpiInAggrMode, badSpiSendNotifyUnset
parameters in output when counters is set to general.