1

I am working on a script that can detect if existing IPsec tunnels on a system have gone down. From my observations, I have seen that it can take any where between 1 second to 8 minutes for this to be detected using the command:

netsh ipsec dynamic show mmsas

If the active IPsec policy is unassigned or deleted altogether, the change is reflected immediately, with netsh returning:

IPsec MainMode Security Associations not available.

However, in other cases such as the tunnel endpoint being unreachable or network connectivity failure, it can take as much as 8 minutes for this to be detected via netsh.

I have tried fiddling with idle timeout values and other configuration parameters in the IPsec policy itself, but there seems to be nothing that changes this behaviour. Is there any configuration parameter I can modify in the IPsec policy or within Windows itself to modify this behaviour? My goal is for the script to detect this as quickly as possible.

UPDATE: I have been trying to explore an alternate method where I initiate some interesting traffic and then check for Quick Mode security associations being established. However, this method would be useful only in cases where there is very little interesting traffic being generated on a normal basis.

PS: I had initially posted this question to StackOverflow, which I believe in hindsight was not such a great idea.

0

0

You must log in to answer this question.

Browse other questions tagged .