Re: Difference between isakmp keepalive and invalid-spi-recovery
keepalive is used for detection; while invalid spi recovery is one of the ways to fix up a vpn black hole.
with keepalive enabled, the router/pix will be able to determine whether the vpn peer is still alive or not. in case the peer doesn't respond for a certain period of time, then the router/pix will decide to remove the vpn being created.
in case there was some sort of interruption of the internet link, the vpn peer will still consider that the "old" vpn is up; whereas the local device would have no vpn as keepalive suggested. what would happen next is that the peer will keep sending traffic via the "old" vpn; while the local device will try to initiate a "new" vpn. this is when the feature invalid spi recovery get involved.
with invalid spi recovery, the router/pix will be able to notify the peer in order to trash the old vpn , and create a new vpn at the same time.
i guess they work together, not overlapping each other.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...