Version 4.1.5¶
- If a DNS lookup failure occurs when resolving right=%<FQDN>
or right=<FQDN> combined with rightallowany=yes then the
connection is not updated by ipsec starter thus preventing
the disruption of an active IPsec connection. Only if the DNS
lookup successfully returns with a changed IP address the
corresponding connection definition is updated.
- Routes installed by the keying daemons are now in a separate
routing table with the ID 100 to avoid conflicts with the main
table. Route lookup for IKEv2 traffic is done in userspace to ignore
routes installed for IPsec, as IKE traffic shouldn't get encapsulated.