DPD action values are outdated.
vyos@vyos# set vpn ipsec ike-group IKE-HUB dead-peer-detection action Possible completions: hold Attempt to re-negotiate the connection when matching traffic is seen clear Remove the connection immediately restart Attempt to re-negotiate the connection immediately
but in strongswan documentation
https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html
child>.dpd_action
Action to perform for this CHILD_SA on DPD timeout. The default clear closes the CHILD_SA and does not take further action. trap installs a trap policy, which will catch matching traffic and tries to re-negotiate the tunnel on-demand (note that this is redundant if start_action includes trap. restart immediately tries to re-negotiate the CHILD_SA under a fresh IKE_SA.