if a customer wants to monitor an IPSec-based site-to-site VPN and basically no incoming traffic is needed, would you recommend:
a) setting up a permanent tunnel that can be monitored all the time and blocking all incoming traffic
b) setting up a non-permanent tunnel (e.g. traffic to IPs of the encryption domain is needed to bring the tunnel up) and allow incoming ICMP-traffic from one host to one host in order to allow the customer to bring the tunnel up?
What are the advantages/disadvantages of this from a security perspective?
Best Regards