DPD action values are outdated.

vyos@vyos# set vpn ipsec ike-group IKE-HUB dead-peer-detection action
Possible completions:
   hold                 Attempt to re-negotiate the connection when matching traffic is seen
   clear                Remove the connection immediately
   restart              Attempt to re-negotiate the connection immediately

but in strongswan documentation
https://docs.strongswan.org/docs/5.9/swanctl/swanctlConf.html

child>.dpd_action

Action to perform for this CHILD_SA on DPD timeout. The default clear closes the CHILD_SA and does not take further action. trap installs a trap policy, which will catch matching traffic and tries to re-negotiate the tunnel on-demand (note that this is redundant if start_action includes trap. restart immediately tries to re-negotiate the CHILD_SA under a fresh IKE_SA.