Script to reset IPSec peer


#1

Hi, I have noticed that for some reason when a GRE/IPSec tunnel between my VyOS 1.1.8 and Mikrotik router is interrupted, the ph2 does not want to re-establish. I do not yet know the cause but I know for a fact that resetting the IPSec peer on the VyOS side, immediately resolves the issue (resetting the peer on the Mikrotik side does not resolve the issue).

Is there a way (until have found a configuration / bug fix) to configure a script on the VyOS side to automatically perform a reset vpn ipsec-peer x.x.x.x when a sh vpn ipsec sa peer state changes to down (or at least run it on a timer)? Thanks


#2

Make a script like this where 1.2.3.4 is the source interface to poll the distant end, and 192.168.1.1 is the address to poll on the distant end. May need some syntax tweaks on the ping depending on your setup. Make sure to make the script executable with chmod.

Then add system task scheduler commands to run at intervals:

set system task-scheduler task vpncheck executable path ‘/config/scripts/vpncheck.sh’
set system task-scheduler task vpncheck interval ‘10m’


vpncheck.sh


#!/bin/bash

/bin/ping -c 3 -W 2 -I 1.2.3.4 192.168.1.1 1>/dev/null 2>&1

if [ $? -ne 0 ]; then
echo “Failed”
/bin/vbash -ic ‘restart vpn’
fi



#3

Thank you for the reply - I will give it a try