Scribd
Upload
282 views1 page

Mikrotik IPSec VPN FailOver Script

This document discusses configuring automatic IPSec VPN failover on a router. It includes an example script that uses ping tests and IPsec policy disabling/enabling to fail over between a primary and secondary VPN if the primary connection fails. It also provides instructions on setting up a scheduler to periodically run the script to enable automatic failover. The configuration was implemented successfully in a lab environment.

Uploaded by

Sarwar Murshed
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
282 views1 page

Mikrotik IPSec VPN FailOver Script

This document discusses configuring automatic IPSec VPN failover on a router. It includes an example script that uses ping tests and IPsec policy disabling/enabling to fail over between a primary and secondary VPN if the primary connection fails. It also provides instructions on setting up a scheduler to periodically run the script to enable automatic failover. The configuration was implemented successfully in a lab environment.

Uploaded by

Sarwar Murshed
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 1

Hi Dear,

According to this topology, I applied an script in RouterA and it works.

IPSecVPNFailOver.png (115.35 KiB) Viewed 92 times


IPSec VPN config in RouterA, it´s important the ID of the IPSec Policy (0 and 1 in this
example).

IPSecConfig.png (16.23 KiB) Viewed 92 times


The next script is for automatic IPSec VPN failover.
{
:local PrimaryPolicy 0
:local SecondaryPolicy 1

:local PrimaryOK [:ping count=3 src-address=172.16.11.2 8.8.8.8];


:local SecondaryOK [:ping count=3 src-address=172.16.12.2 8.8.8.8];

:if ($PrimaryOK<3 and $SecondaryOK=3) do={


/ip ipsec policy disable $PrimaryPolicy;
/ip ipsec policy enable $SecondaryPolicy;
}
:if ($PrimaryOK=3) do={
/ip ipsec policy disable $SecondaryPolicy;
/ip ipsec policy enable $PrimaryPolicy;
}
}

Optionally, to run this script you can create a scheduler and customize a timer (This script has ID
0).

/system scheduler
add interval=10s name=RunScript on-event="system script run 0" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=may/31/2019 start-time=08:04:19

I implemented this in a laboratory and it works successfully.

You might also like

pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy