Scribd
Upload
493 views1 page

Mikrotik IPSec VPN FailOver Script

This document discusses configuring automatic IPSec VPN failover on a router. It includes an example script that uses ping tests and IPsec policy disabling/enabling to fail over between a primary and secondary VPN if the primary connection fails. It also provides instructions on setting up a scheduler to periodically run the script to enable automatic failover. The configuration was implemented successfully in a lab environment.

Uploaded by

Sarwar Murshed
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
493 views1 page

Mikrotik IPSec VPN FailOver Script

This document discusses configuring automatic IPSec VPN failover on a router. It includes an example script that uses ping tests and IPsec policy disabling/enabling to fail over between a primary and secondary VPN if the primary connection fails. It also provides instructions on setting up a scheduler to periodically run the script to enable automatic failover. The configuration was implemented successfully in a lab environment.

Uploaded by

Sarwar Murshed
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd

Hi Dear,

According to this topology, I applied an script in RouterA and it works.

[Link] (115.35 KiB) Viewed 92 times


IPSec VPN config in RouterA, it´s important the ID of the IPSec Policy (0 and 1 in this
example).

[Link] (16.23 KiB) Viewed 92 times


The next script is for automatic IPSec VPN failover.
{
:local PrimaryPolicy 0
:local SecondaryPolicy 1

:local PrimaryOK [:ping count=3 src-address=[Link] [Link]];


:local SecondaryOK [:ping count=3 src-address=[Link] [Link]];

:if ($PrimaryOK<3 and $SecondaryOK=3) do={


/ip ipsec policy disable $PrimaryPolicy;
/ip ipsec policy enable $SecondaryPolicy;
}
:if ($PrimaryOK=3) do={
/ip ipsec policy disable $SecondaryPolicy;
/ip ipsec policy enable $PrimaryPolicy;
}
}

Optionally, to run this script you can create a scheduler and customize a timer (This script has ID
0).

/system scheduler
add interval=10s name=RunScript on-event="system script run 0" policy=\
ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon \
start-date=may/31/2019 start-time=[Link]

I implemented this in a laboratory and it works successfully.

You might also like