Using bits of script from this thread and Greg Sowell’s tutorial and examples, I have a Tik with a DynDNS WAN and IPsec tunnels with DynDNs entries for both SA-Src and SA-Dst in each tunnel pointed back at the TIK
In the Tik scripts here,there is an IF , Then, Else portion for the Tik’s WAN …if no updated is needed after resolve, no action taken…and I use that for this Tik, even though it probably wont ever get another address…but just in case, its there.
I need close to the same thing for this code…
I am resolving both the local and the remote dyndns for each tunnel via a scheduled script every ten minutes and updating the policy and peer for each tunnel…in order.
Works great…but, every time it resolves, even if it gets the same result, it updates the peer and policy to every tunnel, resulting in new SA’s i.e. tunnel setup. Every ten minutes.
I need to resolve every ten minutes because I am checking for an address change on failover at those tunnel ends.
So, can a fetch..check a variable, change if necessary script , if not leave alone script be written for each tunnel’s local and remote site dyndns?
I think I am close, but a push in the right direction would be appreciated.
I am resolving the local site with a different variable for the same ip address for each tunnel …it may not be needed, but it worked. It populates the peers and policies perfectly for all 20 tunnnels.
I would just like to change the tunnel ip addresses only when needed by a change after resolve.
add name="Tunnel 0" policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \
source=":global LocalSite [:resolve x1.dyndns.org]\r\
\n:global RemoteSite0 [:resolve y1.dyndns.org]\r\
\n/ip ipsec policy set 0 sa-dst-address=\$RemoteSite0 sa-src-address=\$Loc\
alSite \r\
\n/ip ipsec peer set 0 address=\$RemoteSite0"
add name="Tunnel 1" policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \
source=":global LocalSite1 [:resolve x1.dyndns.org]\r\
\n:global RemoteSite1 [:resolve y2.dyndns.org]\r\
\n/ip ipsec policy set 1 sa-dst-address=\$RemoteSite1 sa-src-address=\$Loc\
alSite1 \r\
\n/ip ipsec peer set 1 address=\$RemoteSite1\r\
\n"
add name="Tunnel 2" policy=\
ftp,reboot,read,write,policy,test,winbox,password,sniff,sensitive,api \
source=":global LocalSite2 [:resolve x1.dyndns.org]\r\
\n:global RemoteSite2 [:resolve y3.dyndns.org]\r\
\n/ip ipsec policy set 2 sa-dst-address=\$RemoteSite2 sa-src-address=\$Loc\
alSite2\r\
\n/ip ipsec peer set 2 address=\$RemoteSite2\r\
\n"
