I run a configuration with about 30 IPsec peers (site-to-site connections) on one of my RB4011s, with approximately half of them active at any given time, and upon upgrading to 7.23.4 or newer I've started experiencing intermittent problems with IPsec configuration.
First of all, upon upgrade from 7.21.5 to 7.23.7, IPsec configuration section started to time out - empty tabs in IPsec window of WinBox, /ip ipsec peer print timing out with no output, /ip export giving
#error exporting "/ip/ipsec/mode-config" (timeout)
#error exporting "/ip/ipsec/peer" (timeout)
etc. (none of /ip ipsec sections do export, all the other sections exporting without a problem), scripts erroring out on /ip ipsec actions:
2026-10-08 17:57:15 script,warning Removing IPsec connection with multiple SAs for <peer1>-<peer2> S2S
2026-10-08 17:57:15 ipsec,info killing ike2 SA: ipsec-peer-<peer2> (fqdn:(RSA)) <peer1>-<peer2> 3d22aec708e5042b:2f813b8d03faf98e
2026-10-08 17:58:15 script,error executing script from scheduler (sched-manage-S2S-IPIP-over-IPsec) failed, please check it manually
2026-10-08 17:58:15 script,error,debug (scheduler:sched-manage-S2S-IPIP-over-IPsec) action timed out - try again, if error continues contact MikroTik support and send a supout file (13) (/ip/ipsec/active-peers/remove; line 54)
The fist line in the log above is warning the script logs before performing action, the second line is action (it was executed in the particular case, but in other cases it just times out), and the third and fourth lines are timeout error one minute later.
All the other functions except for IPsec work normally.
Originally the problem have manifested immediately after reboot, but after 20 minutes or so the /ip ipsec was becoming available for several minutes, then it was starting to timeout again, and the cycle was repeating until the router was rebooted.
I've suspected some kind of flash memory failure on the particular device, so I've netinstalled the router with 7.23.7 and restored the backup I've made after the upgrade, to the same result.
Ok, the backup may have been already corrupted - I've restored a 7.21.5 backup made few weeks earlier, to the same result.
Maybe the binary configuration is somehow broken (its lineage dates back to v6) - I've reset the router configuration and imported the certs and an export file generated on 7.21.5, to the almost same result - the problems began within an hour, not right after the reboot.
Downgrading to 7.23.4 (without touching the config) helped a bit - the router was normal for almost a day, but then I've started getting the same errors (though sometimes /ip ipsec peer print outputs the peers after some delay).
Upgrading to 7.26beta1 (as its the first version since 7.23.7 to include IPsec fixes that could be related to the problem) seemingly resolved the problem, but the upgrade have wiped all the IPsec policies, both templates and static, requiring manual restore of this part of the config.
My other routers with smaller IPsec configs (10 to 15 peers), including a couple of RB4011s, are fine after upgrading to 7.23.7 - the problem seems to be limited to larger IPsec configurations.