IPsec Police invalid status because of Dst.Address'es match

RouterOS General
1

Hello. I have MK1 with one wan and MK2 with WAN1 and WAN2 for failover.
I need IPsec between MK1 and MK2.
Problem is that one or another IPsec Policy always invalid on both MK.
(Maybe because it have the same Dst.Address). But for my purposes I need two IPsec polices with different SA Dst. and same Dst. Addresses.

Is it exist the way to solve this problem without script?

The same problem
http://forum.mikrotik.com/t/ipsec-policy-invalid/47843/1

Still not solved?
IPsecPolicyInvalid.JPG

2

I have solved this problem with script:

:if ([/ip route get value-name=comment "WAN 2" active] = true) do={
:if ([/ip ipsec policy get number=0 disabled] = true) do={
/ip ipsec policy disable numbers=1
/ip ipsec policy enable numbers=0
}
} else={
:if ([/ip ipsec policy get number=0 disabled] = false) do={
/ip ipsec policy disable numbers=0
/ip ipsec policy enable numbers=1
}
}
3

you can use different SA dst addresses in policy