hi,
i am testing some scripts for ipsec, i have one side static, another site is dynamic (later there will be more
remote sites with dynmic ip). on static side i put peer 0.0.0.0/0. in ipsec policy i need to change sa-dst address
so i find this script:
:global RemoteSite [:resolve xyz.dyndns.org]
/ip ipsec policy set 0 sa-dst-address=$RemoteSite
both policy must resolve sam dyndns name (for now) policy 0 and policy 1 so i made two scripts with two different variable
for policy 0:
:global RemoteSite0 [:resolve xyz.dyndns.org]
/ip ipsec policy set 0 sa-dst-address=$RemoteSite0
and for policy1:
:global RemoteSite1 [:resolve xyz.dyndns.org]
/ip ipsec policy set 1 sa-dst-address=$RemoteSite1
onlo policy “0” is updated, both script are running via scheduler and in log there are no error
i aslo tried with one script (not working):
:global RemoteSite [:resolve xyz.dyndns.org]
/ip ipsec policy set 0 sa-dst-address=$RemoteSite
/ip ipsec policy set 1 sa-dst-address=$RemoteSite
on the other side where i have dynmic address i use script which is looking pppoe interface and put that address in
sa-src-address. I also have two policy so I use same two scripts with different variable (when i had same variable it
didnt work), with different variable working perfectly:
policy 0
:local WANip0 [/ip address get [find interface=“pppoe-out1”] address]
:log info “Interface IP is $WANip0”
:local WANip0 [:pick “$WANip0” 0 ([:len $WANip0] - 3)]
:log info “IP sans the slash notation is $WANip0”
/ip ipsec policy set 0 sa-src-address=$WANip0
policy 1
:local WANip1 [/ip address get [find interface=“pppoe-out1”] address]
:log info “Interface IP is $WANip1”
:local WANip1 [:pick “$WANip1” 0 ([:len $WANip1] - 3)]
:log info “IP sans the slash notation is $WANip1”
/ip ipsec policy set 1 sa-src-address=$WANip1
with different varibale is working when checks pppoe interface, and on another side when he need to reslove my
dyndns name its update only policy 0, first policy.
if I put “generate policy” on static side, and dynamic side is woking with scripts, it will be ok but the thing is that only dynamic side can activate tunnel, if tunel is down on the router which have “generate policy” cant activated tunel, communications with remote networks will work only if tunel is up (anothert side must first send interesting traffic to get tunnel up)
both mikrotiks are 450G, 4.17
so how update multiple ipsec policy with script?
thanks