NordVPN IKEv2 connection hanging - how to fix?

RouterOS General
16

I’ve been using the following script to good effect to deal with drops automatically (I saved it as ‘SA-script’):

:local IPWatchServer 8.8.8.8
:local OutInterface bridge
:if ([/ping interface=$OutInterface $IPWatchServer count=5]<3) do={
  /ip ipsec installed-sa flush 
  :log info "IPSEC tunnel is down: Flushing Installed SA !!!"
} else={
#  :log info "IPSEC tunnel is OK !"
}

Adapted from the example from stmx38 here http://forum.mikrotik.com/t/ipsec-tunnel-issues-sas-need-flushing-from-time-to-time/62391/24

I noticed that the flush command in this example wasn’t working:

/ip ipsec installed-sa flush sa-type=all

Changed to:

/ip ipsec installed-sa flush

Then set a schedule:

/system scheduler add name=checkSA on-event="SA-script" interval=1m

You can adapt the schedule and/or ping count to suit you, but be careful not to set it such that occasional regular ICMP packet loss isn’t flapping your tunnel too much