Redundant IPsec tunnel - second tunnel cannot connect - a bug?

The Mikrotik approach is based on an assumption that the remote peers passively wait for a Phase 2 establishment attempt from the initiator side because a statically configured IPsec policy overrides regular routing, so if it is configured on both peer1 and peer2, they cannot forward the traffic for your site to each other. Since the “unsuccessful” peers keeps trying to establish Phase 2, you won’t be able to get rid of those log messages.


That would be my next step. I would add a chain=output dst-address=peer1 protocol=udp dst-port=500,4500 action=drop rule on the initiator while peer1 is up to see what happens.