Script now running

RouterOS
1

I'm having challenges running scripts on my mikrotik router. simple script does not run as well. Has anyone had similar experience, pls i need assistance on what could be wrong.

Find below the script

MikroTik RouterOS 6.49.18 (c) 1999-2025 http://www.mikrotik.com/

[admin@MikroTik] > /system script print detail where name=VPN_Failover
Flags: I - invalid
0 name="VPN_Failover" owner="admin" policy=read,write,policy,test,sensitive dont-require-permissions=no
last-started=jul/31/2026 16:13:49 run-count=5 source=
:local PrimaryPeer "HQ"
:local BackupPeer "HQ_Backup"

   :local TunnelUp false
   
   :foreach i in=[/ip ipsec active-peers find] do={
       :if ([/ip ipsec active-peers get $i state] = "established") do={
           :set TunnelUp true
       }
   }
   
   :if ($TunnelUp = true) do={
       :return
   }
   
   :local PrimaryDisabled [/ip ipsec peer get [find where name=$PrimaryPeer] disabled]
   
   :if ($PrimaryDisabled = false) do={
   
       :log warning "VPN Failover: Primary failed, switching to Backup"
   
       /ip ipsec peer disable [find where name=$PrimaryPeer]
       :delay 2
       /ip ipsec peer enable [find where name=$BackupPeer]
   
   } else={
   
       :log warning "VPN Failover: Backup failed, switching to Primary"
   
       /ip ipsec peer disable [find where name=$BackupPeer]
       :delay 2
       /ip ipsec peer enable [find where name=$PrimaryPeer]
   
   }
2

Why do you need this part? This code does not display anything in the log for monitoring, nor does it interact with the rest of the script commands.

What does "does not run as well" mean? Are there any errors?

And why do you use active-peers instead of policies??

3

@aldek the gist of that part is:
If everything works, don't bother with unnecessary logs, skip the rest of the script.

The script is poorly written...
BUT I totally agree about not writing log after log unnecessarily when the situation is stable.

Even if then, everything should be done correctly in another way...

For example (untested, same logic):

:local PriPeer "HQ"
:local BakPeer "HQ_Backup"

/ip ipsec active-peers
:if ([:len [find where state="established"]] < 1) do={
    /ip ipsec peer
    :if ([get $BakPeer disable]) do={
        disable $PriPeer ; :delay 2s ; enable  $BakPeer
        :log warning "VPN Failover: Primary failed, switched to Backup"
    } else={
        disable $BakPeer ; :delay 2s ; enable  $PriPeer
        :log warning "VPN Failover: Backup failed, switched to Primary"
    }
}

Obviously, I was "inspired" by the logic of the first script.
I did it to demonstrate the programming difference with the same concept.
Everything should be rethought because, as it is,
if one has other active peers, the exchange never happens...

4

Active-peer verification does not provide unambiguous, reliable confirmation of a VPN's performance.

It would be more correct to check network connectivity via the VPN, such as through a ping test.

5

I was referring to the logs in the comment, not the method: