am i missing something???

savage · Sat Jul 20, 2019 1:21 am

Flags: T - template, X - disabled, D - dynamic, I - invalid, A - active, * - default 
 #     PEER                           TUNNEL SRC-ADDRESS                                                          DST-ADDRESS                                                          PROTOCOL   ACTION  LEVEL    PH2-COUNT
 0 T *                                       ::/0                                                                 ::/0                                                                 all       
 1  A  TRANS-GW #1                    yes    0.0.0.0/0                                                                a.b.23.213/32                                                    all        encrypt require          1
 2  A  TRANS-GW #1                    yes    0.0.0.0/0                                                                c.d.30.0/24                                                      all        encrypt require          1
[rtradmin@host] /ip ipsec policy> :local test1 [/ip ipsec policy get 1 dst-address ] 
[rtradmin@host] /ip ipsec policy> :put $test1                                       

[rtradmin@host] /ip ipsec policy>

I am miserably failing, in trying something like this....

:foreach i in=[/ip route find where distance=20 and bgp and gateway~"^a.b.*\$"] do={
  :local prefix [/ip route get $i dst-address]
  :put $prefix
  :if ([/ip ipsec policy get [/ip ipsec policy find where dst-address=$prefix] dst-address] = $prefix) do={
    :put found
  } else={
    :put notfound
  }
}

The idea is to create policies for a specific IPSEC peer dynamically based on what's being routed via the routing table.

savage · Sat Jul 20, 2019 1:33 am

  :if ([/ip ipsec policy get [find dst-address=10.0.0.0/16] value-name=dst-address] = 10.0.0.0/16) do={
    :put found
  } else={
    :put notfound
  }

works when there is a policy matching 10.0.0.0, but returns a "no such item" error on a check when there isn't a policy. Why return an error? shouldn't the if statement just be false?

2frogs · Sat Jul 20, 2019 3:05 am

:if ([:len [/ip ipsec policy find dst-address=10.0.0.0/16]]=0) do={:put "Not Found"
} else={:put "Found"}

Or

:if ([:len [/ip ipsec policy find dst-address=10.0.0.0/16]]>0) do={:put "Found"} el
se={:put "Not Found"}

A missing value is not 0, it is null and ROS scripts can't handle nulls. But you can check for null using :len (string length.)

am i missing something???

am i missing something???

Re: am i missing something???

Re: am i missing something???

Who is online