Description

This article describes a way to check the IPsec tunnel status using PCLI.

Symptoms

How can I confirm that the tunnel is connected instead of the command #ipsec status? 
IPsec client plugin 3.6.0:
[root@ro123 t128]# ipsec status
whack: Pluto is not running (no "/run/pluto/pluto.ctl")

IPsec client plugin 3.5.0: 
[root@ro123 t128]# ipsec status 
000 Total IPsec connections: loaded 2, active 2

Solution

The ipsec status command from the shell was working till IPsec client plugin 3.5.0.

In the recent versions it is recommended to use the options available available from PCLI and GUI:

To check the status of the IPsec tunnels for a given ingress KNI, extra IPsec tunnel related output will be found in the show device-interface command as well as the show plugin state command.

From the conductor UI, the command can be accessed by navigating:
Login to SSR > Administration > Plugins > Select the installed IPsec Plugin > Click on Details

Please refer for more details: https://www.juniper.net/documentation/us/en/software/session-smart-router/docs/plugin_ipsec_client/#pcli-enhancements

If incase you want to still shell command, something like below can be attempted

# ipsec --rundir $(dirname $(find /run/128technology/plugins -name pluto.ctl)) status

However official recommendation is to use GUI or PCLI to check the status.

Modification History

2024-05-24 : Article Created
2024-08-15 : Updated a working ipsec command with some formatting. 

Related Information

https://www.juniper.net/documentation/us/en/software/session-smart-router/docs/plugin_ipsec_client/#pcli-enhancements