Like "ipsec status" command to check IPsec tunnel status, SSR PCLI also has an option to check the tunnel status as mentioned here https://docs.128technology.com/docs/plugin_ipsec_client#pcli-enhancements using "show device-interface" command

Even though IPsec tunnel is up and working, if default configuration is changed or customized, "show device-interface" output may show tunnel as Down.

```

[email protected]# show device-interface router 128t-br3 node node1 name remote
======================================================================
 node1.128t-br3:remote
======================================================================
 Type:        host
 Forwarding:     true
 Mode:        host
 MAC Address:     xx:xx:xx:xx:xx

 Admin Status:    up
 Operational Status: up
 Provisional Status: up
 Redundancy Status:  non-redundant
 Speed:        1 Gb/s
 Duplex:       full

 in-octets:            12332
 in-unicast-pkts:          199
 in-errors:              0
 out-octets:            7308
 out-unicast-pkts:         174
 out-errors:             0

 IPSec:
   remote:
     Tunnel Status: Down
     Tunnel Details:
       Name:  ipsec-client-tunnel-ipsec-profile1-remote
Completed in 0.25 seconds

```

Even though IPsec tunnel is up and working, "show device-interface" output may show tunnel as Down.

Even though IPsec tunnel is up and working, if default configuration is changed or customized, "show device-interface" output may show tunnel as Down. One such scenario was when pluto logs were not redirected to journalctl due to some customizations done by user.

User was redirecting pluto logs by manually overriding the logging configuration.

--- updated ipsec.conf as below ---
config setup
    # Normally, pluto logs via syslog.
     logfile=/var/log/128technology/pluto.log ← Remove #. Add 128technology to directory
    #.

This resulted in no logs written to journalctl, which ended up tunnel status showing Down since the output of the  "show device-interface" command is extracted from pluto logs available in journalctl. 

The solution was to revert it back and avoid modifying the ipsec.conf files.