VPN monitoring and datapath verification with the iked process

We support VPN monitoring and datapath verification on firewalls that run the iked process for the IPsec VPN service. When using this feature, note the following: 

• Configuration and deletion of VPN monitoring functionality on an active tunnel does not cause any service disruption. 
• After you've configured VPN monitoring, the functionality is active only after the tunnel is up. 
• Configuration of verify-path on an active tunnel causes service disruption and performs renegotiation after the tunnel is down.

With the iked process, you can continue to configure vpn-monitor and verify-path at the [edit security ipsec vpn vpn-name] hierarchy level.