IPSec monitoring

[fabio]

Hi All

I need to check the IPsec tunnel status from my monitoring system (icinga2) ... in your opinion which is the "correct" way?
... with the opnsense API  (which is the call)
... via a script run by the "icinga agent" installed on the firewall
... something else

Has someone already impelmented this type of check  ?
I'll be glade for any suggestion

Thanks
--
Fabio