IPSec monitoring

[fabio]

Hi All

I need to check the IPsec tunnel status from my monitoring system (icinga2) … in your opinion which is the “correct” way?
… with the opnsense API  (which is the call)
... via a script run by the “icinga agent” installed on the firewall
… something else

Has someone already impelmented this type of check  ?
I’ll be glade for any suggestion

Thanks
--
Fabio