The current issue is you can't actually restart ipsec without disabling and enabling the service, which is odd and confusing.

Convert actions to configd template and change service registration.