Because Debian 10 seems to have a more robust security update policy for the libreswan package than Ubuntu does, I've moved this functionality from Ubuntu to Debian 10, and I believe I got a newer version of libreswan in the process.
On Debian 10, the cron job to check birdc's output for BGP session status and run ipsec auto --down [tunnelname], sleep 10, and ipsec auto --up [tunnelname] when the BGP session isn't ESTABLISHED still seems to be needed, but the default supplied leftupdown script seems to work fine unmodified.
Because Debian 10 seems to have a more robust security update policy for the libreswan package than Ubuntu does, I've moved this functionality from Ubuntu to Debian 10, and I believe I got a newer version of libreswan in the process.
On Debian 10, the cron job to check birdc's output for BGP session status and run ipsec auto --down [tunnelname], sleep 10, and ipsec auto --up [tunnelname] when the BGP session isn't ESTABLISHED still seems to be needed, but the default supplied leftupdown script seems to work fine unmodified.