[Unit]
Description=On suspend actions
Before=sleep.target

[Service]
Type=oneshot
ExecStart=/usr/bin/systemctl stop ipsec
ExecStartPost=/usr/bin/sleep 5

[Install]
WantedBy=sleep.target