topic Re: Automate the VPN show and test commands to check the tunnel status and make it UP in Automation/API Discussions

Automate the VPN show and test commands to check the tunnel status and make it UP

Sambhu21 — Tue, 21 Dec 2021 06:30:13 GMT

We have some tunnel goes down frequently so we are planning to bring up the tunnel with automation ( For the Monitoring team to check the status and make it UP using test command).

Is it possible to run below commands with some batch file/exe using powershell. My idea is to create batch file for each tunnel and run it when the same is down/alert is coming.

#show vpn ipsec-sa tunnel <Tunnel name>

#test vpn ipsec-sa tunnel <Tunnel name>

Re: Automate the VPN show and test commands to check the tunnel status and make it UP

JimmyHolland — Tue, 21 Dec 2021 11:00:48 GMT

Hi @Sambhu21, if you configure tunnel monitoring within PAN-OS (link), pings will be sent across the tunnel at regular intervals and the tunnel will not go down due to inactivity.

For PowerShell specifically, there is a wrapper developed within the community that may help, you may wish to use this for example to execute operational commands. However, it would be better to stop the tunnel going down in the first place, rather than focusing on automating the recovery.