VPN tunnel monitoring/alerting

Sec101 — Wed, 16 Jul 2025 15:31:16 GMT

When NOT using tunnel monitoring and keying off events ids for "tunnel-status-up/tunnel-status-down", what is the best logging to alert on for tunnels going up or down?

Is it only alertable/trackable by
( eventid eq 'ikev2-nego-ike-dpd-dn' )

Or is there a better way to alert when NOT using tunnel monitoring on when a tunnel is hard down? Assuming there is a ikev1 that you can alert on too? What is the best prescribed method for alerting outside of tunnel monitoring?

Re: VPN tunnel monitoring/alerting

BPry — Wed, 16 Jul 2025 20:39:25 GMT

@Sec101,

Is there any reason why you just don't include tunnel monitoring? That gives you the absolute clearest alert when a tunnel goes down and when it is restored, and with the action set to wait-recover there's no downsides to enabling it as long as you have addresses on the tunnel interface or just any other host on the other end that can be reliably monitored.

topic VPN tunnel monitoring/alerting in General Topics

VPN tunnel monitoring/alerting

Re: VPN tunnel monitoring/alerting