topic Re: Tunnel monitoring using internal src to external dst? in General Topics

Tunnel monitoring using internal src to external dst?

mike406 — Fri, 25 Jan 2019 00:00:45 GMT

Is it possible to monitor VPN tunnels using an internal source IP on my tunnel interface and the external IP of the other system? I won't always have control/access to the other side of the tunnel, I may only know the local subnet(s) and the external IP.

Re: Tunnel monitoring using internal src to external dst?

reaper — Fri, 25 Jan 2019 12:57:19 GMT

if you 'number' all your tunnels (set a /30 subnet ip on each end) you can simply monitor the remote tunnel interface

Re: Tunnel monitoring using internal src to external dst?

mike406 — Fri, 25 Jan 2019 15:53:13 GMT

I don't follow you. I don't have access to each end, I only have access to my end. I know the external IP and the local subnets of the other end. The other end is generally not a PA firewall.

Can you give an example of what should be set for IPsec Tunnel -> Tunnel Monitor -> Destination IP ?

Re: Tunnel monitoring using internal src to external dst?

OtakarKlier — Fri, 25 Jan 2019 17:52:18 GMT

Hello,

The 'destination IP' can be anything that is pingable on the other end of the tunnel. Perhaps the internal interface of the other sides firewall? Just soemthing that is always %100 up so you dont get false positives.

Does this help?

Re: Tunnel monitoring using internal src to external dst?

mike406 — Fri, 25 Jan 2019 18:33:23 GMT

Okay, I've got it figured out. I also see the tunnel-status-up and tunnel-status-down messages in the system logs.

Are there any plans to add a GUI indicator for tunnel monitoring status?

Re: Tunnel monitoring using internal src to external dst?

OtakarKlier — Fri, 25 Jan 2019 18:34:56 GMT

Already have one Network Tab-> IPSec Tunnels

Re: Tunnel monitoring using internal src to external dst?

mike406 — Fri, 25 Jan 2019 20:29:15 GMT

That doesn't show monitoring status...the tunnel may be up, but monitoring might be in a down state because of a changed IP address (for example).