Detect ipsec vpn tunnel down with remote palo alto peer

[marce1000]

 PA5020/PAN-OS 7.1.10

 I am trying to develop a NAGIOS check to get an alert , when a vpn tunnel between PA's at different locations

is down. So far I have been looking at the ifup-status of the corresponding tunnel interface at the local firewall. It turns

out that  this is still up , even if the vpn tunnel is down. From the local firewall, this can be argumentable and I can except. 
Are there any other SNMP variables in the Palo Alto SNMP MIBS to check and use in order to verify the status of a vpn tunnel

between 2 PA's ?

[aleksandar.astardzhiev]

Have you seend this - https://live.paloaltonetworks.com/t5/Management-Articles/How-to-get-notifications-about-IPSec-tunnel...

Not completely sure if it the absense of SNMP OIDs is still valid for current versions.

[marce1000]

   Tx, for the link, does anyone know of progress on ipsec link monitoring via SNMP in PANOS 8.x ?

M.

[kiwi]

Hi @marce1000,

Using a MIB-browser I found the following inside the PAN-TRAPS MIB :

panVPNTunnelStatusUpTrap : .1.3.6.1.4.1.25461.2.1.3.2.0.1746

panVPNTunnelStatusDownTrap : .1.3.6.1.4.1.25461.2.1.3.2.0.1747

There's also a workaround using syslog messages :

Monitoring-VPN-tunnel-down-events-with-SNMP

How-to-get-notifications-about-IPSec-tunnel-status

Hope this helps !

-Kiwi.

[PDelobel]

Hi 

I have tested the MIBs and I have no feedback.
Have you if since Palo Alto has brought a solution to the problem?