How do VPN connections get monitored outside of logs?

[jbabcockii]

Am I missing some way of monitoring VPN connections outside of watching the logs?  How about a widget or something?

[jdavis]

Take a look at the PAN-TRAPS MIB file.  There are a number of IPSec VPN traps that could be used for SNMP-based monitoring.  There are also GlobalProtect traps if your questions was actually about monitoring SSL VPN and not IPSec VPN.  Download the MIB and open it in a MIB browser to quickly see if any of the available traps will cover what you need.

This is the link to the different MIB versions:  https://live.paloaltonetworks.com/community/documentation/content?filterID=content~category[enterpri...

I hope that helps.

- Jared Davis

[jbabcockii]

Jared,

Thanks for the reply but I was thinking something more along the line of something within the PA GUI on the dashboard tab like most other name brand products have.

[jdavis · Accepted solution]

It appears that a feature request was filed with Product Management for exactly what interests you.  Check with your local systems engineer from Palo Alto Networks.  She or he will be able to look into the matter further and let you know whether there are any plans to include such an enhancement in a future release.  Ask her or him to search on "IPSec Monitor on Dashboard".

- Jared Davis

[panman]

In the Network>IPSec Tunnels GUI, you have basic monitoring functionality for the status of each IPSec VPN connection...using those green/red "LEDs". If you need more than that, usually something on that IPSec peer is abnormal, and you have to view the logs anyway to troubleshoot.

From the help section of that page:

Viewing IPSec Tunnel Status on the Firewall

Network > IPSec Tunnels

To view the status of currently defined IPSec VPN tunnels, open the IPSec Tunnels page. The following status information is reported on the page:

• Tunnel Status (first status column)—Green indicates an IPSec SA tunnel. Red indicates that IPSec SA is not available or has expired.
• IKE Gateway Status—Green indicates a valid IKE phase-1 SA. Red indicates that IKE phase-1 SA is not available or has expired.
• Tunnel Interface Status—Green indicates that the tunnel interface is up (because tunnel monitor is disabled, or because tunnel monitor status is UP). Red indicates that the tunnel interface is down, because the tunnel monitor is enabled and the status is down.

Hope that helps...