Monitor status of VPN tunnel on Cisco router

At various locations on our network, we are using a leased circuit for primary connectivity and an IPSEC VPN tunnel over DSL or cable as secondary or backup connectivity.

In various cases, most commonly when we have a static IP address from our ISP, we have seen where the Cisco router (and therefore NPM) reports the tunnel interface as up/up even when the link is down and not passing traffic. Is there a way, short of purchasing NTA, that we can monitor the "true" status of the link, or alternately, is there a particular SNMP trap we can use to trigger an alert if/when a tunnel goes down?

Find more posts tagged with

Accepted answers

clubjuggle

I found a sort of "back door" way to accomplish this. I created an alert on the tunnel interface that will trigger in either of the following cases:

Interface is down
Recv packet size is equal to 0

If there is absolutely no incoming traffic at all in a polling interval, it's a safe bet the tunnel is not working.

All comments

Questionario

you can monitor both the physical link as well as the tunnel interface...

I dont exactly understand what else you need...

you need to be alerted if there is no traffic flowing on that link anymore?

you can do that by alerting on the utilization of the interface

hope this helps a bit, if not try to elaborate a bit more

clubjuggle

The problem we are experiencing is as follows:

1. The physical FastEthernet/GigabitEthernet interface reports as up/up (because the Ethernet cable is connected to the DSL/Cable modem, and the modem is powered on, so there is an Ethernet link).

2. The Tunnel interface is reporting as up/up, apparently because the physical Ethernet interface has a good link and an IP address

3. The underlying DSL/Cable service is down and therefore no traffic can be passed over the tunnel.

We need to have a way to know when this set of conditions exists.

Thanks,
~Terry

njoylif

easiest way is to do a ping test to the IP on the far side of the tunnel interface (ICMP only)

clubjuggle

easiest way is to do a ping test to the IP on the far side of the tunnel interface (ICMP only)

I could do that, but that would create the need to add well over 200 ICMP-only nodes to our installation. Do we have other options?

matmuts

Hi clubjuggle

I have the same challenge. Did you ever get a solution to this dilemma?

Matt

fcaron

This thread might help. Let us know.

clubjuggle

I found a sort of "back door" way to accomplish this. I created an alert on the tunnel interface that will trigger in either of the following cases:

Interface is down
Recv packet size is equal to 0

If there is absolutely no incoming traffic at all in a polling interval, it's a safe bet the tunnel is not working.

matmuts

Let me try this and will update

jswan

Just a followup: the reason that GRE tunnels almost always show "up/up" is that the state of the tunnel's line protocol is controlled by the presence or absence of a *route* to the tunnel destination. Thus, if a) the IP address of the tunnel destination is on the Internet, and b) you have a default route pointing to the Internet, your tunnel line protocol will always be up unless the interface associated with the default route goes down.

Other ways of dealing with remote tunnel reachability include 1) tunnel keepalives, or 2) running a dynamic routing protocol over the tunnel.

matmuts

Thanks guys for the suggestions.

I have tried the following but still cant get it working:

1. issued the 'no keepalive' on the interfaces

2. created an alert which is triggered when the interface is receiving packet size = 0, as per clubjuggle.

Number 2 resulted in giving me info from serial interfaces. So I added the rule of interface index being 2 (fast ethernet WAN) to the alert. The alert then fails.

I am thinking, the connection to the IDU from the interface makes for constant communication. Therefore the fe0/ will never report that it is down unless the IDU is completely down. Even under the circumstances, it reports that the node is down rather than the interface.

I know this can be done but I cant bring my brain to think. think think think........

rcahill

This may not always be the case where the tunnel is only established when there is "interesting traffic" to send. I commonly configure VPNs in the manner when there is a vendor / customer involved versus a remote site that is Active 24x7.

This would also fail when a tunnel is only established during potential Business Hours.

Note: ICMP is sometimes not a viable solution since it is many times disabled for business to business solutions.

matmuts

Rcahill,

Thanks for the input. I have always available, static tunnels. Therefore this is not the case in this situation. I am still looking to find a solution to the challenge that is at hand.

jswan

If you're using tunnel keepalives, the line protocol on the tunnel interface should go down if the other side is unreachable. Assuming you live in Cisco land:

http://www.cisco.com/en/US/tech/tk827/tk369/technologies_tech_note09186a008040a17c.shtml

The "no keepalive" command is not what you want; you want to be doing GRE tunnel keepalives as shown in the link above.