Fortinet IPSec VPN Monitoring

Hello everyone,I am monitoring the status of the VPN tunnel in the fortinet firewalls with OIDs and I want to generate an alert that tells me when one is down. 
Would the logic or procedure I'm using for this be right?



where down(1), up(2)

Another important information that I would not know how to place is the name of the vpn that fell

Find more posts tagged with

npm

Alerts

fortinet

Accepted answers

All comments

The_Dragon

Hi ...

Looks like we are about to start doing this as well. Did you get anywhere with this?

stuartd

On the face of it, the logic appears to be sound.

The only line I'd query is this one:

Without knowing what your UnDP is doing / looking for it is hard to tell.

That said, if you click one one of the down facing arrows and then click on "Show SWQL" you can copy and paste that into SWQL Studio, and then play around with the status line (or even comment it out) then you can see if your setup is seeing what you expect it to see.

In your case, I presume status=2 means the VPN is up? So any other number essentially means it is down. In which case, if you have no VPN's down currently, then change the last line of the SWQL so the status number is something else. Or just comment that line out altogether and all your VPN's should report back.

Your SWQL would look something like:

SELECT E0.[Uri], E0.[DisplayName]

FROM Orion.NPM.CustomPollerStatusOnNodeTabular AS E0 

WHERE ( ( ( E0.[CustomPollerAssignment].[Node].[Vendor] = 'Fortinet, Inc.' ) 
AND ( E0.[CustomPollerAssignment].[CustomPoller].[OID] LIKE '1.3.6.1.4.1.12356.101.12.2.2.1.2%' ) ) 
AND ( ( E0.[CustomPollerAssignment].[CustomPoller].[UniqueName] = 'Status' ) 
--AND ( E0.[RawStatus] != '2'*1 ) ) 
)

Let us know how you get on?

mjonathan

regards stuartIf I have to search in the field where the data is. In some cases it was the Current Numeric Value 
and in another case it was Row Label, but maintaining the same logic.

mjonathan

Regards The_DragonI'm doing it just as I showed it in the case. There are 3 options for custom alerts, which are nodes, 
status and interfaces. Then you have to search for the field where the data you need is, be it Row Label,
Current Numeric Value, Rate, Row Status, etc.

The_Dragon

I tried to replicate your alert logic, but in the following "status" doesn't exist.

Can you show how you found status?

ASMoonshine

Do you manage to create an alert for Failover? Can you share the OID? I used to have this kind of set up but haven't tried if this will work.

ASMoonshine

where should we use this SWQL? Is it for creating a report or alert?

Would you be able to help me in setting up the failover status? Can you share the OID? I used to have this kind of set up but haven't tried if this will work.

mjonathan

Greetings ASMoonshineThe OID I use are the following:1.3.6.1.4.1.12356.101.13.1.1 -> "High-availability mode (Standalone, A-A or A-P)"

Syntax  FgHaMode (INTEGER) {standalone(1), activeActive(2), activePassive(3) }1.3.6.1.4.1.12356.101.13.2.1.1.12 -> "Current HA Sync status"

Syntax FgHaStatsSyncStatusType (INTEGER) {unsynchronized(0), synchronized(1) }and configure the alert as follows

ASMoonshine

Hello! What OID do you use in your alert.. Is it

1.3.6.1.4.1.12356.101.13.1.1 -> "High-availability mode (Standalone, A-A or A-P)"

1.3.6.1.4.1.12356.101.13.2.1.1.12 -> "Current HA Sync status"