Polling VPN tunnels

Question

does anyone have any knowledge about what might be best-practice for NODE values in Polling seconds to sites having VPN tunnels?

when i ping a VPN site i've noticed the first ping reply may be around 1.5 seconds, probably greater in some cases. this is, i've been told,the VPN tunnel being renegotiated.

so as Solarwinds loses contact with a VPN site i'm wondering if the packets get timed-out and discarded during this tunnel-negotiation delay, thereby Solarwinds thinks it is down.

is it best to POLL VPN tunnels with higher frequency - just to maintain tunnel activity? or is that under control of the VPN device configuration and has nothing to do with Solarwinds polling?

thanks,

LC

kweise · Accepted Answer

LC,

I don't poll devices on the far side of a VPN tunnel any differently than I do any other remote site.  We're a Cisco shop, so all I did on the device configs was to include traffic from the Orion poller in the access list that defines "interesting" traffic for the tunnel.  The default idle timeout for an IP Sec tunnel (at least on our device) is 30 minutes, so as long as our polling interval is less than every 30 minutes, our tunnel should always stay up.  The times our far side device has shown down in Orion, it was an actual outage, not a tunnel time out.

If you're including traffic from your Orion poller in the tunnel itself, as long as you poll more frequently than the idle timeout setting for the tunnel, your tunnel shouldn't drop.

Hope this helps.