Network
banshee/network-collection/network/fortinet/snmp/
vpn
The IPsec tunnels of a FortiGate by SNMP: the state and traffic of each tunnel, and a tunnel down or gone.
by banshee1 installation2 versions
v2Latest
Published on October 28, 2026. One naming convention across collections; documentation completed.
IPsec tunnels of a FortiGate, by SNMP
Returns, for each IPsec tunnel of a FortiGate, its state and its traffic in each direction, and the number of tunnels up. Three watches are offered: a tunnel down, a tunnel missing, and a tunnel without traffic.
Versions
FortiOS 5, 6 and 7, which serve this table alike. It stays at the common level of fortinet/.
How it works
The collector reads fgVpnTunTable (FORTINET-FORTIGATE-MIB), one row per phase 2 of a tunnel.
- A tunnel is named by its phase 1 and its phase 2 (
to-branch/to-branch-lan); two of the same name each keep their own, the second carrying its index. - The state is
fgVpnTunEntStatusin words:upordown. "Tunnel down" is critical ondown. - The traffic is the rate of
fgVpnTunEntInOctetsandfgVpnTunEntOutOctetsbetween two runs, in bit/s, for a tunnel up; nothing on the first run. - A dial-up tunnel is listed only while a client is connected, and a tunnel may leave the table when it falls, depending on its configuration: name the tunnels that must stay up in "Tunnel missing".
The collector only reads: SNMP sends nothing but reads.
Prerequisites
- SNMP enabled on the FortiGate, reachable from the poller (UDP 161), a community or a user restricted to the poller.
- Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (
protocol:snmp:*variables).
Outputs
| Name | Label | Unit | Per instance |
|---|---|---|---|
status | Tunnel state | — | yes, per tunnel |
traffic-in | Inbound traffic | bit/s | yes, per tunnel |
traffic-out | Outbound traffic | bit/s | yes, per tunnel |
tunnels-up | Tunnels up | — | no |
Watches
| Name | Title | Kind | Defaults | Checked by default |
|---|---|---|---|---|
down | Tunnel down | state to avoid, on status | critical on down | yes |
missing | Tunnel missing | expected instances, on status | no tunnel named: it raises nothing until names are set on the probe | no |
idle | Tunnel without traffic | no activity, on traffic-in | warning after 30 min at zero | no |
Limits
- SSL VPN tunnels are not in this table.
- Which tunnels FortiOS keeps in the table while they are down, and which it drops, is not verified here without a device: "Tunnel missing" covers both.