vpn

// The IPsec tunnels of a FortiGate, by SNMP (FORTINET-FORTIGATE-MIB, fgVpnTunTable): the state of each
// tunnel and its traffic, and the number of tunnels up. A tunnel is named by its phase 1 and its phase 2
// ("to-branch/to-branch-lan"). A dial-up tunnel is listed only while a client is connected: a tunnel that
// must stay is watched by its name, in "Tunnel missing".
need('protocol:snmp');

per('tunnel', 'Tunnels');
output('status', 'text', array('label' => 'Tunnel state', 'per' => 'tunnel'));
output('traffic-in', 'number', array('label' => 'Inbound traffic', 'unit' => 'bit/s', 'per' => 'tunnel'));
output('traffic-out', 'number', array('label' => 'Outbound traffic', 'unit' => 'bit/s', 'per' => 'tunnel'));
output('tunnels-up', 'number', array('label' => 'Tunnels up'));

watch.state('down', 'Tunnel down', 'status', array('critical' => array('down')));
watch.missing('missing', 'Tunnel missing', 'status', array('enabled' => false));
watch.silence('idle', 'Tunnel without traffic', 'traffic-in', array('warning' => '30 min', 'enabled' => false));

// fgVpnTunTable: fgVpnTunEntPhase1Name, fgVpnTunEntPhase2Name, fgVpnTunEntInOctets,
// fgVpnTunEntOutOctets and fgVpnTunEntStatus (down 1, up 2).
$tunnels = snmp.table(array(
    'phase1' => '1.3.6.1.4.1.12356.101.12.2.2.1.2',
    'phase2' => '1.3.6.1.4.1.12356.101.12.2.2.1.3',
    'in'     => '1.3.6.1.4.1.12356.101.12.2.2.1.18',
    'out'    => '1.3.6.1.4.1.12356.101.12.2.2.1.19',
    'status' => '1.3.6.1.4.1.12356.101.12.2.2.1.20',
));

$up = 0;
$seen = array();
foreach ($tunnels as $index => $row) {
    $name = list.get($row, 'phase1', 'tunnel ' . $index) . '/' . list.get($row, 'phase2', '');
    if (list.has($seen, $name)) {
        $name = $name . ' #' . $index;
    }
    $seen[$name] = true;
    $status = 'unknown';
    if (list.get($row, 'status', 0) == 1) {
        $status = 'down';
    } elseif (list.get($row, 'status', 0) == 2) {
        $status = 'up';
        $up = $up + 1;
    }
    value('status', $status, $name);

    // Rates, from the counters of this run and the previous one; nothing on the first run.
    if ($status != 'up' || !list.has($row, 'in') || !list.has($row, 'out')) {
        continue;
    }
    $in = counter.rate('in', $row['in'] * 8, $name);
    $out = counter.rate('out', $row['out'] * 8, $name);
    if ($in != '' && $out != '') {
        value('traffic-in', number.round($in), $name);
        value('traffic-out', number.round($out), $name);
    }
}
value('tunnels-up', $up);