banshee/network-collection/network/fortinet/snmp/vpn

IPsec tunnels of a FortiGate, by SNMP

Returns, for each IPsec tunnel of a FortiGate, its state and its traffic in each direction, and the number of tunnels up. Three watches are offered: a tunnel down, a tunnel missing, and a tunnel without traffic.

How it works

The collector reads fgVpnTunTable (FORTINET-FORTIGATE-MIB), one row per phase 2 of a tunnel.

A tunnel is named by its phase 1 and its phase 2 (to-branch/to-branch-lan); two of the same name each keep their own, the second carrying its index.
The state is fgVpnTunEntStatus in words: up or down. "Tunnel down" is critical on down.
The traffic is the rate of fgVpnTunEntInOctets and fgVpnTunEntOutOctets between two runs, in bit/s, for a tunnel up; nothing on the first run.
A dial-up tunnel is listed only while a client is connected, and a tunnel may leave the table when it falls, depending on its configuration: name the tunnels that must stay up in "Missing tunnel".

The collector only reads: SNMP sends nothing but reads.

Prerequisites

SNMP enabled on the FortiGate, reachable from the poller (UDP 161), a community or a user restricted to the poller.
Read-only access, SNMPv2c or SNMPv3, set on the host or one of its folders (protocol:snmp:* variables).
Versions: FortiOS 5, 6 and 7, which serve this table alike. It stays at the common level of fortinet/.

Outputs

Name	Label	Unit	Per instance
`status`	Tunnel state	—	yes, per tunnel
`traffic-in`	Inbound traffic	bit/s	yes, per tunnel
`traffic-out`	Outbound traffic	bit/s	yes, per tunnel
`tunnels-up`	Tunnels up	—	no

Watches

Name	Title	Kind	Defaults	Checked by default
`down`	Tunnel down	state to avoid, on `status`	critical on `down`	yes
`missing`	Missing tunnel	expected instances, on `status`	no tunnel named: it raises nothing until names are set on the probe	no
`idle`	Tunnel without traffic	no activity, on `traffic-in`	warning after 30 min at zero	no

Limits

SSL VPN tunnels are not in this table.
Which tunnels FortiOS keeps in the table while they are down, and which it drops, is not verified here without a device: "Missing tunnel" covers both.