Technical Tip: How to configure an automation stitch to provide email alerts when IPSec tunnel dead peer detection fails

1. Configure the Automation stitch under Security Fabric -> Automation -> Stitch -> Create New.

2. Configure an Automation Trigger:
                                        

3. Under FortiOS Event Log, select 'IPsec DPD failed'.
                                                       

4. Add a trigger.
                                                       

5. Configure the Action to send an email:
                                                                   

6. Add the Action to the Automation Stitch:
                                                                    

The automation stitch has now been configured:

Example configuration in the CLI: 

config system automation-trigger

    edit "IPSec_fails"
        set event-type event-log
        set logid 37136
    next
end

config system automation-action
    edit "IPSec_email"
        set action-type email
        set email-to "abc@acb.com"
        set email-subject "IPSec_fails"
    next
end

config system automation-stitch
    edit "Tunnel_fails"
        set trigger "IPSec_fails"
            config actions
                edit 1
                    set action "IPSec_email"
                    set required enable
                next
            end
    next
end

The following logs will trigger an email:

date=2023-10-18 time=02:31:10 eventtime=1697610670144517760 tz="-0400" logid="0101037136" type="event" subtype="vpn" level="error" vd="root" logdesc="IPsec DPD failed" msg="IPsec DPD failure" action="dpd" remip=Y.Y.Y.Y locip=X.X.X.X remport=500 locport=500 outintf="ppp2" cookies="0388753fb48e7e90/0227c1f78015a569" user="Y.Y.Y.Y" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="Head Office" status="dpd_failure" advpnsc=0

Related documents: 

Technical Tip: Configure automation stitch to receive email alert for only particular IPSEC tunnel status change

Technical Tip: Email alert notification when IPsec VPN tunnel is down

Automation stitches