Troubleshooting Tip: Creating Alerts for IPsec Dial-up VPN Disconnections

An email alert can sometimes be needed when an IPsec dial-up user is disconnecting from the VPN.

To create an alert using automation stitches:

Select Security Fabric -> Automation -> Trigger -> Create New.

Event to be chosen: IPsec connection status changed.

When using this log as a trigger condition, this will trigger on any IPsec tunnels going through a connection change. If the alerts are desired only for a specific tunnel, it is possible to add a filter to the trigger to only act on the desired tunnel name using the example below.

After creating a trigger, an Action can be chosen:

Once the steps above have been completed, navigate to Select Stitch -> Create New.

CLI Reference:

config system automation-trigger

    edit "ipsec_down"

        set event-type event-log

        set logid 37138

            config fields

                edit 1

                    set name "vpntunnel"

                    set value "ipsec-dialup"

                next

            end

    next

end

config system automation-action

    edit "Default Email"

        set action-type email

        set email-to "test@fortinet.com"

        set email-subject "%%log.logdesc%%"

    next

end

config system automation-stitch

    edit "ipsec_down"

        set trigger "ipsec_down"

            config actions

                edit 1

                    set action "Default Email"

                    set required enable

                next

            end

    next

end

Example logs generated when a user connects or disconnects from the VPN:

Ensure that the email server is also correctly configured under System -> Settings -> Email Service:

Alert Email received with log content:

date=2025-07-22 time=15:13:42 devid="FGVM4XXXXXXXX" devname="FGVM4XXXXXXX" eventtime=1753222422448179593 tz="-0700" logid="0101037138" type="event" subtype="vpn" level="notice" vd="root" logdesc="IPsec connection status changed" msg="IPsec connection status change" action="tunnel-up" remip=172.16.0.2 locip=192.168.16.135 remport=500 locport=500 outintf="port2" srccountry="Reserved" cookies="c99940a897c297bd/52c2d9a16a3964b0" user="172.16.0.2" group="N/A" useralt="N/A" eapuser="localuser" eapauthgroup="localgroup" assignip=10.212.134.200 vpntunnel="ipsec-dialup_0" tunnelip=10.212.134.200 tunnelid=755159287 tunneltype="ipsec" duration=0 sentbyte=0 rcvdbyte=0 nextstat=0 fctuid="1AEC0F84EAFE4F21BCCBB012AA3F36BA" advpnsc=0