Skip to main content
WDCB
WDCB
New Member
January 23, 2020
Question

Bring up tunnel with monitor

  • January 23, 2020
  • 1 reply
  • 3608 views

Hi all - newbie here

I have an IPSEC tunnel running to Azure. Every so often this will drop and then I can only via CLI ike reset bring the tunnel up again. I have the Keep Alive setting up, but it does not resolve the issue. Note the WAN interface connected to the ISP does not miss a beat and the one other VPN has not dropped since it was installed. 

 

What I am looking for is a way to execute the cli commands if the VPN interface drop. I am not doing failover since nothing else drops. I just need to find a way to bring the ipsec vpn interface up again ? Any guidelines or links to KB's will be appreciated. Perhaps this can be done in Fortimanager ?

 

Thanks in advance

    1 reply

    m0j0
    m0j0
    New Member
    January 24, 2020

    I do something similar using a bash script and an expect script.  The bash script performs an SNMP query to check the state of the tunnel interface.  If not up, it calls the expect script which logs into the Fortigate and executes a series of cli commands.

     

    Run the script via a cronjob every 5 minutes or however frequently you want - I only run it every 5 minutes to give the tunnel a chance to establish before I'm running the script again and checking the tunnel state.

     

    Mark

     

    m0j0
    m0j0
    New Member
    January 24, 2020

    Here's my shell script.  I've sanitized it a little to remove email addresses.  Your oid is likely to be different so you'll have to work that out.  I've used a variable in my oid so I can easily change it to run this against a different tunnel interface if I want.  I've also got a system to check if the tunnel has just transitioned state (up or down) and if so, so a relevant email (and pushover notification via email) just so I'm aware something's happened and I have a track record of how frequently it's happening.  Yes, I could log it, but I'd get lazy and stop checking logs.

     

    The expect file you'll have to do yourself.  If you're not familiar with expect, it can take a bit of getting used to, but you can always use autoexpect to create your file.  It basically records what you're doing and creates a script from your keystrokes and what's been return.  The script may need tweaking.  Just google it, there's plenty of info out there.

     

    #!/bin/bash
    LOCKFILE="/var/run/tunneltest.lock"
    ID="21"
    tunnelState=$(snmpwalk -v 2c -On -c public 10.66.67.1 .1.3.6.1.2.1.2.2.1.8.$ID | cut -d':' -f2 | cut -d'(' -f2 | cut -d ')' -f1)
    echo $tunnelState

    # Check if tunnel is up.
    if [ "$tunnelState" -eq "1" ]; then
      if [ -f "$LOCKFILE" ]; then
        # If lockfile exists but tunnel is up, then this has transitioned from down state. Delete lockfile and notify back up.
        rm $LOCKFILE
        echo "The tunnel to RemoteSite is back up. Carry on." > /tmp/tunneltest.txt
        mailx -s "RemoteSite Tunnel is back UP" <pushover email address> < /tmp/tunneltest.txt &
        mailx -s "RemoteSite Tunnel is back UP" <pushover email address> < /tmp/tunneltest.txt &
        exit 0
      else
        # Tunnel is still up. Do nothing.
        exit 0
      fi
    fi

    #If we've made it this far, tunnel is down. Perform additional checks to see if it has just gone down.
    if [ -f "$LOCKFILE" ]; then
      #Tunnel is still down. Don't bother sending multiple notifications.
      expect -f /path/to/expect.script
      exit 0
    else
      #Tunnel is has gone down. Create lockfile and notify of tunnel going down.
      touch $LOCKFILE
      echo "Shit hath hit the fan and your tunnel to RemoteSite is down. Restarting IKE process." > /tmp/tunneltest.txt
      mailx -s "RemoteSite Tunnel is DOWN" <pushover email address> < /tmp/tunneltest.txt &
      mailx -s "RemoteSite Tunnel is DOWN" <personal email address> < /tmp/tunneltest.txt &
      expect -f /path/to/expect.script
    fi

    Terms & ConditionsAccessibility statement