Technical Tip: Email alert notification when IPsec VPN tunnel is down

[aionescu]

Description

This article describes how to use automation stitches to automatically send alert emails if the status of the VPN tunnel changes.

Scope

FortiGate.

Solution

1. Create a new Automation Stitch: Go to Security Fabric -> Automation and select 'Create New'.
2. Assign a name, select Add Trigger -> Create -> FortiOS Event Log, select 'IPsec connection status changed' in the Event field, and select Apply. 

 If multiple IPsec tunnels are configured, use the vpntunnel filter in the Field Filter(s) section to filter for a particular tunnel.

Specify the email address that the alerts will be sent to and select Apply:

Select OK to save the changes. Flushing the tunnel will trigger the event and send the email alert:

The alert email is received:

The following commands can be used for debugging: 

diagnose debug reset
diagnose debug application alertmail -1
diagnose debug enable