Technical Tip: Email alert notification when IPsec VPN tunnel is down

[aionescu]

Description

This article describes how to use automation stitches to automatically send alert emails if the status of the VPN tunnel changes.

Scope

FortiGate.

Solution

1. Create a new Automation Stitch: Go to Security Fabric -> Automation and select 'Create New'.
2. Assign a name, select Add Trigger -> Create -> FortiOS Event Log, select 'IPsec connection status changed' in the Event field, and select Apply. 

Select Add Action, and select the pencil icon next to Default Email to edit (It is also possible to create a new action). 

Specify the email address that the alerts will be sent to and select Apply:

Select OK to save the changes.

Flushing the tunnel will trigger the event and send the email alert:

The alert email is received:

The following commands can be used for debugging: 

diagnose debug reset
diagnose debug application alertmail -1
diagnose debug enable

Related articles: 

Technical Tip: Configure automation stitch to rece... - Fortinet Community

Technical Tip: How to configure an automation stit... - Fortinet Community

Technical Tip: Configuration of email alert - Fortinet Community