Technical Tip: How to configure an automation stitch to provide email alerts when IPSec tunnel dead peer detection fails

[Shashwati]

Description	This article describes how to configure an automation stitch to provide email alerts when the IPSec tunnel dead peer detection fails.
Scope	FortiGate v6.x and v7.x.
Solution	Configure the Automation stitch under Security Fabric -> Automation -> Stitch -> Create New. Configure an Automation Trigger:                                       Under FortiOS Event Log, select 'IPsec DPD failed'.                                                      Add a trigger.                                                      Configure the Action to send an email:                                                                  Add the Action to the Automation Stitch:                                                                   The automation stitch has now been configured: Example configuration in the CLI:  config system automation-trigger     edit "IPSec_fails"         set event-type event-log         set logid 37136     next end config system automation-action     edit "IPSec_email"         set action-type email         set email-to "abc@acb.com"         set email-subject "IPSec_fails"     next end config system automation-stitch     edit "Tunnel_fails"         set trigger "IPSec_fails"             config actions                 edit 1                     set action "IPSec_email"                     set required enable                 next             end     next end The following logs will trigger an email: date=2023-10-18 time=02:31:10 eventtime=1697610670144517760 tz="-0400" logid="0101037136" type="event" subtype="vpn" level="error" vd="root" logdesc="IPsec DPD failed" msg="IPsec DPD failure" action="dpd" remip=Y.Y.Y.Y locip=X.X.X.X remport=500 locport=500 outintf="ppp2" cookies="0388753fb48e7e90/0227c1f78015a569" user="Y.Y.Y.Y" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="Head Office" status="dpd_failure" advpnsc=0 Related documents:  Technical Tip: Configure automation stitch to receive email alert for only particular IPSEC tunnel s... Technical Tip: Email alert notification when IPsec VPN tunnel is down Automation stitches