FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes how to monitor the status of the phase 1 tunnel of the IPsec.
Scope
FortiGate.
Solution
It is possible to only monitor the status of the individual phase 2 tunnels. There is no option to only monitor the status of the Phase 1 tunnel using SNMP.
As per the current design, the Kernel no longer sends any carrier on/off netlink events for ipsec interfaces when an SA is added or the last SA is removed; instead the carrier state stays on. If SNMP is monitoring this carrier flag and reporting it through ifOperStatus, that would explain the current behavior. So it is not a reliable indicator of tunnel state; it is better to monitor tunnel state using the VPN-specific OIDs for tunnel status and SA counts.
