Technical Tip: How to use SNMP monitoring the backup VPN tunnel interface status.

[ChrisTan]

Description	This article describes how to use the correct FortiGate OID to monitor the status of the backup VPN tunnel.
Scope	FortiGate.
Solution	When a backup VPN tunnel monitors the primary tunnel, the VPN tunnel is down, but the interface is still showing up: fgt (backup) # show config vpn ipsec phase1-interface edit "backup" set monitor "vpn1" <----- Monitoring the primary VPN tunnel. end fgt # get sys interface | grep backup == [ backup ] name: backup ip: 10.10.1.3 255.255.255.255 status: up <---- Interface showing up. fgt # diagnose vpn tunnel list list all ipsec tunnel in vd 0 ------------------------------------------------------ name=backup ver=2 serial=9 10.56.245.147:0->10.56.245.148:0 nexthop=0.0.0.0 tun_id=10.56.245.148 tun_id6=::10.56.245.148 status=down dst_mtu=1500 weight=1  <-----Tunnel is down. ------------------------------------------------------ OID: .1.3.6.2.1.2.2.1.8 can only check the interface status so that the backup VPN would show up: To check the VPN interface status, the FortiGate MIB file and FortiGate Core MIB file need to be loaded into the MIB browser. OID: 1.3.6.1.4.1.12356.101.12.2.2.1.20 would show the correct tunnel status: Related article: Technical Tip: How to monitor the individual VPN tunnel by SNMP (OID)