AUTO STITCH FOR IPSEV VPN TUNNEL

[chrispng]

Hello,

I am trying to find a way to make an auto stitch to trigger and work when a user disconects or connects on a remote ipsec tunnel and send an email. I have it set up but cant see emails comming. Any ideas?

FGT60F # config system automation-stitch

FGT60F(automation-stitch) # edit "VPNIPSEC"

FGT60F (VPNIPSEC) # show
config system automation-stitch
edit "VPNIPSEC"
set trigger "IPSEC VPN UP"
config actions
edit 1
set action "Email Notification"
set required enable
next
end
next
end

FGT60F (VPNIPSEC) #

config system automation-trigger

FGT60F (automation-trigger) # edit "VPNIPSEC"
new entry 'VPNIPSEC' added

FGT60F (VPNIPSEC) # show
config system automation-trigger
edit "VPNIPSEC"
next
end

config system automation-action

FGT60F (automation-action) # edit "VPNIPSEC"
new entry 'VPNIPSEC' added

FGT60F (VPNIPSEC) # show
config system automation-action
edit "VPNIPSEC"
next
end

[AEK]

Hi Chris

First of all, under the automation menu, check if the related trigger count is incrementing when the needed IPsec event occurs. If not then you are using the wrong trigger.

Also the below tech tip may help.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-alert-notification-when-IPsec-VPN-tu...

[chrispng]

I tried the guide as stated too. trigger count is 0

[AEK]

It means you are probably using the wrong trigger.

Try check in the VPN logs which message is generated when your event occurs. Once you find it you can use the same id in the trigger and it should work.

[chrispng]

i am trying to track certain users logging in vpn and out so i use xauth and username,BUT with no avail. Is that the correct source for the trigger or should i use smthng else?

[AEK]

In the VPN logs do you see such messages?

This is the event id you should use in your trigger.

[chrispng]

thats what i am using and not working right now

[AEK · Accepted solution]

Probably a filter issue.

Can you remove the 3 filters and see if the event is triggered? If it works then add one by one to find which one is causing the issue.

[chrispng]

It seems it cant handle 3 users in the same trigger, i created different stiches and triggers in order to work for multiple users