Automatically Disable VPN interface

[fortihaza]

Hello Everyone,

I don't know if what i want is even possible but here it is. I have a client site with two vpns tunnel to two remote locations. What i want is if the ping to an internal ip address in one of the remote locations is fail i want the vpn interface toward that location to be disable.

Thanks in advance.

[Toshi_Esumi]

It's not clear about your final goal is based on the method you described by "disalbe a VPN". If ping through the tunnel goes done, the tunnel is likely down/diabled already whatever the cause is. Then static routes toward the tunnel would have been disabled/disappeared as well. What's your actual goal you want to accomplish when the tunnel is down, not a method.

[emnoc · Accepted solution]

Yeah I would think you could use SDWAN and ipsla monitor or I would run a dynamic-routing over that tunnel lan2lan.

Also not relevant to your issues, but if you want to manually disable a vpn , set the fwpolicy to disable. Without a policy and without a policy enabled, the IKE negotiation will fail or not happen.

Ken Felix

[ede_pfau]

Unfortunately, there is no easy way to really disable a VPN. You can cripple it by disabling the policy as Ken stated but

a) this can be done manually only

and

b) the poor FGT will retry every couple of seconds in vain, filling the VPN log with trash.

VPNs are materialized in virtual interfaces. What if you disable the interface, would that stop a VPN from trying?