Monitor vpntunnel changes via snmp polling

[rickards]

Hi I need to monitor ipsec tunnels on a 50B (FortiOS 4MR2.6) using Nagios but i cannot find the right OID. According to the 4MR2 System Administration manual you can check for example the serialnumber of the device using this OID with snmpget: staff@msys:~$ snmpget -v2c -c public 192.168.10.10 1.3.6.1.4.1.12356.100.1.1.1 iso.3.6.1.4.1.12356.100.1.1.1 = No Such Instance currently exists at this OID But that fails, if i do a snmpwalk of the FG50B i get a few OID' s but i cannot see any related to VPN tunnels. In my snmp config i have enabled the snmpagent listening to any interfaces and i have allowed my host to connect. Under Network/Interface WAN1 i have checked the snmp box. I can see the snmpqueries if i do packet trace on the FG50B Is this possible at all or must i use snmptraps ? Thanks

[ede_pfau]

I use the FORTINET-CORE-MIB.mib and FORTINET-FORTIGATE-MIB.mib for 4.2.6. For the serial no. I get a result with

 .iso.org.dod.internet.private.enterprises.fortinet.fnCoreMib.fnCommon.fnSystem.fnSysSerial
 .1.3.6.1.4.1.12356.100.1.1.1

and the tunnel up/down traps from the FORTINET MIB with

 .iso.org.dod.internet.private.enterprises.fortinet.fnFortiGateMib.fgTraps.fgTrapPrefix.fgTrapVpnTunUp
 .1.3.6.1.4.1.12356.101.2.0.301
 
 .iso.org.dod.internet.private.enterprises.fortinet.fnFortiGateMib.fgTraps.fgTrapPrefix.fgTrapVpnTunDown
 .1.3.6.1.4.1.12356.101.2.0.302

As tunnel up/down are events by nature I' d use traps to detect changes, not polling.

[ede_pfau]

But if you really want to you can use polling:

 .iso.org.dod.internet.private.enterprises.fortinet.fnFortiGateMib.fgVpn.fgVpnTables.fgVpnTunTable.fgVpnTunEntry.fgVpnTunEntStatus
 .1.3.6.1.4.1.12356.101.12.2.2.1.20.X

returns an int, with 1==down, 2==up for tunnel index X.

[rickards]

Thanks! I understand that, snmptraps should be the way to go but with Nagios you can check all sorts of snmp values and send alert emails when they change. Altough i get this: snmpget -v2c -c public 192.168.10.10 iso.1.3.6.1.4.1.12356.101.12.2.2.1.20.X iso.1.3.6.1.4.1.12356.101.12.2.2.1.20.X: Unknown Object Identifier (X) Probably i am have misunderstood something here....

[ede_pfau]

X is a placeholder for an int of range 0.. which is an index into the table of tunnels. You' d better browse the MIB tree to get an overview. I use getif for that, you can use snmpwalk.

[rickards]

Hi I have attached the output of an snmpwalk: $snmpwalk -Os -c public -v 1 192.168.10.1 I cannot find this OID, is it missing on the FG50 ?

[ede_pfau]

c' mmon, you barking up the wrong tree..use the .private.enterprise.fortinet branch that I posted already. Are you sure you' ve compiled the above cited MIBs at all?

[rickards]

Sorry i don' t understand how i can accomplish this, do i need to change the configuration on the FG ? If i do a snmpget according to the manual i think i should get an response like in the System Administration Manual for Fortios V4MR2.6 ? I have not compiled any MIB' s, with snmpwalk i did an search for all OID' s in the firewall. Thanks for you patience :)

[ede_pfau]

You have to get the 2 MIBs I posted above, from support.fortinet.com, from the Fortigate firmware folders of your version. Then you ' make them known' to your snmpget/snmpwalk, a.k.a. compiling. All of this is standard SNMP handling, and has nothing to do with the FGT. You don' t have to change anything in your FGT.